release.yml

name: Release

on:
  push:
    tags:
      - 'v*'
  workflow_dispatch:
    inputs:
      version:
        description: 'Version to release (e.g. 1.2.2) — must match package.json'
        required: true
        type: string

permissions:
  contents: write  # needed to create GitHub Releases

env:
  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true

jobs:
  build-mac:
    name: Build macOS (Apple Silicon)
    runs-on: macos-15
    timeout-minutes: 30
    permissions:
      packages: read
    steps:
      - uses: actions/checkout@v5

      - uses: actions/setup-node@v6
        with:
          node-version: 22
          cache: npm
          registry-url: 'https://npm.pkg.github.com'
          scope: '@openconduit'

      - run: npm ci
        env:
          NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

      - name: Import signing certificate
        env:
          CERTIFICATE_BASE64: ${{ secrets.APPLE_CERTIFICATE }}
          CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
        run: |
          if [ -z "$CERTIFICATE_BASE64" ]; then
            echo "::error::APPLE_CERTIFICATE secret is not set. macOS build will be unsigned and auto-update will fail."
            exit 1
          fi
          KEYCHAIN_PATH=$RUNNER_TEMP/app-signing.keychain-db
          KEYCHAIN_PASSWORD=$(openssl rand -base64 32)
          security create-keychain -p "$KEYCHAIN_PASSWORD" "$KEYCHAIN_PATH"
          security set-keychain-settings -lut 21600 "$KEYCHAIN_PATH"
          security unlock-keychain -p "$KEYCHAIN_PASSWORD" "$KEYCHAIN_PATH"
          echo "$CERTIFICATE_BASE64" | base64 --decode > $RUNNER_TEMP/certificate.p12
          security import "$RUNNER_TEMP/certificate.p12" -P "$CERTIFICATE_PASSWORD" -A -t cert -f pkcs12 -k "$KEYCHAIN_PATH"
          security list-keychain -d user -s "$KEYCHAIN_PATH"
          security set-key-partition-list -S apple-tool:,apple: -s -k "$KEYCHAIN_PASSWORD" "$KEYCHAIN_PATH"
          echo "KEYCHAIN_PATH=$KEYCHAIN_PATH" >> $GITHUB_ENV
          echo "KEYCHAIN_PASSWORD=$KEYCHAIN_PASSWORD" >> $GITHUB_ENV
          echo "APPLE_IDENTITY=Developer ID Application: Andrew Chumchal (2TT36YTB8P)" >> $GITHUB_ENV

      - name: Build macOS arm64
        run: npm run make -- --platform darwin --arch arm64
        env:
          APPLE_IDENTITY: ${{ env.APPLE_IDENTITY }}
          APPLE_ID: ${{ secrets.APPLE_ID }}
          APPLE_APP_SPECIFIC_PASSWORD: ${{ secrets.APPLE_APP_SPECIFIC_PASSWORD }}
          APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
          NODE_ENV: production
          NODE_OPTIONS: --max-old-space-size=6144
          SENTRY_DSN: ${{ secrets.SENTRY_DSN }}
          SENTRY_AUTH_TOKEN: ${{ secrets.SENTRY_AUTH_TOKEN }}
          SENTRY_PROJECT: ${{ secrets.SENTRY_PROJECT }}

      - name: Upload dSYMs to Sentry
        continue-on-error: true
        run: |
          npx sentry-cli debug-files upload \
            --org openconduit \
            --project ${{ secrets.SENTRY_PROJECT }} \
            out/make
        env:
          SENTRY_AUTH_TOKEN: ${{ secrets.SENTRY_AUTH_TOKEN }}

      - name: Clean up keychain
        if: always()
        run: |
          if [ -n "$KEYCHAIN_PATH" ]; then
            security delete-keychain "$KEYCHAIN_PATH" || true
          fi

