release.yaml

name: "Release"

on:
  # Allow manual
  workflow_dispatch:
  push:
    branches:
      # TODO: REMOVE ME BEFORE MERGE
      # FIXME: fr fr ong pls remove
      - migrate/codesign

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  build-tauri:
    name: Build (${{ matrix.settings.os }})
    permissions:
      contents: write
    strategy:
      fail-fast: false
      matrix:
        settings:
          # - host: macos-latest
          #   target: universal-apple-darwin
          #   toolchain: aarch64-apple-darwin,x86_64-apple-darwin
          #   bundles: app,dmg
          #   os: darwin
          - host: windows-latest
            target: x86_64-pc-windows-msvc
            toolchain: x86_64-pc-windows-msvc
            bundles: msi,nsis
            os: windows
          # - host: ubuntu-latest
          #   target: x86_64-unknown-linux-gnu
          #   toolchain: x86_64-unknown-linux-gnu
          #   bundles: deb,appimage
          #   os: linux
    env:
      APP_DIR: "apps/desktop"
    runs-on: ${{ matrix.settings.host }}
    steps:
      - uses: actions/checkout@v4
      - name: Setup node
        uses: actions/setup-node@v4
        with:
          node-version: 20
      - name: Install Rust stable
        uses: dtolnay/rust-toolchain@stable
        with:
          target: "${{ matrix.settings.toolchain }}"
      - uses: Swatinem/rust-cache@v2
        with:
          workspaces: "apps/desktop/src-tauri/target"
      - name: install dependencies (ubuntu only)
        if: matrix.settings.host == 'ubuntu-latest'
        run: |
          sudo apt-get update
          sudo apt-get install -y libgtk-3-dev libwebkit2gtk-4.1-dev libappindicator3-dev librsvg2-dev patchelf
      - uses: pnpm/action-setup@v3
        with:
          version: 9
      - name: install frontend dependencies
        run: pnpm install
      - uses: tauri-apps/tauri-action@dev
        id: tauri
        env:
          APPLE_ID: "${{ secrets.APPLE_ID }}"
          APPLE_PASSWORD: "${{ secrets.APPLE_PASSWORD }}"
          APPLE_TEAM_ID: "${{ secrets.APPLE_TEAM_ID }}"
          APPLE_SIGNING_IDENTITY: "${{ secrets.APPLE_SIGNING_IDENTITY }}"
          APPLE_CERTIFICATE: "${{ secrets.APPLE_CERTIFICATE }}"
          APPLE_CERTIFICATE_PASSWORD: "${{ secrets.APPLE_CERTIFICATE_PASSWORD }}"
          TAURI_SIGNING_PRIVATE_KEY: "${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}"
          TAURI_SIGNING_PUBLIC_KEY: "${{ secrets.TAURI_SIGNING_PUBLIC_KEY }}"
          GITHUB_TOKEN: "${{ secrets.GITHUB_TOKEN }}"
          VITE_AXIOM_TOKEN: "${{ secrets.VITE_AXIOM_TOKEN }}"
          VITE_SENTRY_AUTH_TOKEN: "${{ secrets.VITE_SENTRY_AUTH_TOKEN }}"
        with:
          # NOTE: we only use this action to build the project bins for each platform
          # because we need to do code signing for windows we will upload manually after the signing is completed
          projectPath: "${{ env.APP_DIR }}"
          args: --target ${{ matrix.settings.target }} --bundles ${{ matrix.settings.bundles }},updater
      # TODO: figure out where the binary are in the fs from the above action
      - name: Presign
        run: |
          # Create binaries directory if it doesn't exist
          New-Item -ItemType Directory -Force -Path "./binaries"

          # Parse artifactPaths to extract .exe and .msi files
          $artifactPaths = '${{ steps.tauri.outputs.artifactPaths }}'
          
          # Parse as JSON array
          $paths = $artifactPaths | ConvertFrom-Json
          
          # Extract .exe and .msi files (excluding .sig and .zip files)
          $exeFiles = $paths | Where-Object { $_ -match '\.exe$' } | Where-Object { $_ -notmatch '\.(sig|zip)$' }
          $msiFiles = $paths | Where-Object { $_ -match '\.msi$' } | Where-Object { $_ -notmatch '\.(sig|zip)$' }
          
          Write-Host "Found EXE files:"
          $exeFiles | ForEach-Object { Write-Host "  $_" }
          
          Write-Host "Found MSI files:"
          $msiFiles | ForEach-Object { Write-Host "  $_" }
          
          # Move the files to binaries folder
          $exeFiles | ForEach-Object { 
            $fileName = Split-Path $_ -Leaf
            Copy-Item $_ -Destination ".\binaries\$fileName"
          }
          
          $msiFiles | ForEach-Object { 
            $fileName = Split-Path $_ -Leaf
            Copy-Item $_ -Destination ".\binaries\$fileName"
          }

          # sha sum the files in binaries
          Get-ChildItem -Path ".\binaries" -File -Recurse | ForEach-Object { Get-FileHash -Path $_.FullName -Algorithm SHA256 }

      - name: Upload Unsigned Windows Binaries
        id: upload-unsigned-artifact
        uses: actions/upload-artifact@v4
        with: 
          path: ./binaries
      - name: Sign Windows Binaries
        uses: signpath/github-action-submit-signing-request@v1.1
        with:
          api-token: '${{ secrets.SIGNPATH_API_TOKEN }}'
          organization-id: 'b2cc34a4-3b75-4753-82e4-b755351770ea'
          project-slug: 'overlayed'
          # TODO: when we have the production signing policy update this
          signing-policy-slug: 'test-signing'
          github-artifact-id: '${{ steps.upload-unsigned-artifact.outputs.artifact-id }}'
          wait-for-completion: true
          output-artifact-directory: 'binaries/signed'
      - name: Postsign
        run: |
          # using powershell lets list out the sha sum of the signed binaries
          Get-ChildItem -Path binaries/signed -File -Recurse | ForEach-Object { Get-FileHash -Path $_.FullName -Algorithm SHA256 }
      - name: Upload signed windows binaries
        uses: actions/github-script@v7
        with:
          script: |
            const { script } = await import('${{ github.workspace }}/scripts/actions/upload-signed-bins.js');
            const id = "${{ needs.create-release.outputs.release_id }}";
            await script({ github, context }, id);
  create-release:
    needs: build-tauri
    name: Create or Update
    permissions:
      contents: write
    runs-on: ubuntu-latest
    outputs:
      release_id: ${{ steps.create-release.outputs.result }}
    steps:
      - uses: actions/checkout@v4
      - name: setup node
        uses: actions/setup-node@v4
        with:
          node-version: 20
      - name: Get app version
        run: echo "PACKAGE_VERSION=$(node -p "require('./apps/desktop/src-tauri/tauri.conf.json').package.version")" >> $GITHUB_ENV
      - name: Create release or skip
        id: create-release
        uses: actions/github-script@v7
        with:
          script: |
            const { script } = await import('${{ github.workspace }}/scripts/actions/create-release.js')
            return await script({ github, context });