Memoh/.github/workflows/release.yml

name: Release

on:
  push:
    tags:
      - "v*"
  workflow_dispatch:
    inputs:
      tag_name:
        description: "Existing release tag to rebuild, e.g. v0.7.0"
        required: true

permissions:
  contents: write

concurrency:
  group: ${{ github.workflow }}-${{ github.event.inputs.tag_name || github.ref_name }}
  cancel-in-progress: false

env:
  RELEASE_TAG: ${{ github.event.inputs.tag_name || github.ref_name }}

jobs:
  changelog:
    name: Generate changelog
    runs-on: ubuntu-latest
    if: github.event_name == 'push'
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - uses: pnpm/action-setup@v4
        with:
          version: 10
      - uses: actions/setup-node@v4
        with:
          node-version: lts/*
          registry-url: https://registry.npmjs.org/

      - run: pnpm dlx changelogithub
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

  desktop-build:
    name: Build desktop (${{ matrix.platform }})
    runs-on: ${{ matrix.platform }}
    timeout-minutes: 60
    strategy:
      fail-fast: false
      matrix:
        include:
          - platform: macos-latest
            build_cmd: build:mac
          - platform: ubuntu-22.04
            build_cmd: build:linux
          - platform: windows-latest
            build_cmd: build:win
    env:
      APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }}
      APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
    steps:
      - uses: actions/checkout@v4
      - name: Sync desktop version
        shell: bash
        run: |
          set -euo pipefail
          VERSION="${RELEASE_TAG#v}"
          export VERSION
          node <<'EOF'
          const fs = require('fs');
          const version = process.env.VERSION;
          const packageJsonPath = 'apps/desktop/package.json';
          const packageJson = JSON.parse(fs.readFileSync(packageJsonPath, 'utf8'));
          packageJson.version = version;
          fs.writeFileSync(packageJsonPath, `${JSON.stringify(packageJson, null, 2)}\n`);
          EOF
      - uses: pnpm/action-setup@v4
        with:
          version: 10
      - uses: actions/setup-node@v4
        with:
          node-version: lts/*
          cache: pnpm
      - name: Install JS dependencies
        run: pnpm install --frozen-lockfile
      - name: Prepare macOS code signing
        id: mac-signing
        if: ${{ matrix.platform == 'macos-latest' && env.APPLE_CERTIFICATE != '' && env.APPLE_CERTIFICATE_PASSWORD != '' }}
        shell: bash
        run: |
          set -euo pipefail
          CSC_PATH="$RUNNER_TEMP/certificate.p12"
          python3 - <<'EOF'
          import base64
          import os
          from pathlib import Path

          target = Path(os.environ["RUNNER_TEMP"]) / "certificate.p12"
          target.write_bytes(base64.b64decode(os.environ["APPLE_CERTIFICATE"]))
          EOF
          echo "CSC_LINK=$CSC_PATH" >> "$GITHUB_ENV"
          echo "CSC_KEY_PASSWORD=$APPLE_CERTIFICATE_PASSWORD" >> "$GITHUB_ENV"
          echo "has_cert=true" >> "$GITHUB_OUTPUT"
      - name: Build desktop bundles
        shell: bash
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          CSC_IDENTITY_AUTO_DISCOVERY: ${{ steps.mac-signing.outputs.has_cert == 'true' && 'true' || 'false' }}
        run: pnpm --filter @memohai/desktop ${{ matrix.build_cmd }}
      - name: Upload desktop artifacts
        uses: actions/upload-artifact@v4
        with:
          name: desktop-${{ matrix.platform }}
          path: |
            apps/desktop/dist/*.AppImage
            apps/desktop/dist/*.deb
            apps/desktop/dist/*.rpm
            apps/desktop/dist/*.dmg
            apps/desktop/dist/*.zip
            apps/desktop/dist/*.exe
          if-no-files-found: error

  desktop-upload:
    name: Upload desktop artifacts
    runs-on: ubuntu-latest
    needs: [changelog, desktop-build]
    if: ${{ always() && needs.desktop-build.result == 'success' && (needs.changelog.result == 'success' || needs.changelog.result == 'skipped') }}
    steps:
      - name: Download desktop artifacts
        uses: actions/download-artifact@v4
        with:
          path: release-artifacts/desktop
          pattern: desktop-*
          merge-multiple: true
      - name: Publish desktop assets
        shell: bash
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          GH_REPO: ${{ github.repository }}
          TAG_NAME: ${{ env.RELEASE_TAG }}
        run: |
          set -euo pipefail
          shopt -s nullglob
          files=(
            release-artifacts/desktop/*.AppImage
            release-artifacts/desktop/*.deb
            release-artifacts/desktop/*.rpm
            release-artifacts/desktop/*.dmg
            release-artifacts/desktop/*.zip
            release-artifacts/desktop/*.exe
          )
          if [[ ${#files[@]} -eq 0 ]]; then
            echo "No desktop artifacts found" >&2
            exit 1
          fi
          gh release upload "$TAG_NAME" "${files[@]}" --clobber --repo "$GH_REPO"