desktop-build.yml

name: Desktop App CI

permissions:
  contents: read
  id-token: write
  attestations: write
  artifact-metadata: write

on:
  push:
    branches: [master]

jobs:
  build-macos:
    runs-on: macos-26-xlarge
    steps:
      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # was v4
        with:
          persist-credentials: false

      # Xcode 26.5 is temporarily exposed as a beta app on macos-26 runners: https://github.com/actions/runner-images/issues/14108
      - name: Select Xcode 26.5
        run: |
          set -euo pipefail
          for xcode_app in \
            /Applications/Xcode_26.5.0.app \
            /Applications/Xcode_26.5_beta_2.app \
            /Applications/Xcode_26.5_beta.app
          do
            if [ -x "${xcode_app}/Contents/Developer/usr/bin/xcodebuild" ]; then
              sudo xcode-select -s "${xcode_app}/Contents/Developer"
              xcodebuild -version
              exit 0
            fi
          done
          echo "Xcode 26.5 is not installed on this runner." >&2
          ls -1 /Applications/Xcode*.app >&2 || true
          exit 1

      - name: Install Nix
        uses: DeterminateSystems/nix-installer-action@ef8a148080ab6020fd15196c2084a2eea5ff2d25 # was v22
        with:
          github-token: ""

      - name: Cache sccache
        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # was v4
        with:
          path: ~/Library/Caches/Mozilla.sccache
          key: ${{ runner.os }}-sccache-macos-release-${{ hashFiles('**/Cargo.lock') }}
          restore-keys: |
            ${{ runner.os }}-sccache-macos-release-
            ${{ runner.os }}-sccache-macos-
            ${{ runner.os }}-sccache-

      - name: Build Tauri App (macOS, signed)
        run: nix develop .#ci -c ./scripts/ci/desktop-release.sh
        env:
          TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
          TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
          APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }}
          APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
          APPLE_ID: ${{ secrets.APPLE_ID }}
          APPLE_PASSWORD: ${{ secrets.APPLE_ID_PASSWORD }}
          APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}

      - name: Show sccache stats
        if: always()
        run: nix develop .#ci -c sccache --show-stats

      - name: Collect macOS release checksums
        run: |
          nix develop .#ci -c ./scripts/ci/attestation-manifest.sh \
            desktop-macos-artifacts.sha256 \
            frontend/src-tauri/target/reproducibility/desktop-release-macos-final.sha256 \
            frontend/src-tauri/target/reproducibility/desktop-release-macos-*.sha256
          cat desktop-macos-artifacts.sha256

      - name: Attest macOS release artifacts
        # Keep uploads/verifiers running if GitHub token policy rejects artifact attestation.
        continue-on-error: true
        uses: actions/attest@281a49d4cbb0a72c9575a50d18f6deb515a11deb # was v4
        with:
          subject-checksums: desktop-macos-artifacts.sha256

      - name: Upload macOS Build
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # was v4
        with:
          name: maple-macos-universal
          path: |
            frontend/src-tauri/target/universal-apple-darwin/release/bundle/dmg/*.dmg
            frontend/src-tauri/target/universal-apple-darwin/release/bundle/macos/*.app
            frontend/src-tauri/target/universal-apple-darwin/release/bundle/macos/*.app.tar.gz
            frontend/src-tauri/target/universal-apple-darwin/release/bundle/macos/*.app.tar.gz.sig
            frontend/src-tauri/target/reproducibility/*.sha256
          retention-days: 5

  build-linux:
    runs-on: ubuntu-latest-8-cores
    steps:
      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # was v4
        with:
          persist-credentials: false

      - name: Install Nix
        uses: DeterminateSystems/nix-installer-action@ef8a148080ab6020fd15196c2084a2eea5ff2d25 # was v22
        with:
          github-token: ""

      - name: Cache sccache
        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # was v4
        with:
          path: ~/.cache/sccache
          key: ${{ runner.os }}-sccache-linux-release-${{ hashFiles('**/Cargo.lock') }}
          restore-keys: |
            ${{ runner.os }}-sccache-linux-release-
            ${{ runner.os }}-sccache-linux-
            ${{ runner.os }}-sccache-

      # Ubuntu 24.04 restricts unprivileged user namespaces by default; linuxdeploy/AppImage
      # packaging uses bubblewrap and otherwise fails with "bwrap: setting up uid map: Permission denied".
      - name: Allow bubblewrap user namespaces
        run: |
          set -euo pipefail
          if [ -e /proc/sys/kernel/apparmor_restrict_unprivileged_userns ]; then
            sudo sysctl -w kernel.apparmor_restrict_unprivileged_userns=0
          fi
          if [ -e /proc/sys/kernel/unprivileged_userns_clone ]; then
            sudo sysctl -w kernel.unprivileged_userns_clone=1
          fi

