build.yml

name: Desktop Bundles

on:
  # Expensive desktop bundle builds only run on release-track events:
  #   - push to release/**, hotfix/**  (validate before tagging)
  #   - tag push v*                   (actual release)
  #   - PR to main                    (release/hotfix PRs — verify job only)
  #   - workflow_dispatch             (manual)
  # Push to main/develop does NOT trigger this workflow. Test Suite (test.yml)
  # handles TypeScript/tests/build validation on those branches.
  pull_request:
    branches: [main]
    paths-ignore:
      - '**.md'
      - 'docs/**'
      - '.github/ISSUE_TEMPLATE/**'
      - '.github/PULL_REQUEST_TEMPLATE.md'
  push:
    branches: ['release/**', 'hotfix/**']
    tags: ['v*']
    paths-ignore:
      - '**.md'
      - 'docs/**'
      - '.github/ISSUE_TEMPLATE/**'
      - '.github/PULL_REQUEST_TEMPLATE.md'
  workflow_dispatch:
    inputs:
      checkout_ref:
        description: Git ref to build for manual runs, for example refs/tags/v0.1.0 or main
        required: false
        type: string
      publish_npm:
        description: Publish the CLI package to npm for a tagged manual run
        required: false
        type: boolean
        default: false
      publish_release:
        description: Publish the built installers to GitHub Releases
        required: false
        type: boolean
        default: false
      release_tag:
        description: Release tag to create or update when publishing manually, for example v0.1.0
        required: false
        type: string
      draft_release:
        description: Create the manual GitHub release as a draft
        required: false
        type: boolean
        default: true
      prerelease:
        description: Mark the manual GitHub release as a prerelease
        required: false
        type: boolean
        default: false

permissions:
  contents: read

env:
  NODE_VERSION: 'lts/*'

concurrency:
  group: desktop-bundles-${{ github.event_name == 'workflow_dispatch' && inputs.checkout_ref || github.ref }}
  cancel-in-progress: true

jobs:
  verify:
    name: Verify Release Gate
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          ref: ${{ github.event_name == 'workflow_dispatch' && inputs.checkout_ref || github.ref }}

      - uses: actions/setup-node@v4
        with:
          node-version: ${{ env.NODE_VERSION }}
          cache: npm

      - run: npm ci

      - name: TypeScript check
        run: npx tsc -b --noEmit packages/web

      - name: Unit tests
        run: npm test

      - name: Build web
        run: npm run build

  bundle:
    name: Bundle (${{ matrix.label }})
    needs: verify
    if: github.event_name != 'pull_request'
    runs-on: ${{ matrix.os }}
    strategy:
      fail-fast: false
      matrix:
        include:
          - os: ubuntu-24.04
            target: x86_64-unknown-linux-gnu
            label: Linux x64
            artifact_name: clawmaster-linux-x64
            bundles: appimage,deb
          - os: macos-15-intel
            target: x86_64-apple-darwin
            label: macOS Intel
            artifact_name: clawmaster-macos-intel
          - os: macos-14
            target: aarch64-apple-darwin
            label: macOS Apple Silicon
            artifact_name: clawmaster-macos-arm64
          - os: windows-latest
            target: x86_64-pc-windows-msvc
            label: Windows x64
            artifact_name: clawmaster-windows-x64

    steps:
      - uses: actions/checkout@v4
        with:
          ref: ${{ github.event_name == 'workflow_dispatch' && inputs.checkout_ref || github.ref }}

      - uses: actions/setup-node@v4
        with:
          node-version: ${{ env.NODE_VERSION }}
          cache: npm

      - uses: ./.github/actions/setup-rust
        with:
          targets: ${{ matrix.target }}

      - uses: Swatinem/rust-cache@v2
        with:
          workspaces: src-tauri
          key: ${{ matrix.target }}

      - name: Install Linux build dependencies
        if: runner.os == 'Linux'
        run: |
          sudo apt-get update
          sudo apt-get install -y --no-install-recommends \
            build-essential \
            curl \
            file \
            libayatana-appindicator3-dev \
            libgtk-3-dev \
            librsvg2-dev \
            libssl-dev \
            libwebkit2gtk-4.1-dev \
            libxdo-dev \
            patchelf \
            wget

