release-artifacts.yml

name: Release artifacts

env:
  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true

on:
  push:
    branches:
      - dev
      - main
    tags:
      - "v*"
  workflow_dispatch:

concurrency:
  group: release-artifacts-${{ github.event_name }}-${{ github.ref }}
  cancel-in-progress: true

permissions:
  contents: write
  id-token: write

jobs:
  build:
    name: Build ${{ matrix.name }}
    runs-on: ${{ matrix.runs_on }}
    strategy:
      fail-fast: false
      matrix:
        include:
          - name: linux-x64
            runs_on: ubuntu-24.04
          - name: linux-arm64
            runs_on: ubuntu-24.04-arm
          - name: windows-x64
            runs_on: windows-2025
          - name: windows-arm64
            runs_on: windows-11-arm
          - name: macos-arm64
            runs_on: macos-15
          - name: macos-x64
            runs_on: macos-15-intel

    steps:
      - uses: actions/checkout@v6

      - uses: oven-sh/setup-bun@v2
        with:
          bun-version: 1.3.14
          no-cache: true

      - uses: actions/setup-node@v6
        with:
          node-version: 24.15.0

      - name: Install Linux build dependencies
        if: runner.os == 'Linux'
        run: |
          architecture=$(dpkg --print-architecture)
          codename=$(. /etc/os-release && printf '%s' "$VERSION_CODENAME")
          sources_file=$(mktemp)

          case "$architecture" in
            amd64)
              cat >"$sources_file" <<EOF
          deb [arch=amd64] https://archive.ubuntu.com/ubuntu $codename main universe
          deb [arch=amd64] https://archive.ubuntu.com/ubuntu $codename-updates main universe
          deb [arch=amd64] https://security.ubuntu.com/ubuntu $codename-security main universe
          EOF
              ;;
            arm64)
              cat >"$sources_file" <<EOF
          deb [arch=arm64] https://ports.ubuntu.com/ubuntu-ports $codename main universe
          deb [arch=arm64] https://ports.ubuntu.com/ubuntu-ports $codename-updates main universe
          deb [arch=arm64] https://ports.ubuntu.com/ubuntu-ports $codename-security main universe
          EOF
              ;;
            *)
              echo "Unsupported Linux build architecture: $architecture" >&2
              exit 1
              ;;
          esac

          apt_options=(
            -o "Dir::Etc::sourcelist=$sources_file"
            -o "Dir::Etc::sourceparts=-"
            -o "Acquire::ForceIPv4=true"
            -o "Acquire::Retries=2"
            -o "Acquire::https::Timeout=20"
          )

          sudo timeout 180 apt-get "${apt_options[@]}" update
          sudo timeout 180 apt-get "${apt_options[@]}" install -y --no-install-recommends \
            build-essential \
            cmake \
            pkg-config \
            unzip

      - name: Install dependencies
        shell: bash
        run: |
          if ! bun install --frozen-lockfile; then
            echo "Initial bun install failed; clearing Bun package cache and retrying once"
            bun pm cache rm
            bun install --frozen-lockfile
          fi

      - name: Install Windows ARM64 Rollup native package
        if: matrix.name == 'windows-arm64'
        run: npm install --no-save --ignore-scripts --no-audit --no-fund @rollup/rollup-win32-arm64-msvc@4.60.2

      - uses: actions/setup-node@v6
        with:
          node-version: 25.9.0

      - name: Capture Node 25 path
        shell: bash
        run: echo "HOWCODE_NODE_25_PATH=$(node -p 'process.execPath')" >> "$GITHUB_ENV"

      - uses: actions/setup-node@v6
        with:
          node-version: 26.1.0

      - name: Capture Node 26 path
        shell: bash
        run: echo "HOWCODE_NODE_26_PATH=$(node -p 'process.execPath')" >> "$GITHUB_ENV"

      - uses: actions/setup-node@v6
        with:
          node-version: 24.15.0

      - name: Verify release version alignment
        shell: bash
        run: |
          ROOT_VERSION=$(node -p "require('./package.json').version")
          if [ "${GITHUB_REF_TYPE}" = "tag" ]; then
            TAG_VERSION="${GITHUB_REF_NAME#v}"
            if [ "$ROOT_VERSION" != "$TAG_VERSION" ]; then
              echo "Tag version $TAG_VERSION does not match package version $ROOT_VERSION"
              exit 1
            fi
          fi

      - name: Build stable desktop release
        shell: bash
        run: |
          if [ "${RUNNER_OS}" = "macOS" ]; then
            ulimit -n 65536 || ulimit -n 10240 || true
          fi
          bun run build:release

      - name: Build launcher archives
        env:
          HOWCODE_RELEASE_CHANNEL: ${{ github.ref_type == 'tag' && 'main' || (github.ref_name == 'dev' && 'dev' || 'main') }}
          HOWCODE_RELEASE_ASSET_BASE_URL: https://github.com/${{ github.repository }}/releases/download/${{ github.ref_type == 'tag' && github.ref_name || (github.ref_name == 'dev' && 'channel-dev' || 'channel-main') }}
        run: bun run build:launcher-artifacts