      - name: Build Tauri App (Linux, signed updater)
        run: nix develop .#desktop-linux -c ./scripts/ci/desktop-release.sh
        env:
          APPIMAGE_EXTRACT_AND_RUN: "1"
          NO_STRIP: "true"
          TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
          TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}

      - name: Show sccache stats
        if: always()
        run: nix develop .#desktop-linux -c sccache --show-stats

      - name: Collect Linux release checksums
        run: |
          nix develop .#desktop-linux -c ./scripts/ci/attestation-manifest.sh \
            desktop-linux-artifacts.sha256 \
            frontend/src-tauri/target/reproducibility/desktop-release-linux-final.sha256 \
            frontend/src-tauri/target/reproducibility/desktop-release-linux-*.sha256
          cat desktop-linux-artifacts.sha256

      - name: Attest Linux release artifacts
        # Keep uploads/verifiers running if GitHub token policy rejects artifact attestation.
        continue-on-error: true
        uses: actions/attest@281a49d4cbb0a72c9575a50d18f6deb515a11deb # was v4
        with:
          subject-checksums: desktop-linux-artifacts.sha256

      - name: Upload Linux Builds
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # was v4
        with:
          name: maple-linux
          path: |
            frontend/src-tauri/target/release/bundle/appimage/*.AppImage
            frontend/src-tauri/target/release/bundle/appimage/*.AppImage.sig
            frontend/src-tauri/target/release/bundle/deb/*.deb
            frontend/src-tauri/target/release/bundle/deb/*.deb.sig
            frontend/src-tauri/target/release/bundle/rpm/*.rpm
            frontend/src-tauri/target/release/bundle/rpm/*.rpm.sig
            frontend/src-tauri/target/reproducibility/*.sha256
          retention-days: 5

  verify-linux-desktop-artifacts:
    needs:
      - build-linux
    runs-on: ubuntu-latest-8-cores
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # was v4
        with:
          persist-credentials: false

      - name: Install Nix
        uses: DeterminateSystems/nix-installer-action@ef8a148080ab6020fd15196c2084a2eea5ff2d25 # was v22
        with:
          github-token: ""

      - name: Download Linux desktop artifacts
        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # was v4
        with:
          name: maple-linux
          path: artifacts

      - name: Verify Linux desktop artifact reproducibility proofs
        run: nix develop .#desktop-linux -c ./scripts/ci/verify-release-artifacts.sh artifacts linux

  verify-macos-desktop-artifacts:
    needs:
      - build-macos
    runs-on: macos-26-xlarge
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # was v4
        with:
          persist-credentials: false

      - name: Install Nix
        uses: DeterminateSystems/nix-installer-action@ef8a148080ab6020fd15196c2084a2eea5ff2d25 # was v22
        with:
          github-token: ""

      - name: Download macOS desktop artifacts
        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # was v4
        with:
          name: maple-macos-universal
          path: artifacts

      - name: Verify macOS desktop artifact reproducibility proofs
        run: nix develop .#ci -c ./scripts/ci/verify-release-artifacts.sh artifacts macos

  build-windows:
    runs-on: windows-2025
    environment: windows-signing
    env:
      MAPLE_WINDOWS_ARTIFACT_SIGNING_ENDPOINT: ${{ secrets.AZURE_ARTIFACT_SIGNING_ENDPOINT }}
      MAPLE_WINDOWS_ARTIFACT_SIGNING_ACCOUNT_NAME: ${{ secrets.AZURE_ARTIFACT_SIGNING_ACCOUNT_NAME }}
      MAPLE_WINDOWS_ARTIFACT_SIGNING_CERTIFICATE_PROFILE_NAME: ${{ secrets.AZURE_ARTIFACT_SIGNING_CERTIFICATE_PROFILE_NAME }}
    steps:
      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # was v4
        with:
          persist-credentials: false

      - name: Setup Bun
        uses: oven-sh/setup-bun@f4d14e03ff726c06358e5557344e1da148b56cf7 # was v1
        with:
          bun-version: 1.3.5

      - name: Install Rust
        uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # was stable
        with:
          toolchain: 1.94.1