      - uses: actions/upload-artifact@v4
        with:
          name: openconduit-mac-arm64-${{ github.ref_name }}
          path: |
            out/make/**/*.dmg
            out/make/**/*.zip
          if-no-files-found: error
          retention-days: 30

  build-windows:
    name: Build Windows (${{ matrix.arch }})
    runs-on: windows-latest
    timeout-minutes: 30
    permissions:
      packages: read
    strategy:
      matrix:
        arch: [x64, arm64]
    steps:
      - uses: actions/checkout@v5

      - uses: actions/setup-node@v6
        with:
          node-version: 22
          cache: npm
          registry-url: 'https://npm.pkg.github.com'
          scope: '@openconduit'

      - run: npm ci
        env:
          NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

      - name: Build Windows ${{ matrix.arch }}
        run: npm run make -- --platform win32 --arch ${{ matrix.arch }}
        env:
          NODE_ENV: production
          NODE_OPTIONS: --max-old-space-size=6144
          SENTRY_DSN: ${{ secrets.SENTRY_DSN }}
          SENTRY_AUTH_TOKEN: ${{ secrets.SENTRY_AUTH_TOKEN }}
          SENTRY_PROJECT: ${{ secrets.SENTRY_PROJECT }}

      - name: Upload Windows ${{ matrix.arch }} artifacts
        uses: actions/upload-artifact@v4
        with:
          name: openconduit-win-${{ matrix.arch }}-${{ github.ref_name }}
          path: |
            out/make/**/*.exe
            out/make/**/*.nupkg
            out/make/**/RELEASES-*
          if-no-files-found: error
          retention-days: 30

  build-linux:
    name: Build Linux
    runs-on: ubuntu-latest
    timeout-minutes: 30
    permissions:
      packages: read
    steps:
      - uses: actions/checkout@v5

      - uses: actions/setup-node@v6
        with:
          node-version: 22
          cache: npm
          registry-url: 'https://npm.pkg.github.com'
          scope: '@openconduit'

      - run: npm ci
        env:
          NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

      - name: Install Linux packaging deps
        run: sudo apt-get install -y rpm fakeroot

      - name: Build Linux distributable
        id: make
        run: npm run make -- --platform linux --arch x64
        env:
          NODE_ENV: production
          NODE_OPTIONS: --max-old-space-size=6144
          SENTRY_DSN: ${{ secrets.SENTRY_DSN }}
          SENTRY_AUTH_TOKEN: ${{ secrets.SENTRY_AUTH_TOKEN }}
          SENTRY_PROJECT: ${{ secrets.SENTRY_PROJECT }}

      - name: Upload Linux artifacts
        uses: actions/upload-artifact@v4
        with:
          name: openconduit-linux-${{ github.ref_name }}
          path: |
            out/make/**/*.deb
            out/make/**/*.rpm
          if-no-files-found: error
          retention-days: 30

  release:
    name: Create GitHub Release
    needs: [build-mac, build-windows, build-linux]
    runs-on: ubuntu-latest
    steps:
      - uses: actions/download-artifact@v4
        with:
          path: artifacts/

      - name: Detect pre-release
        id: prerelease
        run: |
          TAG="${{ github.event_name == 'workflow_dispatch' && format('v{0}', inputs.version) || github.ref_name }}"
          if [[ "$TAG" == *"-"* ]]; then
            echo "is_prerelease=true" >> $GITHUB_OUTPUT
          else
            echo "is_prerelease=false" >> $GITHUB_OUTPUT
          fi

      - name: Create release
        uses: softprops/action-gh-release@v3
        with:
          tag_name: ${{ github.event_name == 'workflow_dispatch' && format('v{0}', inputs.version) || github.ref_name }}
          files: artifacts/**/*
          generate_release_notes: true
          draft: ${{ steps.prerelease.outputs.is_prerelease == 'false' }}
          prerelease: ${{ steps.prerelease.outputs.is_prerelease == 'true' }}