release.yml

name: Release

on:
  push:
    tags:
      - "v*"

permissions:
  contents: write

jobs:
  release:
    needs: [linux, windows]
    runs-on: macos-latest
    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-node@v4
        with:
          node-version: 20
          cache: npm

      - uses: dtolnay/rust-toolchain@stable
        with:
          targets: aarch64-apple-darwin,x86_64-apple-darwin

      - name: Write Apple API key
        env:
          APPLE_API_KEY: ${{ secrets.APPLE_API_KEY }}
          APPLE_API_KEY_P8: ${{ secrets.APPLE_API_KEY_P8 }}
        run: |
          mkdir -p "$HOME/private_keys"
          printf '%s\n' "$APPLE_API_KEY_P8" > "$HOME/private_keys/AuthKey_${APPLE_API_KEY}.p8"
          echo "APPLE_API_KEY_PATH=$HOME/private_keys/AuthKey_${APPLE_API_KEY}.p8" >> "$GITHUB_ENV"

      - run: npm ci

      - name: Check tag matches app version
        run: |
          set -euo pipefail
          TAG="${GITHUB_REF_NAME#v}"
          CONF=$(node -p "require('./src-tauri/tauri.conf.json').version")
          PKG=$(node -p "require('./package.json').version")
          CARGO=$(awk '/^\[workspace.package\]/{f=1} f && /^version = /{gsub(/"/, "", $3); print $3; exit}' Cargo.toml)
          if [ "$TAG" != "$CONF" ] || [ "$TAG" != "$PKG" ] || [ "$TAG" != "$CARGO" ]; then
            echo "Tag v$TAG does not match package.json ($PKG), Cargo.toml ($CARGO), or tauri.conf.json ($CONF)"
            exit 1
          fi
          node - "$TAG" <<'NODE'
          const { readFileSync } = require("node:fs");
          const version = process.argv[2];
          const escaped = version.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
          const heading = new RegExp(
            `^## \\[${escaped}\\](?: - \\d{4}-\\d{2}-\\d{2})?$`,
            "m",
          );
          if (!heading.test(readFileSync("CHANGELOG.md", "utf8"))) {
            console.error(`CHANGELOG.md has no valid release section for ${version}`);
            process.exit(1);
          }
          NODE

      - name: Write release config
        env:
          APPLE_SIGNING_IDENTITY: ${{ secrets.APPLE_SIGNING_IDENTITY }}
          TAURI_UPDATER_PUBKEY: ${{ secrets.TAURI_UPDATER_PUBKEY }}
          TAURI_UPDATER_ENDPOINT: ${{ secrets.TAURI_UPDATER_ENDPOINT }}
          R2_PUBLIC_BASE_URL: ${{ secrets.R2_PUBLIC_BASE_URL }}
        run: |
          node <<'NODE'
          const { writeFileSync } = require("node:fs");
          const identity = (process.env.APPLE_SIGNING_IDENTITY || "").trim();
          if (!identity || identity === "-") {
            console.error("APPLE_SIGNING_IDENTITY is required and must not be ad-hoc '-'");
            process.exit(1);
          }
          const pubkey = process.env.TAURI_UPDATER_PUBKEY || "";
          const endpoint =
            process.env.TAURI_UPDATER_ENDPOINT ||
            (process.env.R2_PUBLIC_BASE_URL
              ? `${process.env.R2_PUBLIC_BASE_URL.replace(/\/$/, "")}/latest.json`
              : "");
          if (!pubkey || !endpoint) {
            console.error("TAURI_UPDATER_PUBKEY and an updater endpoint are required");
            process.exit(1);
          }
          writeFileSync(
            process.env.RUNNER_TEMP + "/tauri.release.conf.json",
            JSON.stringify(
              {
                bundle: { macOS: { signingIdentity: identity } },
                plugins: {
                  updater: {
                    pubkey,
                    endpoints: endpoint ? [endpoint] : [],
                  },
                },
              },
              null,
              2,
            ),
          );
          NODE

