release.yml

name: Release

on:
  push:
    tags:
      - "v*"

permissions:
  contents: write

env:
  PNPM_VERSION: 9

jobs:
  create-release:
    runs-on: ubuntu-latest
    outputs:
      version: ${{ steps.version.outputs.version }}
      release_id: ${{ steps.release.outputs.id }}
    steps:
      - uses: actions/checkout@v4

      - name: Extract version from tag
        id: version
        run: echo "version=${GITHUB_REF_NAME#v}" >> $GITHUB_OUTPUT

      - name: Create GitHub Release
        id: release
        uses: softprops/action-gh-release@v2
        with:
          tag_name: ${{ github.ref_name }}
          name: OpenACP Desktop ${{ steps.version.outputs.version }}
          draft: true
          prerelease: false
          generate_release_notes: true

  build-tauri:
    needs: create-release
    strategy:
      fail-fast: false
      matrix:
        include:
          - platform: macos-latest
            args: --target aarch64-apple-darwin
            rust_target: aarch64-apple-darwin
          - platform: macos-latest
            args: --target x86_64-apple-darwin
            rust_target: x86_64-apple-darwin
          - platform: ubuntu-22.04
            args: ""
            rust_target: x86_64-unknown-linux-gnu
          - platform: windows-latest
            args: ""
            rust_target: x86_64-pc-windows-msvc

    runs-on: ${{ matrix.platform }}
    steps:
      - uses: actions/checkout@v4

      - name: Install pnpm
        uses: pnpm/action-setup@v4
        with:
          version: ${{ env.PNPM_VERSION }}

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: 22
          cache: pnpm

      - name: Set up Xcode version
        if: matrix.rust_target == 'aarch64-apple-darwin'
        run: sudo xcode-select -s /Applications/Xcode_26.2.app/Contents/Developer

      - name: Install Rust stable
        uses: dtolnay/rust-toolchain@stable
        with:
          targets: ${{ matrix.rust_target }}

      - name: Install Linux dependencies
        if: matrix.platform == 'ubuntu-22.04'
        run: |
          sudo apt-get update
          sudo apt-get install -y libwebkit2gtk-4.1-dev libappindicator3-dev librsvg2-dev patchelf

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      - name: Sync version
        shell: bash
        run: |
          VERSION="${{ needs.create-release.outputs.version }}"
          echo "Version: $VERSION"

          node -e "
            const fs = require('fs');
            const v = '$VERSION';
            const parts = v.split('.');
            const yyyy = parseInt(parts[0]);
            const mdd = parts[1];
            const n = parseInt(parts[2] || '1');

            // WiX MSI: major ≤ 255, minor ≤ 255, build ≤ 65535.
            // YYYY.MDD.N → YY.M.(DD * 100 + N)
            // e.g. 2026.403.1 → 26.4.301, 2026.1231.5 → 26.12.3105
            const yy = yyyy % 100;
            const m = parseInt(mdd.length <= 3 ? mdd.slice(0, -2) : mdd.slice(0, -2));
            const dd = parseInt(mdd.slice(-2));
            const wixVersion = yy + '.' + m + '.' + (dd * 100 + n);

            // package.json
            const pkg = JSON.parse(fs.readFileSync('package.json', 'utf8'));
            pkg.version = v;
            fs.writeFileSync('package.json', JSON.stringify(pkg, null, 2) + '\n');

            // tauri.conf.json — set WiX version override
            const conf = JSON.parse(fs.readFileSync('src-tauri/tauri.conf.json', 'utf8'));
            if (!conf.bundle) conf.bundle = {};
            if (!conf.bundle.windows) conf.bundle.windows = {};
            if (!conf.bundle.windows.wix) conf.bundle.windows.wix = {};
            conf.bundle.windows.wix.version = wixVersion;
            fs.writeFileSync('src-tauri/tauri.conf.json', JSON.stringify(conf, null, 2) + '\n');

            // Cargo.toml
            let cargo = fs.readFileSync('src-tauri/Cargo.toml', 'utf8');
            cargo = cargo.replace(/^version = \".*\"/m, 'version = \"' + v + '\"');
            fs.writeFileSync('src-tauri/Cargo.toml', cargo);

            console.log('App version:', v, '| WiX:', wixVersion);
          "

      # ── Override updater pubkey for forks (if UPDATER_PUBKEY secret is set) ──
      - name: Override updater pubkey
        if: env.UPDATER_PUBKEY != ''
        shell: bash
        env:
          UPDATER_PUBKEY: ${{ secrets.UPDATER_PUBKEY }}
        run: |
          node -e "
            const fs = require('fs');
            const conf = JSON.parse(fs.readFileSync('src-tauri/tauri.conf.json', 'utf8'));
            if (conf.plugins?.updater) {
              conf.plugins.updater.pubkey = process.env.UPDATER_PUBKEY;
            }
            fs.writeFileSync('src-tauri/tauri.conf.json', JSON.stringify(conf, null, 2) + '\n');
            console.log('Updated updater pubkey');
          "

      # ── macOS Code Signing & Notarization ──
      - name: Import Apple certificate
        if: startsWith(matrix.platform, 'macos') && env.APPLE_CERTIFICATE != ''
        env:
          APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }}
        uses: apple-actions/import-codesign-certs@v3
        with:
          p12-file-base64: ${{ secrets.APPLE_CERTIFICATE }}
          p12-password: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}

      # ── Build ──
      - name: Build Tauri app
        uses: tauri-apps/tauri-action@v0
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
          TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
          APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }}
          APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
          APPLE_SIGNING_IDENTITY: ${{ secrets.APPLE_SIGNING_IDENTITY }}
          APPLE_ID: ${{ secrets.APPLE_ID }}
          APPLE_PASSWORD: ${{ secrets.APPLE_PASSWORD }}
          APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
        with:
          releaseId: ${{ needs.create-release.outputs.release_id }}
          args: ${{ matrix.args }}
          updaterJsonPreferNsis: true

  publish-release:
    needs: [create-release, build-tauri]
    runs-on: ubuntu-latest
    steps:
      - name: Publish release
        uses: actions/github-script@v7
        with:
          script: |
            await github.rest.repos.updateRelease({
              owner: context.repo.owner,
              repo: context.repo.repo,
              release_id: ${{ needs.create-release.outputs.release_id }},
              draft: false,
            })