publish.yml

name: "publish"

# change this when ready to release if you want CI/CD
on:
  workflow_dispatch:
    inputs:
      interactionId:
        description: "Discord Interaction ID"
        required: false
        type: string
      windowsTarget:
        description: "Windows build target"
        required: false
        default: all
        type: choice
        options:
          - all
          - x64
          - arm64
      buildMac:
        description: "Build macOS installers"
        required: false
        default: true
        type: boolean

env:
  APP_CARGO_TOML: apps/desktop/src-tauri/Cargo.toml
  SENTRY_ORG: cap-s2
  SENTRY_PROJECT: cap-desktop

jobs:
  draft:
    runs-on: ubuntu-latest
    outputs:
      version: ${{ steps.read_version.outputs.value }}
      needs_release: ${{ steps.create_tag.outputs.tag_existed != 'true' }}
      gh_release_url: ${{ steps.create_gh_release.outputs.url }}
    permissions:
      contents: write
      id-token: write
    steps:
      - uses: actions/checkout@v4

      - name: Read version number
        uses: SebRollen/toml-action@v1.0.2
        id: read_version
        with:
          file: ${{ env.APP_CARGO_TOML }}
          field: "package.version"

      - name: Create tag
        id: create_tag
        uses: actions/github-script@v7
        with:
          script: |
            const version = "${{ steps.read_version.outputs.value }}";
            const tag = `cap-v${version}`;
            const tagRef = `tags/${tag}`;
            const appCargoToml = "${{ env.APP_CARGO_TOML }}";

            const TAG_EXISTED = "tag_existed";
            const TAG_NAME = "tag_name";

            core.setOutput(TAG_NAME, tag);

            async function main() {
              let tagExisted = true;

              try {
                await github.rest.git.getRef({
                  ref: tagRef,
                  owner: context.repo.owner,
                  repo: context.repo.repo,
                });

                core.notice(
                  `Release skipped as tag '${tag}' already exists. Update the version in '${appCargoToml}' before starting another release.`,
                );
              } catch (error) {
                if ("status" in error && error.status === 404) {
                  tagExisted = false;
                } else {
                  throw error;
                }
              }

              core.setOutput(TAG_EXISTED, tagExisted);

              if (!tagExisted) {
                await github.rest.git.createRef({
                  ref: `refs/${tagRef}`,
                  owner: context.repo.owner,
                  repo: context.repo.repo,
                  sha: context.sha,
                });
              }
            }

            await main();

      - name: Create draft GH release
        id: create_gh_release
        # TODO: Change to stable version when available
        uses: softprops/action-gh-release@v2
        with:
          name: ${{ steps.read_version.outputs.value }}
          tag_name: ${{ steps.create_tag.outputs.tag_name }}
          draft: true
          generate_release_notes: true

      - name: Update Discord interaction
        if: ${{ inputs.interactionId != '' }}
        uses: actions/github-script@v7
        with:
          script: |
            async function main() {
              const token = await core.getIDToken("cap-discord-bot");

              const resp = await fetch(
                "https://cap-discord-bot.brendonovich.workers.dev/github-workflow",
                {
                  method: "POST",
                  body: JSON.stringify({
                    type: "release-ready",
                    tag: "${{ steps.create_tag.outputs.tag_name }}",
                    version: "${{ steps.read_version.outputs.value }}",
                    releaseUrl: "${{ steps.create_gh_release.outputs.url }}",
                    interactionId: "${{ inputs.interactionId }}",
                  }),
                  headers: {
                    "Content-Type": "application/json",
                    Authorization: `Bearer ${token}`,
                  },
                },
              );

              if (resp.status !== 200) {
                throw new Error(await resp.text());
              }
            }

            await main();