      - name: Build, sign, and notarize macOS packages
        env:
          APPLE_SIGNING_IDENTITY: ${{ secrets.APPLE_SIGNING_IDENTITY }}
          APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }}
          APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
          APPLE_API_KEY: ${{ secrets.APPLE_API_KEY }}
          APPLE_API_ISSUER: ${{ secrets.APPLE_API_ISSUER }}
          TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
          TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
        run: |
          set -euo pipefail
          npx tauri build --target aarch64-apple-darwin --bundles app,dmg --config "$RUNNER_TEMP/tauri.release.conf.json"
          npx tauri build --target x86_64-apple-darwin --bundles app,dmg --config "$RUNNER_TEMP/tauri.release.conf.json"

      - name: Verify macOS package architectures and signatures
        run: |
          set -euo pipefail
          verify_app() {
            local app="$1"
            local expected_arch="$2"
            local executable
            local actual_arch
            executable=$(/usr/libexec/PlistBuddy -c 'Print :CFBundleExecutable' "$app/Contents/Info.plist")
            actual_arch=$(lipo -archs "$app/Contents/MacOS/$executable")
            if [[ "$actual_arch" != "$expected_arch" ]]; then
              echo "Expected $app to contain only $expected_arch, got: $actual_arch" >&2
              exit 1
            fi
            codesign --verify --deep --strict --verbose=2 "$app"
          }
          verify_app "target/aarch64-apple-darwin/release/bundle/macos/MonoCode.app" arm64
          verify_app "target/x86_64-apple-darwin/release/bundle/macos/MonoCode.app" x86_64

      - name: Download Linux packages
        uses: actions/download-artifact@v4
        with:
          name: linux-packages
          path: target/release/bundle/linux

      - name: Download Windows packages
        uses: actions/download-artifact@v4
        with:
          name: windows-packages
          path: target/release/bundle/nsis

      - name: Upload to R2
        env:
          AWS_ACCESS_KEY_ID: ${{ secrets.R2_ACCESS_KEY_ID }}
          AWS_SECRET_ACCESS_KEY: ${{ secrets.R2_SECRET_ACCESS_KEY }}
          AWS_DEFAULT_REGION: auto
          R2_ACCOUNT_ID: ${{ secrets.R2_ACCOUNT_ID }}
          R2_BUCKET_NAME: ${{ secrets.R2_BUCKET_NAME }}
          R2_PUBLIC_BASE_URL: ${{ secrets.R2_PUBLIC_BASE_URL }}
        run: |
          set -euo pipefail
          VERSION="${GITHUB_REF_NAME#v}"
          BUNDLE="target/release/bundle"
          ARM_BUNDLE="target/aarch64-apple-darwin/release/bundle"
          INTEL_BUNDLE="target/x86_64-apple-darwin/release/bundle"
          shopt -s nullglob
          ARM_TARS=("$ARM_BUNDLE"/macos/*.app.tar.gz)
          ARM_DMGS=("$ARM_BUNDLE"/dmg/*.dmg)
          INTEL_TARS=("$INTEL_BUNDLE"/macos/*.app.tar.gz)
          INTEL_DMGS=("$INTEL_BUNDLE"/dmg/*.dmg)
          WINDOWS_INSTALLERS=("$BUNDLE"/nsis/*.exe)
          WINDOWS_SIGNATURES=("$BUNDLE"/nsis/*.exe.sig)
          if (( ${#ARM_TARS[@]} != 1 || ${#ARM_DMGS[@]} != 1 )); then
            echo "Expected exactly one Apple Silicon updater archive and DMG" >&2
            exit 1
          fi
          if (( ${#INTEL_TARS[@]} != 1 || ${#INTEL_DMGS[@]} != 1 )); then
            echo "Expected exactly one Intel updater archive and DMG" >&2
            exit 1
          fi
          if (( ${#WINDOWS_INSTALLERS[@]} != 1 || ${#WINDOWS_SIGNATURES[@]} != 1 )); then
            echo "Expected exactly one Windows installer and updater signature" >&2
            exit 1
          fi
          ARM_TAR="${ARM_TARS[0]}"
          ARM_SIG="${ARM_TAR}.sig"
          ARM_DMG="${ARM_DMGS[0]}"
          INTEL_TAR="${INTEL_TARS[0]}"
          INTEL_SIG="${INTEL_TAR}.sig"
          INTEL_DMG="${INTEL_DMGS[0]}"
          WINDOWS_INSTALLER="${WINDOWS_INSTALLERS[0]}"
          WINDOWS_SIGNATURE="${WINDOWS_SIGNATURES[0]}"
          for artifact in "$ARM_SIG" "$INTEL_SIG"; do
            if [[ ! -f "$artifact" ]]; then
              echo "Missing release artifact: $artifact" >&2
              exit 1
            fi
          done
          BASE="${R2_PUBLIC_BASE_URL%/}"
          ENDPOINT="https://${R2_ACCOUNT_ID}.r2.cloudflarestorage.com"
          RELEASE_PREFIX="releases/${VERSION}"
          ARM_TAR_KEY="${RELEASE_PREFIX}/MonoCode.app.tar.gz"
          ARM_SIG_KEY="${ARM_TAR_KEY}.sig"
          ARM_DMG_KEY="${RELEASE_PREFIX}/MonoCode_${VERSION}_aarch64.dmg"
          INTEL_TAR_KEY="${RELEASE_PREFIX}/MonoCode_x64.app.tar.gz"
          INTEL_SIG_KEY="${INTEL_TAR_KEY}.sig"
          INTEL_DMG_KEY="${RELEASE_PREFIX}/MonoCode_${VERSION}_x64.dmg"
          WINDOWS_INSTALLER_KEY="${RELEASE_PREFIX}/MonoCode_${VERSION}_x64-setup.exe"
          WINDOWS_SIGNATURE_KEY="${WINDOWS_INSTALLER_KEY}.sig"

