release.yml

name: Release

on:
  push:
    tags:
      - "v*"

permissions:
  contents: write

env:
  CARGO_TERM_COLOR: always

jobs:
  verify:
    uses: ./.github/workflows/ci.yml

  validate-release-version:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6

      - name: Verify release tag matches checked-in app versions
        run: |
          set -euo pipefail

          tag_version="${GITHUB_REF_NAME#v}"
          workspace_version="$(sed -nE 's/^version = "([^"]+)"/\1/p' Cargo.toml | head -1)"
          tauri_version="$(python3 -c 'import json; print(json.load(open("crates/diffcore-tauri/tauri.conf.json"))["version"])')"

          if [ "$tag_version" != "$workspace_version" ]; then
            echo "::error::Release tag $tag_version does not match workspace version $workspace_version"
            exit 1
          fi

          if [ "$tag_version" != "$tauri_version" ]; then
            echo "::error::Release tag $tag_version does not match Tauri app version $tauri_version"
            exit 1
          fi

  build-macos:
    needs: [verify, validate-release-version]
    runs-on: macos-latest
    timeout-minutes: 60
    steps:
      - uses: actions/checkout@v6

      - name: Install Rust
        uses: dtolnay/rust-toolchain@stable

      - name: Cache Rust build artifacts
        uses: Swatinem/rust-cache@v2

      - name: Install Node.js
        uses: actions/setup-node@v6
        with:
          node-version: "22"
          cache: npm
          cache-dependency-path: crates/diffcore-tauri/ui/package-lock.json

      - name: Install UI dependencies
        working-directory: crates/diffcore-tauri/ui
        run: npm ci

      - name: Install Tauri CLI
        run: cargo install tauri-cli --version "^2" --locked

      - name: Import Apple certificate
        env:
          APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }}
          APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
        run: |
          CERTIFICATE_PATH="$RUNNER_TEMP/certificate.p12"
          KEYCHAIN_PATH="$RUNNER_TEMP/app-signing.keychain-db"
          echo -n "$APPLE_CERTIFICATE" | base64 --decode -o "$CERTIFICATE_PATH"
          security create-keychain -p "" "$KEYCHAIN_PATH"
          security set-keychain-settings -lut 21600 "$KEYCHAIN_PATH"
          security unlock-keychain -p "" "$KEYCHAIN_PATH"
          security import "$CERTIFICATE_PATH" -P "$APPLE_CERTIFICATE_PASSWORD" -A -t cert -f pkcs12 -k "$KEYCHAIN_PATH"
          security set-key-partition-list -S apple-tool:,apple: -k "" "$KEYCHAIN_PATH"
          security list-keychain -d user -s "$KEYCHAIN_PATH"

      - name: Write Apple API key
        env:
          APPLE_API_KEY_CONTENT: ${{ secrets.APPLE_API_KEY_CONTENT }}
          APPLE_API_KEY: ${{ secrets.APPLE_API_KEY }}
        run: |
          API_KEY_PATH="$RUNNER_TEMP/AuthKey_${APPLE_API_KEY}.p8"
          echo -n "$APPLE_API_KEY_CONTENT" > "$API_KEY_PATH"
          chmod 600 "$API_KEY_PATH"

      - name: Build Tauri app (Apple Silicon)
        env:
          APPLE_SIGNING_IDENTITY: ${{ secrets.APPLE_SIGNING_IDENTITY }}
          APPLE_API_ISSUER: ${{ secrets.APPLE_API_ISSUER }}
          APPLE_API_KEY: ${{ secrets.APPLE_API_KEY }}
          APPLE_API_KEY_PATH: ${{ runner.temp }}/AuthKey_${{ secrets.APPLE_API_KEY }}.p8
          TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
          TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ""
        run: cargo tauri build --target aarch64-apple-darwin

      - name: Verify code signing and notarization
        env:
          APPLE_API_ISSUER: ${{ secrets.APPLE_API_ISSUER }}
          APPLE_API_KEY: ${{ secrets.APPLE_API_KEY }}
          APPLE_API_KEY_PATH: ${{ runner.temp }}/AuthKey_${{ secrets.APPLE_API_KEY }}.p8
        run: |
          set -euo pipefail