  build:
    needs: draft
    if: ${{ needs.draft.outputs.needs_release == 'true' }}
    permissions:
      contents: write
      actions: read
    strategy:
      fail-fast: false
      matrix:
        settings:
          - target: x86_64-apple-darwin
            runner: macos-latest-xlarge
            platform: macos
            arch: x64
          - target: aarch64-apple-darwin
            runner: macos-latest-xlarge
            platform: macos
            arch: arm64
          - target: x86_64-pc-windows-msvc
            runner: windows-latest
            platform: windows
            arch: x64
          - target: aarch64-pc-windows-msvc
            runner: windows-latest
            platform: windows
            arch: arm64
    env:
      TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }}
      TURBO_TEAM: ${{ secrets.TURBO_TEAM }}
      RUN_BUILD: ${{ (matrix.settings.platform == 'macos' && inputs.buildMac) || (matrix.settings.platform == 'windows' && (inputs.windowsTarget == 'all' || inputs.windowsTarget == matrix.settings.arch)) }}
    runs-on: ${{ matrix.settings.runner }}
    steps:
      - name: Checkout repository
        if: ${{ env.RUN_BUILD == 'true' }}
        uses: actions/checkout@v4

      - name: Normalize Cargo version
        if: ${{ env.RUN_BUILD == 'true' }}
        shell: bash
        run: |
          node <<'NODE'
          const fs = require('node:fs');
          const cargoTomlPath = 'apps/desktop/src-tauri/Cargo.toml';
          const contents = fs.readFileSync(cargoTomlPath, 'utf8');
          const normalized = contents.replace(
            /^version\s*=\s*"cap-v([^"]+)"$/m,
            'version = "$1"',
          );

          if (normalized !== contents) {
            fs.writeFileSync(cargoTomlPath, normalized);
            console.log(`Normalized ${cargoTomlPath} to semver`);
          }
          NODE

      - name: Create API Key File
        if: ${{ env.RUN_BUILD == 'true' }}
        run: echo "${{ secrets.APPLE_API_KEY_FILE }}" > api.p8

      - uses: apple-actions/import-codesign-certs@v2
        if: ${{ env.RUN_BUILD == 'true' && matrix.settings.runner == 'macos-latest-xlarge' }}
        with:
          p12-file-base64: ${{ secrets.APPLE_CERTIFICATE }}
          p12-password: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}

      - name: Verify certificate
        if: ${{ env.RUN_BUILD == 'true' && matrix.settings.runner == 'macos-latest-xlarge' }}
        run: security find-identity -v -p codesigning ${{ runner.temp }}/build.keychain

      - name: Rust setup
        if: ${{ env.RUN_BUILD == 'true' }}
        uses: dtolnay/rust-toolchain@stable
        with:
          targets: ${{ matrix.settings.target }}

      - uses: ./.github/actions/setup-rust-cache
        if: ${{ env.RUN_BUILD == 'true' }}
        with:
          target: ${{ matrix.settings.target }}

      - uses: ./.github/actions/setup-js
        if: ${{ env.RUN_BUILD == 'true' }}

      - name: Create .env file in root
        if: ${{ env.RUN_BUILD == 'true' }}
        run: |
          echo "appVersion=${{ needs.draft.outputs.version }}" >> .env
          echo "VITE_ENVIRONMENT=production" >> .env
          echo "CAP_DESKTOP_SENTRY_URL=https://6a3b6a09e6ae976c2ad6fff710e88748@o4506859771527168.ingest.us.sentry.io/4508330917101568" >> .env
          echo "NEXT_PUBLIC_WEB_URL=${{ secrets.NEXT_PUBLIC_WEB_URL }}" >> .env
          echo 'NEXTAUTH_URL=${{ secrets.NEXT_PUBLIC_WEB_URL }}' >> .env
          echo 'VITE_POSTHOG_KEY=${{ secrets.VITE_POSTHOG_KEY }}' >> .env
          echo 'VITE_POSTHOG_HOST=${{ secrets.VITE_POSTHOG_HOST }}' >> .env
          echo 'VITE_SERVER_URL=${{ secrets.NEXT_PUBLIC_WEB_URL }}' >> .env
          echo 'RUST_TARGET_TRIPLE=${{ matrix.settings.target }}' >> .env