          VERSION="$VERSION" \
            ARM_SIG="$ARM_SIG" \
            ARM_TAR_URL="$BASE/$ARM_TAR_KEY" \
            INTEL_SIG="$INTEL_SIG" \
            INTEL_TAR_URL="$BASE/$INTEL_TAR_KEY" \
            WINDOWS_SIGNATURE="$WINDOWS_SIGNATURE" \
            WINDOWS_INSTALLER_URL="$BASE/$WINDOWS_INSTALLER_KEY" \
            node <<'NODE'
          const fs = require("fs");
          fs.writeFileSync(
            "latest.json",
            JSON.stringify(
              {
                version: process.env.VERSION,
                notes: `MonoCode ${process.env.VERSION}`,
                pub_date: new Date().toISOString(),
                platforms: {
                  "darwin-aarch64": {
                    signature: fs
                      .readFileSync(process.env.ARM_SIG, "utf8")
                      .trim(),
                    url: process.env.ARM_TAR_URL,
                  },
                  "darwin-x86_64": {
                    signature: fs
                      .readFileSync(process.env.INTEL_SIG, "utf8")
                      .trim(),
                    url: process.env.INTEL_TAR_URL,
                  },
                  "windows-x86_64": {
                    signature: fs
                      .readFileSync(process.env.WINDOWS_SIGNATURE, "utf8")
                      .trim(),
                    url: process.env.WINDOWS_INSTALLER_URL,
                  },
                },
              },
              null,
              2,
            ) + "\n",
          );
          NODE