      - name: Upload dev artifacts
        if: github.event_name == 'push' && github.ref_name == 'dev'
        uses: actions/upload-artifact@v7
        with:
          name: dev-${{ matrix.name }}
          retention-days: 1
          if-no-files-found: error
          path: |
            artifacts/stable-*-update.json
            artifacts/npm-launcher/*.tar.gz
            artifacts/electron/*.AppImage
            artifacts/electron/*.exe
            artifacts/electron/*.zip

      - name: Upload main artifacts
        if: github.event_name == 'push' && github.ref_name == 'main'
        uses: actions/upload-artifact@v7
        with:
          name: main-${{ matrix.name }}
          retention-days: 1
          if-no-files-found: error
          path: |
            artifacts/stable-*-update.json
            artifacts/npm-launcher/*.tar.gz
            artifacts/electron/*.AppImage
            artifacts/electron/*.exe
            artifacts/electron/*.zip

      - name: Upload manual preview artifacts
        if: github.event_name == 'workflow_dispatch'
        uses: actions/upload-artifact@v7
        with:
          name: preview-${{ matrix.name }}
          retention-days: 1
          if-no-files-found: error
          path: |
            artifacts/stable-*-update.json
            artifacts/npm-launcher/*.tar.gz
            artifacts/electron/*.AppImage
            artifacts/electron/*.exe
            artifacts/electron/*.zip

      - name: Upload release files
        if: github.event_name == 'push' && github.ref_type == 'tag'
        uses: actions/upload-artifact@v7
        with:
          name: release-${{ matrix.name }}
          retention-days: 1
          if-no-files-found: error
          path: |
            artifacts/stable-*-update.json
            artifacts/npm-launcher/*.tar.gz
            artifacts/electron/*.AppImage
            artifacts/electron/*.exe
            artifacts/electron/*.zip

  cleanup-dev-artifacts:
    name: Cleanup old dev artifacts
    if: github.event_name == 'push' && github.ref_name == 'dev'
    needs: build
    runs-on: ubuntu-24.04
    permissions:
      actions: write

    steps:
      - name: Delete artifacts from older dev runs
        uses: actions/github-script@v9
        with:
          script: |
            const owner = context.repo.owner;
            const repo = context.repo.repo;
            const currentRunId = context.runId;
            const artifacts = await github.paginate(github.rest.actions.listArtifactsForRepo, {
              owner,
              repo,
              per_page: 100,
            });

            for (const artifact of artifacts) {
              const workflowRun = artifact.workflow_run;
              if (!workflowRun) {
                continue;
              }

              if (workflowRun.head_branch !== "dev") {
                continue;
              }

              if (workflowRun.id === currentRunId) {
                continue;
              }

              if (!artifact.name.startsWith("dev-")) {
                core.info(
                  `Skipping unrelated artifact ${artifact.name} (${artifact.id}) from dev run ${workflowRun.id}`,
                );
                continue;
              }

              core.info(
                `Deleting artifact ${artifact.name} (${artifact.id}) from dev run ${workflowRun.id}`,
              );
              await github.rest.actions.deleteArtifact({
                owner,
                repo,
                artifact_id: artifact.id,
              });
            }

  publish-channel-release:
    name: Publish channel GitHub release
    if: github.event_name == 'push' && (github.ref_name == 'dev' || github.ref_name == 'main')
    needs: build
    runs-on: ubuntu-24.04

    steps:
      - uses: actions/checkout@v6

      - uses: oven-sh/setup-bun@v2
        with:
          bun-version: 1.3.14
          no-cache: true

      - name: Download built artifacts
        uses: actions/download-artifact@v8
        with:
          pattern: ${{ github.ref_name }}-*
          merge-multiple: true
          path: release-assets

      - name: List channel release assets
        run: find release-assets -maxdepth 2 -type f \( -name 'stable-*-update.json' -o -name '*.tar.gz' -o -name '*.AppImage' -o -name '*.exe' -o -name '*.zip' \) -print | sort

      - name: Validate channel update manifests
        env:
          HOWCODE_RELEASE_CHANNEL: ${{ github.ref_name }}
        run: bun run validate:release-assets release-assets

      - name: Prepare channel release notes
        env:
          CHANNEL: ${{ github.ref_name }}
        run: |
          node - <<'NODE'
          const fs = require('node:fs')
          const changelog = fs.readFileSync('docs/changelog.md', 'utf8')
          const match = changelog.match(/^###\s+([^\n]+)\n([\s\S]*?)(?=^###\s+|(?![\s\S]))/m)
          const version = match?.[1]?.trim() || 'current'
          const notes = match?.[2]?.trim() || 'See the changelog for details.'
          const channel = process.env.CHANNEL
          const title = channel === 'dev' ? `howcode dev (${version})` : `howcode ${version}`
          const channelNote = channel === 'dev'
            ? 'This is the moving dev channel used by `npx howcode@dev`.'
            : 'This is the moving stable channel used by `npx howcode`.'
          fs.writeFileSync('channel-release-title.txt', `${title}\n`)
          fs.writeFileSync('channel-release-notes.md', `## ${title}\n\n${notes}\n\n### Release channel\n\n${channelNote} Future app updates refresh these GitHub Release assets without requiring an npm package publish unless the launcher itself changes.\n`)
          NODE

