release.yml

name: Release Desktop App

on:
  # Cut a release by pushing/merging to the `release` branch. The version comes
  # from apps/desktop/src-tauri/tauri.conf.json — bump it before each release, or
  # the build fails trying to re-create an existing tag. Every push here runs a
  # full macOS build (~200 billed Actions minutes), so promote to `release`
  # deliberately, not casually.
  push:
    branches: [release]

jobs:
  build-and-release:
    permissions:
      contents: write
    strategy:
      fail-fast: false
      matrix:
        include:
          # macOS universal (Intel + Apple Silicon).
          # macOS-only in CI — the Linux runner was dropped to conserve the org's
          # free Actions minutes; Linux artifacts are built and uploaded by
          # scripts/release-local.sh instead. No Windows build for now.
          - platform: macos-latest
            args: '--target universal-apple-darwin'
            rust_target: 'aarch64-apple-darwin,x86_64-apple-darwin'

    runs-on: ${{ matrix.platform }}

    steps:
      - uses: actions/checkout@v4

      # Fail fast, before the ~200-minute macOS build, if the changelog wasn't
      # updated for this version. The release body links to /changelog, so a
      # missing entry ships a release pointing at a page that never mentions it.
      - name: Check changelog has an entry for this version
        run: |
          VERSION=$(node -p "require('./apps/desktop/src-tauri/tauri.conf.json').version")
          if ! grep -q "version: '$VERSION'" apps/web/src/lib/changelog.ts; then
            echo "::error::No changelog entry for $VERSION. Prepend one to apps/web/src/lib/changelog.ts."
            exit 1
          fi
          echo "Changelog entry found for $VERSION"

      - name: Install pnpm
        uses: pnpm/action-setup@v4
        # version intentionally omitted — taken from package.json "packageManager"

      - name: Set up Node
        uses: actions/setup-node@v4
        with:
          node-version-file: .nvmrc
          cache: pnpm

      - name: Install Rust stable
        uses: dtolnay/rust-toolchain@stable
        with:
          targets: ${{ matrix.rust_target }}

      - name: Rust cache
        uses: swatinem/rust-cache@v2
        with:
          workspaces: apps/desktop/src-tauri -> target

      - name: Install frontend dependencies
        run: pnpm install --frozen-lockfile

      - name: Build and release
        uses: tauri-apps/tauri-action@v0
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          # macOS code signing
          APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }}
          APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
          APPLE_SIGNING_IDENTITY: ${{ secrets.APPLE_SIGNING_IDENTITY }}
          APPLE_ID: ${{ secrets.APPLE_ID }}
          APPLE_PASSWORD: ${{ secrets.APPLE_PASSWORD }}
          APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
          # Tauri updater signing
          TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
          TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
        with:
          projectPath: apps/desktop
          # __VERSION__ is replaced by tauri-action with the version from
          # tauri.conf.json, so the release/tag is v<version> (e.g. v0.1.0).
          tagName: v__VERSION__
          releaseName: MyDevTools v__VERSION__
          releaseBody: |
            Full release notes: https://mydevtools.tech/changelog
          releaseDraft: false
          prerelease: false
          args: ${{ matrix.args }}
          updaterJsonPath: latest.json
          updaterJsonKeepUniversal: true

      # Historical: this repo used to be private, so artifacts were mirrored to a
      # public releases repo. The repo is public now and both the updater endpoint
      # (tauri.conf.json) and the website download button point at this repo's
      # releases; the mirror is kept only for older installs that still poll it.
      - name: Mirror release to public repo
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}      # read this repo's release
          RELEASES_TOKEN: ${{ secrets.RELEASES_TOKEN }}  # write to the mirror repo
          PUBLIC_REPO: mydevtools-tech/mydevtools-releases
        run: |
          set -euo pipefail
          VERSION="$(node -p "require('./apps/desktop/src-tauri/tauri.conf.json').version")"
          TAG="v$VERSION"
          BUNDLE="apps/desktop/src-tauri/target/universal-apple-darwin/release/bundle"
          DMG="$(ls "$BUNDLE"/dmg/*.dmg)"
          TARGZ="$(ls "$BUNDLE"/macos/*.app.tar.gz)"
          SIG="$(ls "$BUNDLE"/macos/*.app.tar.gz.sig)"

          # Pull tauri's generated latest.json from this repo's release.
          # threatcrush-disable-next-line secret-generic-credential
          GH_TOKEN="$GITHUB_TOKEN" gh release download "$TAG" \
            --repo "$GITHUB_REPOSITORY" --pattern latest.json --dir . --clobber

          # Repoint its asset URLs at the public repo. The minisign signature
          # signs the file bytes, not the URL, so it stays valid.
          node -e '
            const fs = require("fs");
            const src = process.env.GITHUB_REPOSITORY, dst = process.env.PUBLIC_REPO;
            const j = JSON.parse(fs.readFileSync("latest.json", "utf8"));
            for (const k of Object.keys(j.platforms || {}))
              j.platforms[k].url = j.platforms[k].url.split(src).join(dst);
            fs.writeFileSync("latest.json", JSON.stringify(j, null, 2));
          '

          # Create the public release (once) and upload all four assets.
          # GH_TOKEN is assigned from an env var, not a literal — the three
          # lines below are scanner false positives, not embedded tokens.
          # threatcrush-disable-next-line secret-generic-credential
          if ! GH_TOKEN="$RELEASES_TOKEN" gh release view "$TAG" --repo "$PUBLIC_REPO" >/dev/null 2>&1; then
            # threatcrush-disable-next-line secret-generic-credential
            GH_TOKEN="$RELEASES_TOKEN" gh release create "$TAG" --repo "$PUBLIC_REPO" \
              --title "MyDevTools $TAG" --notes "MyDevTools desktop $TAG"
          fi
          # threatcrush-disable-next-line secret-generic-credential
          GH_TOKEN="$RELEASES_TOKEN" gh release upload "$TAG" --repo "$PUBLIC_REPO" \
            --clobber "$DMG" "$TARGZ" "$SIG" latest.json