          brew list awscli >/dev/null 2>&1 || brew install awscli
          IMMUTABLE_CACHE="public,max-age=31536000,immutable"
          NO_CACHE="no-store,max-age=0,must-revalidate"
          aws s3 cp "$ARM_DMG" "s3://${R2_BUCKET_NAME}/${ARM_DMG_KEY}" --cache-control "$IMMUTABLE_CACHE" --endpoint-url "$ENDPOINT"
          aws s3 cp "$ARM_TAR" "s3://${R2_BUCKET_NAME}/${ARM_TAR_KEY}" --cache-control "$IMMUTABLE_CACHE" --endpoint-url "$ENDPOINT"
          aws s3 cp "$ARM_SIG" "s3://${R2_BUCKET_NAME}/${ARM_SIG_KEY}" --cache-control "$IMMUTABLE_CACHE" --endpoint-url "$ENDPOINT"
          aws s3 cp "$INTEL_DMG" "s3://${R2_BUCKET_NAME}/${INTEL_DMG_KEY}" --cache-control "$IMMUTABLE_CACHE" --endpoint-url "$ENDPOINT"
          aws s3 cp "$INTEL_TAR" "s3://${R2_BUCKET_NAME}/${INTEL_TAR_KEY}" --cache-control "$IMMUTABLE_CACHE" --endpoint-url "$ENDPOINT"
          aws s3 cp "$INTEL_SIG" "s3://${R2_BUCKET_NAME}/${INTEL_SIG_KEY}" --cache-control "$IMMUTABLE_CACHE" --endpoint-url "$ENDPOINT"
          aws s3 cp "$WINDOWS_INSTALLER" "s3://${R2_BUCKET_NAME}/${WINDOWS_INSTALLER_KEY}" --cache-control "$IMMUTABLE_CACHE" --endpoint-url "$ENDPOINT"
          aws s3 cp "$WINDOWS_SIGNATURE" "s3://${R2_BUCKET_NAME}/${WINDOWS_SIGNATURE_KEY}" --cache-control "$IMMUTABLE_CACHE" --endpoint-url "$ENDPOINT"
          # Keep stable links for both architectures, but never let the CDN
          # retain an older release under these mutable names.
          aws s3 cp "$ARM_DMG" "s3://${R2_BUCKET_NAME}/MonoCode.dmg" --cache-control "$NO_CACHE" --endpoint-url "$ENDPOINT"
          aws s3 cp "$INTEL_DMG" "s3://${R2_BUCKET_NAME}/MonoCode_x64.dmg" --cache-control "$NO_CACHE" --endpoint-url "$ENDPOINT"
          aws s3 cp latest.json "s3://${R2_BUCKET_NAME}/latest.json" --content-type "application/json" --cache-control "$NO_CACHE" --endpoint-url "$ENDPOINT"

      - name: GitHub Release
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          set -euo pipefail
          VERSION="${GITHUB_REF_NAME#v}"
          BUNDLE="target/release/bundle"
          ARM_BUNDLE="target/aarch64-apple-darwin/release/bundle"
          INTEL_BUNDLE="target/x86_64-apple-darwin/release/bundle"
          ARM_TAR="$ARM_BUNDLE/macos/MonoCode.app.tar.gz"
          ARM_SIG="${ARM_TAR}.sig"
          ARM_DMG="$ARM_BUNDLE/dmg/MonoCode_${VERSION}_aarch64.dmg"
          INTEL_TAR="$INTEL_BUNDLE/macos/MonoCode.app.tar.gz"
          INTEL_SIG="${INTEL_TAR}.sig"
          INTEL_DMG="$INTEL_BUNDLE/dmg/MonoCode_${VERSION}_x64.dmg"
          DEB="$BUNDLE/linux/MonoCode_${VERSION}_amd64.deb"
          APPIMAGE="$BUNDLE/linux/MonoCode_${VERSION}_amd64.AppImage"
          NSIS="$BUNDLE/nsis/MonoCode_${VERSION}_x64-setup.exe"
          NSIS_SIG="${NSIS}.sig"
          for artifact in "$ARM_DMG" "$ARM_TAR" "$ARM_SIG" "$INTEL_DMG" "$INTEL_TAR" "$INTEL_SIG" "$DEB" "$APPIMAGE" "$NSIS" "$NSIS_SIG"; do
            if [[ ! -f "$artifact" ]]; then
              echo "Missing release artifact: $artifact" >&2
              exit 1
            fi
          done
          RELEASE_ASSETS="$RUNNER_TEMP/github-release-assets"
          mkdir -p "$RELEASE_ASSETS"
          cp "$ARM_TAR" "$RELEASE_ASSETS/MonoCode.app.tar.gz"
          cp "$ARM_SIG" "$RELEASE_ASSETS/MonoCode.app.tar.gz.sig"
          cp "$INTEL_TAR" "$RELEASE_ASSETS/MonoCode_x64.app.tar.gz"
          cp "$INTEL_SIG" "$RELEASE_ASSETS/MonoCode_x64.app.tar.gz.sig"
          gh release create "$GITHUB_REF_NAME" \
            --title "MonoCode $VERSION" \
            --notes "See CHANGELOG.md for details." \
            "$ARM_DMG" "$RELEASE_ASSETS/MonoCode.app.tar.gz" "$RELEASE_ASSETS/MonoCode.app.tar.gz.sig" \
            "$INTEL_DMG" "$RELEASE_ASSETS/MonoCode_x64.app.tar.gz" "$RELEASE_ASSETS/MonoCode_x64.app.tar.gz.sig" \
            "$DEB" "$APPIMAGE" "$NSIS" "$NSIS_SIG"

  linux:
    name: Linux packages
    runs-on: ubuntu-22.04
    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-node@v4
        with:
          node-version: 20
          cache: npm