      - name: Create or update channel GitHub release
        env:
          GH_TOKEN: ${{ github.token }}
          CHANNEL: ${{ github.ref_name }}
        run: |
          RELEASE_TAG="channel-$CHANNEL"
          mapfile -d '' assets < <(find release-assets -type f \( -name 'stable-*-update.json' -o -name '*.tar.gz' -o -name '*.AppImage' -o -name '*.exe' -o -name '*.zip' \) -print0 | sort -z)
          if [ ${#assets[@]} -eq 0 ]; then
            echo "No release assets found"
            exit 1
          fi

          release_flags=()
          if [ "$CHANNEL" = "dev" ]; then
            release_flags+=(--prerelease)
          else
            release_flags+=(--latest)
          fi

          release_title=$(cat channel-release-title.txt)

          if gh release view "$RELEASE_TAG" >/dev/null 2>&1; then
            mkdir -p previous-manifests
            gh release download "$RELEASE_TAG" --pattern 'stable-*-update.json' --dir previous-manifests || true

            declare -A keep_assets=()
            for asset in "${assets[@]}"; do
              keep_assets["$(basename "$asset")"]=1
            done
            while IFS= read -r previous_archive; do
              if [ -n "$previous_archive" ]; then
                keep_assets["$previous_archive"]=1
              fi
            done < <(node - <<'NODE'
          const fs = require('node:fs')
          const path = require('node:path')
          for (const name of fs.readdirSync('previous-manifests')) {
            try {
              const metadata = JSON.parse(fs.readFileSync(path.join('previous-manifests', name), 'utf8'))
              if (typeof metadata.assetUrl === 'string') {
                console.log(path.basename(new URL(metadata.assetUrl).pathname))
              }
            } catch {}
          }
          NODE
            )

            mapfile -d '' payload_assets < <(find release-assets -type f ! -name 'stable-*-update.json' \( -name '*.tar.gz' -o -name '*.AppImage' -o -name '*.exe' -o -name '*.zip' \) -print0 | sort -z)
            mapfile -d '' manifest_assets < <(find release-assets -type f -name 'stable-*-update.json' -print0 | sort -z)
            gh release upload "$RELEASE_TAG" "${payload_assets[@]}" --clobber
            # Per-target manifests commit last: every advertised immutable archive now exists.
            gh release upload "$RELEASE_TAG" "${manifest_assets[@]}" --clobber
            gh release edit "$RELEASE_TAG" --title "$release_title" --notes-file channel-release-notes.md --target "$GITHUB_SHA" "${release_flags[@]}"

            mapfile -t old_assets < <(gh release view "$RELEASE_TAG" --json assets --jq '.assets[].name | select(test("^(stable-.*-update\\.json|howcode-[^-]+-[^-]+\\.tar\\.gz|archive-howcode-[^-]+-[^-]+-[a-f0-9]{64}\\.tar\\.gz|.*\\.AppImage|.*\\.exe|.*\\.zip)$"))')
            for old_asset in "${old_assets[@]}"; do
              if [ -z "${keep_assets[$old_asset]+x}" ]; then
                gh release delete-asset "$RELEASE_TAG" "$old_asset" --yes
              fi
            done
          else
            gh release create "$RELEASE_TAG" "${assets[@]}" --title "$release_title" --target "$GITHUB_SHA" --notes-file channel-release-notes.md "${release_flags[@]}"
          fi

  publish-release:
    name: Publish versioned GitHub release
    if: github.event_name == 'push' && github.ref_type == 'tag'
    needs: build
    runs-on: ubuntu-24.04

    steps:
      - uses: actions/checkout@v6

      - uses: oven-sh/setup-bun@v2
        with:
          bun-version: 1.3.14
          no-cache: true

      - name: Download built artifacts
        uses: actions/download-artifact@v8
        with:
          pattern: release-*
          merge-multiple: true
          path: release-assets

      - name: List release assets
        run: find release-assets -maxdepth 2 -type f \( -name 'stable-*-update.json' -o -name '*.tar.gz' -o -name '*.AppImage' -o -name '*.exe' -o -name '*.zip' \) -print | sort

      - name: Validate versioned update manifests
        env:
          HOWCODE_RELEASE_CHANNEL: main
        run: bun run validate:release-assets release-assets

      - name: Create or update GitHub release
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          mapfile -d '' assets < <(find release-assets -type f \( -name 'stable-*-update.json' -o -name '*.tar.gz' -o -name '*.AppImage' -o -name '*.exe' -o -name '*.zip' \) -print0 | sort -z)
          if [ ${#assets[@]} -eq 0 ]; then
            echo "No release assets found"
            exit 1
          fi

          if gh release view "$GITHUB_REF_NAME" >/dev/null 2>&1; then
            gh release upload "$GITHUB_REF_NAME" "${assets[@]}" --clobber
          else
            gh release create "$GITHUB_REF_NAME" "${assets[@]}" --title "$GITHUB_REF_NAME" --generate-notes
          fi