release.yml

name: Release Kodo Desktop

on:
  push:
    tags:
      - "v*.*.*"
  workflow_dispatch:
    inputs:
      version:
        description: "Release version (for example 1.2.3 or v1.2.3)"
        required: true
        type: string

permissions:
  contents: write
  id-token: write

jobs:
  preflight:
    name: Preflight
    runs-on: ubuntu-24.04
    timeout-minutes: 15
    outputs:
      version: ${{ steps.release_meta.outputs.version }}
      tag: ${{ steps.release_meta.outputs.tag }}
      is_prerelease: ${{ steps.release_meta.outputs.is_prerelease }}
      make_latest: ${{ steps.release_meta.outputs.make_latest }}
      ref: ${{ github.sha }}
    steps:
      - name: Checkout
        uses: actions/checkout@v6

      - id: release_meta
        name: Resolve release version
        shell: bash
        run: |
          if [[ "${GITHUB_EVENT_NAME}" == "workflow_dispatch" ]]; then
            raw="${{ github.event.inputs.version }}"
          else
            raw="${GITHUB_REF_NAME}"
          fi

          version="${raw#v}"
          if [[ ! "$version" =~ ^[0-9]+\.[0-9]+\.[0-9]+([.-][0-9A-Za-z.-]+)?$ ]]; then
            echo "Invalid release version: $raw" >&2
            exit 1
          fi

          echo "version=$version" >> "$GITHUB_OUTPUT"
          echo "tag=v$version" >> "$GITHUB_OUTPUT"
          if [[ "$version" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
            echo "is_prerelease=false" >> "$GITHUB_OUTPUT"
            echo "make_latest=true" >> "$GITHUB_OUTPUT"
          else
            echo "is_prerelease=true" >> "$GITHUB_OUTPUT"
            echo "make_latest=false" >> "$GITHUB_OUTPUT"
          fi

      - name: Setup Bun
        uses: oven-sh/setup-bun@v2
        with:
          bun-version-file: package.json

      - name: Setup Node
        uses: actions/setup-node@v6
        with:
          node-version-file: package.json

      - name: Cache Bun and Turbo
        uses: actions/cache@v5
        with:
          path: |
            ~/.bun/install/cache
            .turbo
          key: ${{ runner.os }}-bun-${{ hashFiles('bun.lock') }}-${{ hashFiles('turbo.json', 'apps/*/turbo.jsonc') }}
          restore-keys: |
            ${{ runner.os }}-bun-${{ hashFiles('bun.lock') }}-

      - name: Cache Playwright browsers
        uses: actions/cache@v5
        with:
          path: ~/.cache/ms-playwright
          key: ${{ runner.os }}-playwright-${{ hashFiles('bun.lock') }}
          restore-keys: |
            ${{ runner.os }}-playwright-

      - name: Install dependencies
        run: bun install --frozen-lockfile

      - name: Format
        run: bun run fmt:check

      - name: Lint
        run: bun run lint

      - name: Typecheck
        run: bun run typecheck

      - name: Test
        run: bun run test

      - name: Install browser test runtime
        run: |
          cd apps/web
          bunx playwright install --with-deps chromium

      - name: Browser test
        run: bun run --cwd apps/web test:browser

      - name: Release smoke
        run: bun run release:smoke

  build:
    name: Build ${{ matrix.label }}
    needs: preflight
    runs-on: ${{ matrix.runner }}
    timeout-minutes: 30
    strategy:
      fail-fast: false
      matrix:
        include:
          - label: macOS arm64
            runner: macos-14
            platform: mac
            target: dmg
            arch: arm64
          - label: macOS x64
            runner: macos-15-intel
            platform: mac
            target: dmg
            arch: x64
          - label: Linux x64
            runner: ubuntu-24.04
            platform: linux
            target: AppImage
            arch: x64
          - label: Windows x64
            runner: windows-2022
            platform: win
            target: nsis
            arch: x64
    steps:
      - name: Checkout
        uses: actions/checkout@v6
        with:
          ref: ${{ needs.preflight.outputs.ref }}
          fetch-depth: 0

      - name: Setup Bun
        uses: oven-sh/setup-bun@v2
        with:
          bun-version-file: package.json

      - name: Setup Node
        uses: actions/setup-node@v6
        with:
          node-version-file: package.json

      - name: Cache Bun and Turbo
        uses: actions/cache@v5
        with:
          path: |
            ~/.bun/install/cache
            .turbo
          key: ${{ runner.os }}-bun-${{ hashFiles('bun.lock') }}-${{ hashFiles('turbo.json', 'apps/*/turbo.jsonc') }}
          restore-keys: |
            ${{ runner.os }}-bun-${{ hashFiles('bun.lock') }}-

      - name: Cache Electron builder artifacts
        uses: actions/cache@v5
        with:
          path: |
            ~/.cache/electron
            ~/.cache/electron-builder
          key: ${{ runner.os }}-electron-builder-${{ hashFiles('bun.lock') }}
          restore-keys: |
            ${{ runner.os }}-electron-builder-