      - run: npm ci

      - name: Normalize version for MSI (numeric-only required)
        if: runner.os == 'Windows'
        shell: bash
        run: |
          RAW=$(node -p "require('./package.json').version")
          NUMERIC="${RAW%%-*}"
          # Rewrite tauri.conf.json in-place — MSI rejects semver pre-release suffixes
          node -e "
            const fs = require('fs');
            const p = 'src-tauri/tauri.conf.json';
            const c = JSON.parse(fs.readFileSync(p, 'utf8'));
            c.version = '$NUMERIC';
            fs.writeFileSync(p, JSON.stringify(c, null, 2) + '\n');
          "
          echo "Normalized tauri.conf.json version to $NUMERIC"

      - name: Build Tauri desktop bundles
        run: npx tauri build --target ${{ matrix.target }} ${{ matrix.bundles && format('--bundles {0}', matrix.bundles) || '' }}

      - name: Collect workflow bundle files
        shell: bash
        env:
          TARGET_BUNDLE_ROOT: src-tauri/target/${{ matrix.target }}/release/bundle
          DEFAULT_BUNDLE_ROOT: src-tauri/target/release/bundle
          ARTIFACT_DIR: ci-artifacts/${{ matrix.artifact_name }}
          RUNNER_OS: ${{ runner.os }}
        run: |
          set -euo pipefail

          mkdir -p "$ARTIFACT_DIR"

          BUNDLE_ROOTS=()
          if [ -d "$TARGET_BUNDLE_ROOT" ]; then
            BUNDLE_ROOTS+=("$TARGET_BUNDLE_ROOT")
          fi
          if [ -d "$DEFAULT_BUNDLE_ROOT" ] && [ "$DEFAULT_BUNDLE_ROOT" != "$TARGET_BUNDLE_ROOT" ]; then
            BUNDLE_ROOTS+=("$DEFAULT_BUNDLE_ROOT")
          fi

          if [ "${#BUNDLE_ROOTS[@]}" -eq 0 ]; then
            echo "No bundle directory found" >&2
            echo "Checked:" >&2
            echo "  - $TARGET_BUNDLE_ROOT" >&2
            echo "  - $DEFAULT_BUNDLE_ROOT" >&2
            exit 1
          fi

          # Use -maxdepth to stay in top-level bundle output dirs (e.g. bundle/msi/,
          # bundle/deb/). This keeps internal resources (ICU data, npm packages
          # bundled via .tauri-resources/) out of the release artifacts.
          case "$RUNNER_OS" in
            Linux)
              for root in "${BUNDLE_ROOTS[@]}"; do
                find "$root" -maxdepth 3 -type f \
                  \( -name '*.AppImage' -o -name '*.deb' -o -name '*.sig' \) \
                  -exec cp '{}' "$ARTIFACT_DIR"/ \;
              done
              ;;
            macOS)
              for root in "${BUNDLE_ROOTS[@]}"; do
                find "$root" -maxdepth 3 -type f \
                  \( -name '*.dmg' -o -name '*.app.tar.gz' -o -name '*.sig' \) \
                  -exec cp '{}' "$ARTIFACT_DIR"/ \;
              done
              ;;
            Windows)
              for root in "${BUNDLE_ROOTS[@]}"; do
                find "$root" -maxdepth 3 -type f \
                  \( -name '*.msi' -o -name '*.exe' -o -name '*.zip' -o -name '*.sig' \) \
                  -exec cp '{}' "$ARTIFACT_DIR"/ \;
              done
              ;;
            *)
              echo "Unsupported runner OS: $RUNNER_OS" >&2
              exit 1
              ;;
          esac

          if [ -z "$(find "$ARTIFACT_DIR" -maxdepth 1 -type f -print -quit)" ]; then
            echo "No bundle files were collected for $RUNNER_OS" >&2
            for root in "${BUNDLE_ROOTS[@]}"; do
              echo "--- $root ---" >&2
              find "$root" -maxdepth 4 -type f | sort >&2
            done
            exit 1
          fi