      - name: Prepare Tauri build config
        if: ${{ env.RUN_BUILD == 'true' }}
        shell: node {0}
        env:
          RAW_TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
        run: |
          const fs = require("node:fs");
          const path = require("node:path");

          const workspace = process.env.GITHUB_WORKSPACE;
          const sourceConfigPath = path.join(workspace, "apps/desktop/src-tauri/tauri.prod.conf.json");
          const buildConfigPath = path.join(workspace, "apps/desktop/src-tauri/tauri.build.conf.json");
          const config = JSON.parse(fs.readFileSync(sourceConfigPath, "utf8"));

          const raw = (process.env.RAW_TAURI_SIGNING_PRIVATE_KEY || "").trim();
          const candidates = raw
            ? new Set([raw, raw.replace(/\\n/g, "\n")])
            : new Set();

          if (raw && /^[A-Za-z0-9+/=\r\n]+$/.test(raw) && !raw.includes("untrusted comment:")) {
            try {
              const decoded = Buffer.from(raw.replace(/\s+/g, ""), "base64").toString("utf8");
              candidates.add(decoded);
              candidates.add(decoded.replace(/\\n/g, "\n"));
            } catch {}
          }

          const key = [...candidates].find(
            (value) =>
              value.includes("untrusted comment:") &&
              value.toLowerCase().includes("minisign secret key"),
          );

          if (key) {
            fs.appendFileSync(
              process.env.GITHUB_ENV,
              `TAURI_SIGNING_PRIVATE_KEY<<__TAURI_KEY__\n${key}\n__TAURI_KEY__\n`,
            );
          } else {
            config.plugins ??= {};
            config.plugins.updater ??= {};
            config.plugins.updater.active = false;

            config.bundle ??= {};
            config.bundle.createUpdaterArtifacts = false;
          }

          fs.writeFileSync(buildConfigPath, `${JSON.stringify(config, null, 2)}\n`);

      - name: Build app
        if: ${{ env.RUN_BUILD == 'true' }}
        working-directory: apps/desktop
        run: |
          pnpm -w cap-setup
          pnpm build:tauri --target ${{ matrix.settings.target }} --config src-tauri/tauri.build.conf.json
        env:
          # https://github.com/tauri-apps/tauri-action/issues/740
          CI: false
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          # codesigning
          APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }}
          APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
          APPLE_SIGNING_IDENTITY: ${{ secrets.APPLE_SIGNING_IDENTITY }}
          # notarization
          APPLE_API_ISSUER: ${{ secrets.APPLE_API_ISSUER }}
          APPLE_API_KEY: ${{ secrets.APPLE_API_KEY }}
          APPLE_API_KEY_PATH: ${{ github.workspace }}/api.p8
          APPLE_KEYCHAIN: ${{ runner.temp }}/build.keychain
          TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}

      # - name: Upload unsigned Windows installer
      #   if: ${{ runner.os == 'Windows' }}
      #   id: upload_unsigned_windows_installer
      #   uses: actions/upload-artifact@v4
      #   with:
      #     name: unsigned-windows-installer
      #     path: target/${{ matrix.settings.target }}/release/bundle/nsis/*.exe
      #     if-no-files-found: error

      # - name: Submit SignPath signing request
      #   if: ${{ runner.os == 'Windows' }}
      #   id: submit_signpath_signing_request
      #   uses: signpath/github-action-submit-signing-request@v1
      #   with:
      #     api-token: ${{ secrets.SIGNPATH_API_TOKEN }}
      #     organization-id: ${{ secrets.SIGNPATH_ORGANIZATION_ID }}
      #     project-slug: ${{ secrets.SIGNPATH_PROJECT_SLUG }}
      #     signing-policy-slug: ${{ secrets.SIGNPATH_SIGNING_POLICY_SLUG }}
      #     github-artifact-id: ${{ steps.upload_unsigned_windows_installer.outputs.artifact-id }}
      #     wait-for-completion: true
      #     output-artifact-directory: signed-windows-installer

