release.yml

name: Release

on:
  push:
    tags:
      - 'v*'

permissions:
  contents: write

concurrency:
  group: release-${{ github.ref }}
  cancel-in-progress: false

jobs:
  validate:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: pnpm/action-setup@v4
        with:
          version: 9
      - uses: actions/setup-node@v4
        with:
          node-version: 22
          cache: pnpm
      - run: pnpm install --frozen-lockfile
      - run: pnpm run typecheck
      - run: pnpm run test

  release-windows:
    runs-on: windows-latest
    needs: validate
    if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags/')
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - uses: pnpm/action-setup@v4
        with:
          version: 9
      - uses: actions/setup-node@v4
        with:
          node-version: 22
          cache: pnpm
      - name: Cache electron
        uses: actions/cache@v4
        with:
          path: |
            ~/.cache/electron
            ~/.cache/electron-builder
            ~\AppData\Local\electron\cache
            ~\AppData\Local\electron-builder\cache
          key: electron-cache-${{ runner.os }}-${{ hashFiles('**/package-lock.json') }}
          restore-keys: |
            electron-cache-${{ runner.os }}-
      - run: pnpm install --frozen-lockfile
      - run: pnpm run build
      - name: Package (code signing)
        run: pnpm run package
        env:
          CSC_LINK: ${{ secrets.CSC_LINK }}
          CSC_KEY_PASSWORD: ${{ secrets.CSC_KEY_PASSWORD }}
      - name: Generate checksums
        shell: pwsh
        run: |
          Get-ChildItem -Path release -Recurse -Include *.exe | ForEach-Object {
            $hash = (Get-FileHash $_.FullName -Algorithm SHA256).Hash.ToLower()
            "$hash  $($_.Name)" | Out-File -Append -FilePath release/checksums-windows.txt
          }
      - uses: actions/upload-artifact@v4
        with:
          name: windows-release
          path: |
            release/**/*.exe
            release/checksums-windows.txt
          retention-days: 1

  release-macos:
    runs-on: macos-latest
    needs: validate
    if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags/')
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - uses: pnpm/action-setup@v4
        with:
          version: 9
      - uses: actions/setup-node@v4
        with:
          node-version: 22
          cache: pnpm
      - name: Cache electron
        uses: actions/cache@v4
        with:
          path: |
            ~/.cache/electron
            ~/.cache/electron-builder
          key: electron-cache-${{ runner.os }}-${{ hashFiles('**/package-lock.json') }}
          restore-keys: |
            electron-cache-${{ runner.os }}-
      - run: pnpm install --frozen-lockfile
      - run: pnpm run build
      - name: Package (code signing & notarization)
        run: |
          if [ -n "$APPLE_ID" ] && [ -n "$APPLE_APP_SPECIFIC_PASSWORD" ] && [ -n "$APPLE_TEAM_ID" ]; then
            echo "Notarization secrets found, enabling notarize"
            npx json -I -f electron-builder.json -e 'this.mac.notarize=true'
          fi
          pnpm run package
        env:
          CSC_LINK: ${{ secrets.CSC_LINK }}
          CSC_KEY_PASSWORD: ${{ secrets.CSC_KEY_PASSWORD }}
          APPLE_ID: ${{ secrets.APPLE_ID }}
          APPLE_APP_SPECIFIC_PASSWORD: ${{ secrets.APPLE_APP_SPECIFIC_PASSWORD }}
          APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
      - name: Generate checksums
        run: |
          cd release
          find . -name "*.dmg" -o -name "*.zip" | while read f; do
            shasum -a 256 "$f" >> checksums-macos.txt
          done
      - uses: actions/upload-artifact@v4
        with:
          name: macos-release
          path: |
            release/**/*.dmg
            release/**/*.zip
            release/checksums-macos.txt
          retention-days: 1

  publish:
    runs-on: ubuntu-latest
    needs: [release-windows, release-macos]
    if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags/')
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - uses: actions/download-artifact@v4
        with:
          name: windows-release
          path: artifacts/windows
      - uses: actions/download-artifact@v4
        with:
          name: macos-release
          path: artifacts/macos
      - name: Generate changelog
        id: changelog
        run: |
          PREV_TAG=$(git describe --tags --abbrev=0 HEAD^ 2>/dev/null || git rev-list --max-parents=0 HEAD)
          echo "## Changes" > changelog.md
          echo "" >> changelog.md
          git log --pretty=format:"- %s (%h)" "$PREV_TAG"..HEAD >> changelog.md
          echo "" >> changelog.md
          echo "" >> changelog.md
          echo "## Checksums" >> changelog.md
          echo '```' >> changelog.md
          cat artifacts/windows/checksums-windows.txt 2>/dev/null >> changelog.md || true
          cat artifacts/macos/checksums-macos.txt 2>/dev/null >> changelog.md || true
          echo '```' >> changelog.md
      - name: Create GitHub Release
        uses: softprops/action-gh-release@v2
        with:
          body_path: changelog.md
          draft: false
          prerelease: ${{ contains(github.ref, '-beta') || contains(github.ref, '-alpha') || contains(github.ref, '-rc') }}
          files: |
            artifacts/windows/**/*.exe
            artifacts/macos/**/*.dmg
            artifacts/macos/**/*.zip
            artifacts/windows/checksums-windows.txt
            artifacts/macos/checksums-macos.txt