release.yml

name: Release

# Cuts a release whenever a v* tag is pushed.
#
# Secrets required in the repo (Settings → Secrets and variables → Actions):
#   MAC_CERTIFICATE_P12          base64 of your Developer ID .p12 (see specs/06-release.md)
#   MAC_CERTIFICATE_PASSWORD     password used when exporting the .p12
#   APPLE_ID                     your Apple developer email
#   APPLE_APP_SPECIFIC_PASSWORD  an app-specific password generated at appleid.apple.com
#   APPLE_TEAM_ID                10-char Team ID from developer.apple.com
#   GITHUB_TOKEN                 auto-provided by Actions, but electron-builder reads it

on:
  push:
    tags:
      - 'v*'
  workflow_dispatch: {}

permissions:
  contents: write    # so electron-builder can create the GitHub Release

jobs:
  build-mac:
    runs-on: macos-14
    timeout-minutes: 60
    steps:
      - uses: actions/checkout@v5

      # Guard (tag pushes only): a release must be cut from a v* tag whose number matches
      # package.json. Manual workflow_dispatch runs skip the guard but build with
      # --publish never (see the build step) - a safe dry-run for testing the pipeline.
      - name: Guard - tag matches package.json version
        if: github.event_name == 'push'
        run: |
          if [[ "${GITHUB_REF}" != refs/tags/v* ]]; then
            echo "::error::Releases must be cut from a v* tag (got ${GITHUB_REF})."; exit 1
          fi
          VERSION=$(grep -m1 '"version"' package.json | sed -E 's/.*"version"[[:space:]]*:[[:space:]]*"([^"]+)".*/\1/')
          TAG="${GITHUB_REF_NAME#v}"
          if [ "${VERSION}" != "${TAG}" ]; then
            echo "::error::package.json version (${VERSION}) does not match tag (${TAG})."; exit 1
          fi
          echo "Releasing v${VERSION} from tag ${GITHUB_REF_NAME}."

      # node-gyp 9 (used by @electron/rebuild when compiling native modules - e.g. node-pty
      # for the cross-arch x64 build) imports the stdlib `distutils`, which Python 3.12
      # removed (PEP 632). macos-14 runners default to 3.12, so pin 3.11 which still has it.
      - name: Set up Python 3.11 (node-gyp needs distutils)
        uses: actions/setup-python@v6
        with:
          python-version: '3.11'

      - uses: pnpm/action-setup@v6
        with:
          version: 10

      - uses: actions/setup-node@v5
        with:
          node-version: 22
          cache: pnpm

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      - name: Import code-signing cert
        # Decodes MAC_CERTIFICATE_P12 to a file on the runner; electron-builder picks it
        # up via CSC_LINK + CSC_KEY_PASSWORD.
        run: |
          echo "${MAC_CERTIFICATE_P12}" | base64 -d > "${RUNNER_TEMP}/cert.p12"
          echo "CSC_LINK=${RUNNER_TEMP}/cert.p12" >> "$GITHUB_ENV"
          echo "CSC_KEY_PASSWORD=${MAC_CERTIFICATE_PASSWORD}" >> "$GITHUB_ENV"
        env:
          MAC_CERTIFICATE_P12: ${{ secrets.MAC_CERTIFICATE_P12 }}
          MAC_CERTIFICATE_PASSWORD: ${{ secrets.MAC_CERTIFICATE_PASSWORD }}

      - name: Build, sign, notarize, publish
        env:
          APPLE_ID: ${{ secrets.APPLE_ID }}
          APPLE_APP_SPECIFIC_PASSWORD: ${{ secrets.APPLE_APP_SPECIFIC_PASSWORD }}
          APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        # --arm64 --x64 → two native per-arch builds. Apple Silicon users download the
        # ~103MB arm64 DMG; Intel users the x64 DMG. electron-builder writes a single
        # latest-mac.yml listing both zips, and electron-updater fetches the slice that
        # matches the running machine. Smaller downloads than a combined universal binary.
        # Tag pushes publish; manual dispatch runs are dry-runs (build + sign only, artifacts
        # uploaded by the next step) so the pipeline can be exercised without touching releases.
        run: pnpm exec electron-vite build && pnpm exec electron-builder --mac --arm64 --x64 --publish ${{ github.event_name == 'push' && 'always' || 'never' }}

      - name: Upload artifacts (as backup)
        if: always()
        uses: actions/upload-artifact@v5
        with:
          name: mac-dmg
          path: |
            dist/*.dmg
            dist/*.zip
            dist/latest-mac.yml