      - name: Install dependencies
        run: bun install --frozen-lockfile

      - name: Install Linux AppImage update tooling
        if: matrix.platform == 'linux'
        shell: bash
        run: |
          set -euo pipefail
          sudo apt-get update
          sudo apt-get install -y zsync
          mkdir -p "${RUNNER_TEMP}/appimage-tools"
          curl -L \
            https://github.com/AppImage/appimagetool/releases/download/continuous/appimagetool-x86_64.AppImage \
            -o "${RUNNER_TEMP}/appimage-tools/appimagetool-x86_64.AppImage"
          chmod +x "${RUNNER_TEMP}/appimage-tools/appimagetool-x86_64.AppImage"

      - name: Align package versions to release version
        run: node scripts/update-release-package-versions.ts "${{ needs.preflight.outputs.version }}"

      - name: Build desktop artifact
        shell: bash
        env:
          CSC_LINK: ${{ secrets.CSC_LINK }}
          CSC_KEY_PASSWORD: ${{ secrets.CSC_KEY_PASSWORD }}
          APPLE_API_KEY: ${{ secrets.APPLE_API_KEY }}
          APPLE_API_KEY_ID: ${{ secrets.APPLE_API_KEY_ID }}
          APPLE_API_ISSUER: ${{ secrets.APPLE_API_ISSUER }}
          AZURE_TENANT_ID: ${{ secrets.AZURE_TENANT_ID }}
          AZURE_CLIENT_ID: ${{ secrets.AZURE_CLIENT_ID }}
          AZURE_CLIENT_SECRET: ${{ secrets.AZURE_CLIENT_SECRET }}
          AZURE_TRUSTED_SIGNING_ENDPOINT: ${{ secrets.AZURE_TRUSTED_SIGNING_ENDPOINT }}
          AZURE_TRUSTED_SIGNING_ACCOUNT_NAME: ${{ secrets.AZURE_TRUSTED_SIGNING_ACCOUNT_NAME }}
          AZURE_TRUSTED_SIGNING_CERTIFICATE_PROFILE_NAME: ${{ secrets.AZURE_TRUSTED_SIGNING_CERTIFICATE_PROFILE_NAME }}
          AZURE_TRUSTED_SIGNING_PUBLISHER_NAME: ${{ secrets.AZURE_TRUSTED_SIGNING_PUBLISHER_NAME }}
          T3CODE_APPIMAGETOOL: ${{ runner.temp }}/appimage-tools/appimagetool-x86_64.AppImage
        run: |
          args=(
            --platform "${{ matrix.platform }}"
            --target "${{ matrix.target }}"
            --arch "${{ matrix.arch }}"
            --build-version "${{ needs.preflight.outputs.version }}"
            --verbose
          )

          has_all() {
            for value in "$@"; do
              if [[ -z "$value" ]]; then
                return 1
              fi
            done
            return 0
          }

          if [[ "${{ matrix.platform }}" == "mac" ]]; then
            if has_all "$CSC_LINK" "$CSC_KEY_PASSWORD" "$APPLE_API_KEY" "$APPLE_API_KEY_ID" "$APPLE_API_ISSUER"; then
              key_path="$RUNNER_TEMP/AuthKey_${APPLE_API_KEY_ID}.p8"
              printf '%s' "$APPLE_API_KEY" > "$key_path"
              export APPLE_API_KEY="$key_path"
              echo "macOS signing enabled."
              args+=(--signed)
            else
              echo "macOS signing disabled (missing one or more Apple signing secrets)."
            fi
          elif [[ "${{ matrix.platform }}" == "win" ]]; then
            if has_all \
              "$AZURE_TENANT_ID" \
              "$AZURE_CLIENT_ID" \
              "$AZURE_CLIENT_SECRET" \
              "$AZURE_TRUSTED_SIGNING_ENDPOINT" \
              "$AZURE_TRUSTED_SIGNING_ACCOUNT_NAME" \
              "$AZURE_TRUSTED_SIGNING_CERTIFICATE_PROFILE_NAME" \
              "$AZURE_TRUSTED_SIGNING_PUBLISHER_NAME"; then
              echo "Windows signing enabled (Azure Trusted Signing)."
              args+=(--signed)
            else
              echo "Windows signing disabled (missing one or more Azure Trusted Signing secrets)."
            fi
          else
            echo "Signing disabled for ${{ matrix.platform }}."
          fi

          bun run dist:desktop:artifact -- "${args[@]}"

      - name: Verify Linux AppImage update metadata
        if: matrix.platform == 'linux'
        shell: bash
        run: |
          set -euo pipefail
          appimage=$(find release -maxdepth 1 -type f -name '*.AppImage' | head -n1)
          if [[ -z "$appimage" ]]; then
            echo "Linux AppImage was not produced." >&2
            exit 1
          fi

          update_info=$("$appimage" --appimage-updateinformation)
          printf '%s\n' "$update_info"
          [[ "$update_info" == gh-releases-zsync\|boggedbrush\|KodoCode\|latest\|Kodo-Code-\*-x86_64.AppImage.zsync ]]

