ci-linux.yml

name: 'CI / Linux'

on:
  workflow_dispatch:
  push:
    branches:
      - development
      - linux
      - 'linux-release-*'
    tags:
      - 'release-*.*.*-linux*'
      - 'release-*.*.*-test*'
  pull_request:
    branches:
      - linux
      - linux-vnext
      - 'linux-release-*'

permissions:
  contents: read

jobs:
  arm64:
    name: Ubuntu arm64
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
        with:
          repository: ${{ inputs.repository || github.repository }}
          ref: ${{ inputs.ref }}
          submodules: recursive
      - name: Package and test application in container
        uses: Guys-Inc-Public/desktop-ubuntu-arm64-packaging@5c78b91585368c3df0941dc90042015b882afb47
        env:
          DESKTOP_OAUTH_CLIENT_ID: ${{ secrets.DESKTOP_OAUTH_CLIENT_ID }}
      - name: Check build artifacts for leaked secrets
        run: ./script/check-build-secrets.sh
      - name: Upload output artifacts
        uses: actions/upload-artifact@v7
        with:
          name: ubuntu-arm64-artifacts
          path: |
            dist/*.AppImage
            dist/*.deb
            dist/*.rpm
            dist/*.sha256
          retention-days: 5
          if-no-files-found: error
  arm:
    name: Ubuntu arm
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
        with:
          repository: ${{ inputs.repository || github.repository }}
          ref: ${{ inputs.ref }}
          submodules: recursive
      - name: Package and test application in container
        uses: Guys-Inc-Public/desktop-ubuntu-arm-packaging@53be9dad4294deb31e472a135f4545a42880d28e
        env:
          DESKTOP_OAUTH_CLIENT_ID: ${{ secrets.DESKTOP_OAUTH_CLIENT_ID }}
      - name: Check build artifacts for leaked secrets
        run: ./script/check-build-secrets.sh
      - name: Upload output artifacts
        uses: actions/upload-artifact@v7
        with:
          name: ubuntu-arm-artifacts
          path: |
            dist/*.AppImage
            dist/*.deb
            dist/*.rpm
            dist/*.sha256
          retention-days: 5
          if-no-files-found: error
  amd64:
    name: Ubuntu x64
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
        with:
          repository: ${{ inputs.repository || github.repository }}
          ref: ${{ inputs.ref }}
          submodules: recursive
      - name: Package and test application in container
        uses: Guys-Inc-Public/desktop-ubuntu-amd64-packaging@b551a147f46ece79e199ba6f14e83be7fb569936
        env:
          DESKTOP_OAUTH_CLIENT_ID: ${{ secrets.DESKTOP_OAUTH_CLIENT_ID }}
      - name: Check build artifacts for leaked secrets
        run: ./script/check-build-secrets.sh
      - name: Upload output artifacts
        uses: actions/upload-artifact@v7
        with:
          name: ubuntu-amd64-artifacts
          path: |
            dist/*.AppImage
            dist/*.deb
            dist/*.rpm
            dist/*.sha256
          retention-days: 5
          if-no-files-found: error

  publish:
    name: Create GitHub release
    needs: [arm64, arm, amd64]
    runs-on: ubuntu-latest
    if: startsWith(github.ref, 'refs/tags/')
    permissions:
      contents: write
      id-token: write      # mint the short-lived Sigstore identity
      attestations: write  # record the provenance attestation
    steps:
      - uses: actions/checkout@v7

      - name: Use Node.js 20.17.0
        uses: actions/setup-node@v7
        with:
          node-version: 20.17.0
          cache: yarn

      - name: Download all artifacts
        uses: actions/download-artifact@v8
        with:
          path: './artifacts'

      - name: Display structure of downloaded files
        run: ls -R
        working-directory: './artifacts'

      # Records "this exact binary was built by this workflow, from this
      # commit" in a public transparency log. The signing identity is minted
      # per-run and discarded, so there is no key to store or rotate.
      # Verify with:  gh attestation verify <file> --owner Guys-Inc-Public
      - name: Attest build provenance
        uses: actions/attest-build-provenance@v4
        with:
          subject-path: |
            artifacts/**/*.AppImage
            artifacts/**/*.deb
            artifacts/**/*.rpm

      - name: Get tag name without prefix
        run: |
          RELEASE_TAG=${GITHUB_REF/refs\/tags\//}
          echo "RELEASE_TAG=${RELEASE_TAG}" >> $GITHUB_ENV
          tagNameWithoutPrefix="${RELEASE_TAG:8}"
          echo "RELEASE_TAG_WITHOUT_PREFIX=${tagNameWithoutPrefix}" >> $GITHUB_ENV

      # TODO: generate release notes
      #    - pull in default if version matches X.Y.Z-linux1
      #    - otherwise stub template

      - name: Generate release notes
        run: |
          node -v
          yarn
          node -r ts-node/register script/generate-release-notes.ts "${{ github.workspace }}/artifacts" "${{ env.RELEASE_TAG_WITHOUT_PREFIX }}"
          RELEASE_NOTES_FILE=script/release_notes.txt
          if [[ ! -f "$RELEASE_NOTES_FILE" ]]; then
              echo "$RELEASE_NOTES_FILE does not exist. Something might have gone wrong while generating the release notes."
              exit 1
          fi
          echo "Release notes:"
          echo "---"
          cat ${RELEASE_NOTES_FILE}
          echo "---"

      - name: Create Release
        uses: softprops/action-gh-release@v3
        with:
          name: GitHub Desktop for Linux ${{ env.RELEASE_TAG_WITHOUT_PREFIX }}
          body_path: script/release_notes.txt
          files: |
            artifacts/**/*.AppImage
            artifacts/**/*.deb
            artifacts/**/*.rpm
            artifacts/**/*.sha256
          draft: true
          fail_on_unmatched_files: true
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}