      - name: Install sccache
        shell: bash
        run: |
          SCCACHE_VERSION=0.8.2
          SCCACHE_SHA256="de5e9f66bb8a6bbdf0e28cb8a086a8d12699af796bf70bcd9dc40d80715bf9b8"
          SCCACHE_ARCHIVE="sccache-v${SCCACHE_VERSION}-x86_64-pc-windows-msvc.tar.gz"
          SCCACHE_URL="https://github.com/mozilla/sccache/releases/download/v${SCCACHE_VERSION}/${SCCACHE_ARCHIVE}"
          # Run download/verify/extract inside a subshell cd'd to RUNNER_TEMP so
          # the archive and target dir are referenced by relative names. MSYS2 tar
          # mangles Windows paths like D:\a when given absolute -C/-f arguments
          # (even with --force-local); relative paths sidestep that.
          (
            cd "$RUNNER_TEMP"
            curl --fail --location --show-error --silent "$SCCACHE_URL" --output "$SCCACHE_ARCHIVE"
            echo "${SCCACHE_SHA256}  ${SCCACHE_ARCHIVE}" | sha256sum --check -
            tar xzf "$SCCACHE_ARCHIVE"
          )
          SCCACHE_BIN_DIR="$RUNNER_TEMP/sccache-v${SCCACHE_VERSION}-x86_64-pc-windows-msvc"
          echo "$SCCACHE_BIN_DIR" >> "$GITHUB_PATH"
          "$SCCACHE_BIN_DIR/sccache.exe" --version

      - name: Cache sccache
        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # was v4
        with:
          path: ~\AppData\Local\Mozilla\sccache
          key: ${{ runner.os }}-sccache-windows-${{ hashFiles('**/Cargo.lock') }}
          restore-keys: |
            ${{ runner.os }}-sccache-windows-
            ${{ runner.os }}-sccache-

      - name: Build Windows app executable
        shell: bash
        run: ./scripts/ci/desktop-windows-release.sh build

      - name: Bundle Windows unsigned installer baseline
        shell: bash
        run: ./scripts/ci/desktop-windows-release.sh unsigned-bundle

      - name: Azure login for Artifact Signing
        uses: azure/login@2dd0bbf4064d5a1812889dc200bb8eed2597f82a # was v3
        with:
          client-id: ${{ secrets.AZURE_CLIENT_ID }}
          tenant-id: ${{ secrets.AZURE_TENANT_ID }}
          subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}

      - name: Install Artifact Signing module
        shell: pwsh
        run: ./scripts/ci/install-windows-artifact-signing.ps1

      - name: Bundle Windows installer
        shell: bash
        run: ./scripts/ci/desktop-windows-release.sh bundle

      - name: Resolve Windows installer paths
        shell: bash
        run: |
          set -euo pipefail
          source scripts/ci/_common.sh
          setup_exe="$(windows_release_setup_exe_required)"
          echo "MAPLE_WINDOWS_SETUP_EXE_REL=$(repo_relative_path "${setup_exe}")" >> "${GITHUB_ENV}"

      - name: Install minisign
        shell: pwsh
        run: ./scripts/ci/install-windows-minisign.ps1

      - name: Finalize Windows updater signatures and checksums
        shell: bash
        run: ./scripts/ci/desktop-windows-release.sh finalize
        env:
          TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
          TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}

      - name: Show sccache stats
        if: always()
        run: sccache --show-stats

      - name: Collect Windows release checksums
        shell: bash
        run: |
          ./scripts/ci/attestation-manifest.sh \
            desktop-windows-artifacts.sha256 \
            frontend/src-tauri/target/reproducibility/desktop-release-windows-final.sha256 \
            frontend/src-tauri/target/reproducibility/desktop-release-windows-signed-canonical.sha256 \
            frontend/src-tauri/target/reproducibility/desktop-release-windows-runtime-dlls.sha256
          cat desktop-windows-artifacts.sha256

      - name: Attest Windows release artifacts
        uses: actions/attest@281a49d4cbb0a72c9575a50d18f6deb515a11deb # was v4
        with:
          subject-checksums: desktop-windows-artifacts.sha256

      - name: Upload Windows Build
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # was v4
        with:
          name: maple-windows-x64
          path: |
            ${{ env.MAPLE_WINDOWS_SETUP_EXE_REL }}
            ${{ env.MAPLE_WINDOWS_SETUP_EXE_REL }}.sig
            frontend/src-tauri/target/reproducibility/desktop-release-windows-*.sha256
          retention-days: 5

  verify-windows-desktop-artifacts:
    needs:
      - build-windows
    runs-on: ubuntu-latest-8-cores
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # was v4
        with:
          persist-credentials: false

      - name: Install Nix
        uses: DeterminateSystems/nix-installer-action@ef8a148080ab6020fd15196c2084a2eea5ff2d25 # was v22
        with:
          github-token: ""

      - name: Download Windows desktop artifacts
        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # was v4
        with:
          name: maple-windows-x64
          path: artifacts

      - name: Verify Windows desktop artifact reproducibility proofs
        run: nix develop .#ci -c ./scripts/ci/verify-release-artifacts.sh artifacts windows

  verify-desktop-artifacts:
    needs:
      - verify-linux-desktop-artifacts
      - verify-macos-desktop-artifacts
      - verify-windows-desktop-artifacts
    runs-on: ubuntu-latest
    steps:
      - name: Verify desktop artifact checks completed
        run: echo "Desktop artifact verification completed for Linux, macOS, and Windows."