          MOUNT_DIR=""
          cleanup() {
            if [ -n "${MOUNT_DIR}" ] && mount | grep -q "${MOUNT_DIR}"; then
              hdiutil detach "${MOUNT_DIR}" -quiet || true
            fi
          }
          trap cleanup EXIT

          echo "::group::Locate .app bundle"
          DMG_PATH=$(find target/aarch64-apple-darwin/release/bundle/dmg -name "*.dmg" -type f | head -1)
          if [ -z "$DMG_PATH" ]; then
            echo "::error::No DMG found in bundle output"
            exit 1
          fi

          APP_PATH=$(find target/aarch64-apple-darwin/release/bundle -name "*.app" -type d | head -1)
          if [ -z "$APP_PATH" ]; then
            echo "No .app found in bundle dir, mounting DMG to verify..."
            MOUNT_DIR="$(mktemp -d)"
            hdiutil attach "$DMG_PATH" -mountpoint "$MOUNT_DIR" -nobrowse -quiet
            APP_PATH=$(find "$MOUNT_DIR" -maxdepth 1 -name "*.app" -type d | head -1)
          fi
          if [ -z "$APP_PATH" ]; then
            echo "::error::No .app found in bundle output or mounted DMG"
            exit 1
          fi
          echo "Found app at: $APP_PATH"
          echo "Found DMG at: $DMG_PATH"
          echo "::endgroup::"

          echo "::group::Verify app signature"
          codesign -dvvv "$APP_PATH"
          echo "::endgroup::"

          echo "::group::Verify signature validity"
          codesign --verify --deep --strict "$APP_PATH"
          echo "::endgroup::"

          echo "::group::Check signing identity"
          IDENTITY=$(codesign -dvvv "$APP_PATH" 2>&1 | grep "Authority=Developer ID Application" || true)
          if [ -z "$IDENTITY" ]; then
            echo "::error::App is NOT signed with Developer ID Application certificate!"
            exit 1
          fi
          echo "Signed by: $IDENTITY"
          echo "::endgroup::"

          echo "::group::Gatekeeper assessment (.app)"
          spctl --assess --type execute --verbose "$APP_PATH"
          echo "::endgroup::"

          echo "::group::Notarize and staple DMG"
          xcrun notarytool submit \
            "$DMG_PATH" \
            --issuer "$APPLE_API_ISSUER" \
            --key-id "$APPLE_API_KEY" \
            --key "$APPLE_API_KEY_PATH" \
            --wait
          xcrun stapler staple "$DMG_PATH"
          echo "::endgroup::"

          echo "::group::Validate notarized DMG ticket"
          xcrun stapler validate "$DMG_PATH"
          echo "::endgroup::"

          echo "::group::Gatekeeper assessment (.dmg)"
          spctl --assess --type open --context context:primary-signature --verbose "$DMG_PATH"
          echo "::endgroup::"

      - name: List macOS bundle outputs
        run: |
          echo "::group::All bundle files"
          find target/aarch64-apple-darwin/release/bundle -type f | sort
          echo "::endgroup::"

      - name: Upload macOS artifacts
        uses: actions/upload-artifact@v6
        with:
          name: diffcore-aarch64-apple-darwin
          path: |
            target/aarch64-apple-darwin/release/bundle/dmg/*.dmg
            target/aarch64-apple-darwin/release/bundle/macos/*.tar.gz
            target/aarch64-apple-darwin/release/bundle/macos/*.tar.gz.sig
          if-no-files-found: warn

  build-linux:
    needs: [verify, validate-release-version]
    runs-on: ubuntu-22.04
    timeout-minutes: 60
    steps:
      - uses: actions/checkout@v6

      - name: Install system dependencies
        run: |
          sudo apt-get update
          sudo apt-get install -y libwebkit2gtk-4.1-dev libappindicator3-dev librsvg2-dev patchelf

      - name: Install Rust
        uses: dtolnay/rust-toolchain@stable

      - name: Cache Rust build artifacts
        uses: Swatinem/rust-cache@v2

      - name: Install Node.js
        uses: actions/setup-node@v6
        with:
          node-version: "22"
          cache: npm
          cache-dependency-path: crates/diffcore-tauri/ui/package-lock.json

      - name: Install UI dependencies
        working-directory: crates/diffcore-tauri/ui
        run: npm ci

      - name: Install Tauri CLI
        run: cargo install tauri-cli --version "^2" --locked

      - name: Build Tauri app
        env:
          TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
          TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ""
        run: cargo tauri build