      - name: Collect release assets
        shell: bash
        run: |
          set -euo pipefail
          mkdir -p release-publish

          shopt -s nullglob
          for pattern in \
            "release/*.dmg" \
            "release/*.zip" \
            "release/*.AppImage" \
            "release/*.AppImage.zsync" \
            "release/*.exe" \
            "release/*.blockmap" \
            "release/latest*.yml"; do
            for file in $pattern; do
              cp "$file" release-publish/
            done
          done

          if [[ "${{ matrix.platform }}" == "mac" && "${{ matrix.arch }}" != "arm64" ]]; then
            if [[ -f release-publish/latest-mac.yml ]]; then
              mv release-publish/latest-mac.yml "release-publish/latest-mac-${{ matrix.arch }}.yml"
            fi
          fi

      - name: Upload build artifacts
        uses: actions/upload-artifact@v7
        with:
          name: desktop-${{ matrix.platform }}-${{ matrix.arch }}
          path: release-publish/*
          if-no-files-found: error

  publish_desktop:
    name: Publish Desktop Release
    needs: [preflight, build]
    runs-on: ubuntu-24.04
    timeout-minutes: 10
    steps:
      - name: Checkout
        uses: actions/checkout@v6
        with:
          ref: ${{ needs.preflight.outputs.ref }}

      - name: Setup Node
        uses: actions/setup-node@v6
        with:
          node-version-file: package.json

      - name: Download desktop artifacts
        uses: actions/download-artifact@v5
        with:
          pattern: desktop-*
          path: release-assets
          merge-multiple: true

      - name: Merge macOS update manifests
        shell: bash
        run: |
          set -euo pipefail

          # Each matrix job uploads its own artifact bundle, so the final release job must
          # reassemble the shared asset directory and merge the per-arch mac updater manifests
          # before anything is published to GitHub Releases.
          if [[ -f release-assets/latest-mac.yml && -f release-assets/latest-mac-x64.yml ]]; then
            node scripts/merge-mac-update-manifests.ts \
              release-assets/latest-mac.yml \
              release-assets/latest-mac-x64.yml
          fi

      - name: Verify release asset bundle
        shell: bash
        run: |
          set -euo pipefail
          shopt -s nullglob
          assets=(
            release-assets/*.dmg
            release-assets/*.zip
            release-assets/*.AppImage
            release-assets/*.AppImage.zsync
            release-assets/*.exe
            release-assets/*.blockmap
            release-assets/latest*.yml
          )

          if [[ ${#assets[@]} -eq 0 ]]; then
            echo "No desktop release assets were assembled for publication." >&2
            exit 1
          fi

          printf '%s\n' "${assets[@]}"

      - name: Publish desktop assets to GitHub Releases
        uses: softprops/action-gh-release@v2
        with:
          tag_name: ${{ needs.preflight.outputs.tag }}
          target_commitish: ${{ needs.preflight.outputs.ref }}
          prerelease: ${{ needs.preflight.outputs.is_prerelease == 'true' }}
          make_latest: ${{ needs.preflight.outputs.make_latest }}
          generate_release_notes: true
          files: |
            release-assets/*

  publish_cli:
    name: Publish CLI to npm
    needs: [preflight, build]
    if: ${{ vars.KODO_RELEASE_PUBLISH_CLI == 'true' }}
    runs-on: ubuntu-24.04
    timeout-minutes: 10
    steps:
      - name: Checkout
        uses: actions/checkout@v6
        with:
          ref: ${{ needs.preflight.outputs.ref }}

      - name: Setup Bun
        uses: oven-sh/setup-bun@v2
        with:
          bun-version-file: package.json

      - name: Setup Node
        uses: actions/setup-node@v6
        with:
          node-version-file: package.json
          registry-url: https://registry.npmjs.org

      - name: Cache Bun and Turbo
        uses: actions/cache@v5
        with:
          path: |
            ~/.bun/install/cache
            .turbo
          key: ${{ runner.os }}-bun-${{ hashFiles('bun.lock') }}-${{ hashFiles('turbo.json', 'apps/*/turbo.jsonc') }}
          restore-keys: |
            ${{ runner.os }}-bun-${{ hashFiles('bun.lock') }}-

      - name: Install dependencies
        run: bun install --frozen-lockfile

      - name: Align package versions to release version
        run: node scripts/update-release-package-versions.ts "${{ needs.preflight.outputs.version }}"

      - name: Build CLI package
        run: bun run build --filter=@t3tools/web --filter=kodo

      - name: Publish CLI package
        run: |
          # Pre-releases must not move npm's stable latest dist-tag.
          # We pass --provenance so npm can attach the GitHub OIDC attestation.
          # Trusted publishing should authenticate via this workflow's id-token permission.
          npm_tag=latest
          if [[ "${{ needs.preflight.outputs.is_prerelease }}" == "true" ]]; then
            npm_tag=next
          fi
          node apps/server/scripts/cli.ts publish \
            --tag "$npm_tag" \
            --app-version "${{ needs.preflight.outputs.version }}" \
            --provenance \
            --verbose