      # - name: Restore signed Windows installer
      #   if: ${{ runner.os == 'Windows' }}
      #   shell: pwsh
      #   run: |
      #     $signedDir = "signed-windows-installer"
      #     $bundleDir = "target/${{ matrix.settings.target }}/release/bundle/nsis"

      #     if (-not (Test-Path $signedDir)) {
      #       throw "Signed artifact directory '$signedDir' not found."
      #     }

      #     $executables = Get-ChildItem -Path $signedDir -Filter *.exe -Recurse
      #     if (-not $executables) {
      #       throw "No signed executables found in '$signedDir'."
      #     }

      #     # Copy signed executables back to the original bundle location for CrabNebula upload
      #     Write-Host "Copying signed executables to: $bundleDir"
      #     Copy-Item -Path (Join-Path $signedDir '*.exe') -Destination $bundleDir -Force

      #     # List the files to verify
      #     Write-Host "Files in bundle directory after signing:"
      #     Get-ChildItem -Path $bundleDir -Filter *.exe | ForEach-Object { Write-Host "  - $($_.Name)" }

      - name: Upload Windows ARM installer artifact
        if: ${{ env.RUN_BUILD == 'true' && matrix.settings.platform == 'windows' && matrix.settings.arch == 'arm64' }}
        uses: actions/upload-artifact@v4
        with:
          name: windows-arm-installer
          path: target/${{ matrix.settings.target }}/release/bundle/nsis/*.exe
          if-no-files-found: error

      - uses: matbour/setup-sentry-cli@8ef22a4ff03bcd1ebbcaa3a36a81482ca8e3872e
        if: ${{ env.RUN_BUILD == 'true' }}

      - name: Upload debug symbols to Sentry
        if: ${{ env.RUN_BUILD == 'true' && runner.os == 'macOS' }}
        shell: bash
        env:
          SENTRY_AUTH_TOKEN: ${{ secrets.SENTRY_AUTH_TOKEN }}
        run: |
          sentry-cli debug-files upload -o ${{ env.SENTRY_ORG }} -p ${{ env.SENTRY_PROJECT }} target/Cap.dSYM

      - name: Upload debug symbols to Sentry
        if: ${{ env.RUN_BUILD == 'true' && runner.os == 'Windows' }}
        shell: bash
        env:
          SENTRY_AUTH_TOKEN: ${{ secrets.SENTRY_AUTH_TOKEN }}
        run: |
          sentry-cli debug-files upload -o ${{ env.SENTRY_ORG }} -p ${{ env.SENTRY_PROJECT }} target/${{ matrix.settings.target }}/release/cap_desktop.pdb

  done:
    needs: [draft, build]
    runs-on: ubuntu-latest
    permissions:
      contents: write
      id-token: write
    steps:
      - name: Send Discord notification
        if: ${{ inputs.interactionId != '' }}
        uses: actions/github-script@v7
        with:
          script: |
            async function main() {
              const token = await core.getIDToken("cap-discord-bot");

              const resp = await fetch(
                "https://cap-discord-bot.brendonovich.workers.dev/github-workflow",
                {
                  method: "POST",
                  body: JSON.stringify({
                    type: "release-done",
                    interactionId: "${{ inputs.interactionId }}",
                    version: "${{ needs.draft.outputs.version }}",
                    releaseUrl: "${{ needs.draft.outputs.gh_release_url }}",
                  }),
                  headers: {
                    "Content-Type": "application/json",
                    Authorization: `Bearer ${token}`,
                  },
                },
              );

              if (resp.status !== 200) {
                throw new Error(await resp.text());
              }
            }

            await main();