      - name: Upload Linux artifacts
        uses: actions/upload-artifact@v6
        with:
          name: diffcore-linux
          path: |
            target/release/bundle/deb/*.deb
            target/release/bundle/appimage/*.AppImage
            target/release/bundle/appimage/*.AppImage.sig

  build-windows:
    needs: [verify, validate-release-version]
    runs-on: windows-latest
    timeout-minutes: 60
    steps:
      - uses: actions/checkout@v6

      - name: Install Rust
        uses: dtolnay/rust-toolchain@stable

      - name: Cache Rust build artifacts
        uses: Swatinem/rust-cache@v2

      - name: Install Node.js
        uses: actions/setup-node@v6
        with:
          node-version: "22"
          cache: npm
          cache-dependency-path: crates/diffcore-tauri/ui/package-lock.json

      - name: Install UI dependencies
        working-directory: crates/diffcore-tauri/ui
        run: npm ci

      - name: Install Tauri CLI
        run: cargo install tauri-cli --version "^2" --locked

      - name: Build Tauri app
        env:
          TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
          TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ""
        run: cargo tauri build

      - name: Upload Windows artifacts
        uses: actions/upload-artifact@v6
        with:
          name: diffcore-windows
          path: |
            target/release/bundle/msi/*.msi
            target/release/bundle/msi/*.msi.sig
            target/release/bundle/nsis/*.exe
            target/release/bundle/nsis/*.exe.sig

  create-release:
    needs: [build-macos, build-linux, build-windows]
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6

      - name: Download all artifacts
        uses: actions/download-artifact@v8
        with:
          path: artifacts

      - name: List downloaded artifacts
        run: find artifacts -type f | sort

      - name: Create or update GitHub release
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          tag="${GITHUB_REF_NAME}"
          files=()
          while IFS= read -r -d '' file; do
            files+=("$file")
          done < <(
            find artifacts -type f \( \
              -name '*.dmg' -o \
              -name '*.tar.gz' -o \
              -name '*.deb' -o \
              -name '*.AppImage' -o \
              -name '*.AppImage.sig' -o \
              -name '*.msi' -o \
              -name '*.msi.sig' -o \
              -name '*.exe' -o \
              -name '*.exe.sig' \
            \) ! -name '*.tar.gz.sig' -print0
          )

          if [ ${#files[@]} -eq 0 ]; then
            echo "No release assets found under artifacts/"
            exit 1
          fi

          if gh release view "$tag" > /dev/null 2>&1; then
            gh release upload "$tag" "${files[@]}" --clobber
          else
            gh release create "$tag" "${files[@]}" --generate-notes --verify-tag
          fi

      - name: Generate updater manifest (latest.json)
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          set -euo pipefail
          tag="${GITHUB_REF_NAME}"
          version="${tag#v}"
          base_url="https://github.com/jamesaphoenix/diff-core/releases/download/${tag}"
          notes="$(gh release view "$tag" --json body -q .body | head -c 2000)"
          pub_date="$(date -u +%Y-%m-%dT%H:%M:%SZ)"

          # Read signatures
          mac_sig=""
          linux_sig=""
          win_nsis_sig=""
          for f in $(find artifacts -name "*.sig" -type f); do
            content="$(cat "$f")"
            case "$f" in
              *.tar.gz.sig) mac_sig="$content" ;;
              *.AppImage.sig) linux_sig="$content" ;;
              *.exe.sig) win_nsis_sig="$content" ;;
            esac
          done

          # Find artifact filenames
          mac_tar="$(find artifacts -name '*.tar.gz' ! -name '*.sig' -type f | head -1 | xargs basename 2>/dev/null || echo '')"
          linux_appimage="$(find artifacts -name '*.AppImage' -type f | head -1 | xargs basename 2>/dev/null || echo '')"
          win_exe="$(find artifacts -name '*.exe' -type f | head -1 | xargs basename 2>/dev/null || echo '')"

          cat > latest.json <<JSONEOF
          {
            "version": "${version}",
            "notes": $(echo "$notes" | python3 -c 'import json,sys; print(json.dumps(sys.stdin.read()))'),
            "pub_date": "${pub_date}",
            "platforms": {
              "darwin-aarch64": {
                "signature": "${mac_sig}",
                "url": "${base_url}/${mac_tar}"
              },
              "linux-x86_64": {
                "signature": "${linux_sig}",
                "url": "${base_url}/${linux_appimage}"
              },
              "windows-x86_64": {
                "signature": "${win_nsis_sig}",
                "url": "${base_url}/${win_exe}"
              }
            }
          }
          JSONEOF

          gh release upload "$tag" latest.json --clobber