      - uses: dtolnay/rust-toolchain@stable

      - name: Install Linux system dependencies
        run: bash scripts/install-linux-deps-debian.sh

      - run: npm ci

      - name: Build Linux packages
        run: npm run build:linux

      - name: Stage Linux packages
        run: |
          set -euo pipefail
          shopt -s nullglob
          deb=(target/release/bundle/deb/*.deb)
          appimage=(target/release/bundle/appimage/*.AppImage)
          if (( ${#deb[@]} != 1 || ${#appimage[@]} != 1 )); then
            echo "Expected exactly one .deb and one AppImage" >&2
            exit 1
          fi
          mkdir -p release-artifacts
          cp "${deb[0]}" "${appimage[0]}" release-artifacts/

      - name: Upload Linux packages
        uses: actions/upload-artifact@v4
        with:
          name: linux-packages
          path: release-artifacts/
          if-no-files-found: error

  windows:
    name: Windows packages
    runs-on: windows-latest
    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-node@v4
        with:
          node-version: 20
          cache: npm

      - uses: dtolnay/rust-toolchain@stable

      - run: npm ci

      - name: Write updater release config
        env:
          TAURI_UPDATER_PUBKEY: ${{ secrets.TAURI_UPDATER_PUBKEY }}
          TAURI_UPDATER_ENDPOINT: ${{ secrets.TAURI_UPDATER_ENDPOINT }}
          R2_PUBLIC_BASE_URL: ${{ secrets.R2_PUBLIC_BASE_URL }}
        run: |
          $endpoint = $env:TAURI_UPDATER_ENDPOINT
          if ([string]::IsNullOrWhiteSpace($endpoint)) {
            if ([string]::IsNullOrWhiteSpace($env:R2_PUBLIC_BASE_URL)) {
              throw "TAURI_UPDATER_ENDPOINT or R2_PUBLIC_BASE_URL is required"
            }
            $endpoint = "$($env:R2_PUBLIC_BASE_URL.TrimEnd('/'))/latest.json"
          }
          if ([string]::IsNullOrWhiteSpace($env:TAURI_UPDATER_PUBKEY)) {
            throw "TAURI_UPDATER_PUBKEY is required"
          }
          $config = @{
            bundle = @{
              createUpdaterArtifacts = $true
            }
            plugins = @{
              updater = @{
                pubkey = $env:TAURI_UPDATER_PUBKEY
                endpoints = @($endpoint)
              }
            }
          }
          $config | ConvertTo-Json -Depth 5 | Set-Content -Encoding utf8 "$env:RUNNER_TEMP\tauri.release.conf.json"

      - name: Build Windows packages
        env:
          TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
          TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
        run: |
          $env:RUSTUP_TOOLCHAIN = "stable-x86_64-pc-windows-msvc"
          npx tauri build --bundles nsis --config "$env:RUNNER_TEMP\tauri.release.conf.json"

      - name: Stage Windows packages
        run: |
          $installers = @(Get-ChildItem "target/release/bundle/nsis" -Filter "*.exe")
          $signatures = @(Get-ChildItem "target/release/bundle/nsis" -Filter "*.exe.sig")
          if ($installers.Count -ne 1 -or $signatures.Count -ne 1) {
            throw "Expected exactly one NSIS installer and one updater signature"
          }
          New-Item -ItemType Directory -Force "release-artifacts" | Out-Null
          $artifacts = @($installers[0].FullName, $signatures[0].FullName)
          Copy-Item -Path $artifacts -Destination "release-artifacts/"

      - name: Upload Windows packages
        uses: actions/upload-artifact@v4
        with:
          name: windows-packages
          path: release-artifacts/
          if-no-files-found: error