          {
            echo "### ${{ matrix.label }}"
            while IFS= read -r file; do
              echo "- $(basename "$file")"
            done < <(find "$ARTIFACT_DIR" -maxdepth 1 -type f | sort)
            echo
          } >> "$GITHUB_STEP_SUMMARY"

      - name: Upload workflow bundle artifact
        uses: actions/upload-artifact@v4
        with:
          name: ${{ matrix.artifact_name }}
          path: ci-artifacts/${{ matrix.artifact_name }}
          if-no-files-found: error
          retention-days: 14

  publish-npm:
    name: Publish to npm
    needs: verify
    runs-on: ubuntu-latest
    if: startsWith(github.ref, 'refs/tags/v') || (github.event_name == 'workflow_dispatch' && inputs.publish_npm)
    steps:
      - uses: actions/checkout@v4
        with:
          ref: ${{ github.event_name == 'workflow_dispatch' && inputs.checkout_ref || github.ref }}

      - uses: actions/setup-node@v4
        with:
          node-version: ${{ env.NODE_VERSION }}
          cache: npm
          registry-url: https://registry.npmjs.org

      - run: npm ci

      - name: Resolve npm release tag
        id: npm_release
        env:
          EVENT_NAME: ${{ github.event_name }}
          REF_NAME: ${{ github.ref_name }}
          INPUT_RELEASE_TAG: ${{ inputs.release_tag }}
          INPUT_CHECKOUT_REF: ${{ inputs.checkout_ref }}
        run: |
          set -euo pipefail

          if [ "$EVENT_NAME" = "workflow_dispatch" ]; then
            if [ -n "$INPUT_RELEASE_TAG" ]; then
              TAG="$INPUT_RELEASE_TAG"
            elif printf '%s' "$INPUT_CHECKOUT_REF" | grep -Eq '^refs/tags/v'; then
              TAG="${INPUT_CHECKOUT_REF#refs/tags/}"
            elif printf '%s' "$INPUT_CHECKOUT_REF" | grep -Eq '^v'; then
              TAG="$INPUT_CHECKOUT_REF"
            else
              echo "publish_npm requires release_tag or checkout_ref pointing to refs/tags/v*" >&2
              exit 1
            fi
          else
            TAG="$REF_NAME"
          fi

          if ! printf '%s' "$TAG" | grep -Eq '^v'; then
            echo "npm publish only supports version tags like v0.3.0 or v0.3.0-rc.3 (got $TAG)" >&2
            exit 1
          fi

          echo "tag=$TAG" >> "$GITHUB_OUTPUT"

      - name: Determine npm dist-tag
        id: npm_tag
        env:
          TAG: ${{ steps.npm_release.outputs.tag }}
        run: |
          VERSION="${TAG#v}"
          if printf '%s' "$VERSION" | grep -Eq -- '-(rc|beta|alpha)'; then
            echo "tag=rc" >> "$GITHUB_OUTPUT"
          else
            echo "tag=latest" >> "$GITHUB_OUTPUT"
          fi

      - name: Check if version already published
        id: check_npm
        env:
          TAG: ${{ steps.npm_release.outputs.tag }}
        run: |
          EXPECTED_VERSION="${TAG#v}"
          VERSION=$(node -p "require('./package.json').version")
          if [ "$EXPECTED_VERSION" != "$VERSION" ]; then
            echo "Release tag $TAG does not match package.json version $VERSION" >&2
            exit 1
          fi
          if npm view "clawmaster@$VERSION" version >/dev/null 2>&1; then
            echo "skip=true" >> "$GITHUB_OUTPUT"
            echo "clawmaster@$VERSION is already on npm; skipping publish"
          else
            echo "skip=false" >> "$GITHUB_OUTPUT"
          fi

      - name: Publish
        if: steps.check_npm.outputs.skip != 'true'
        run: npm publish --tag ${{ steps.npm_tag.outputs.tag }}
        env:
          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}

  publish-release:
    name: Publish Release Assets
    needs: bundle
    runs-on: ubuntu-latest
    if: startsWith(github.ref, 'refs/tags/v') || (github.event_name == 'workflow_dispatch' && inputs.publish_release)
    permissions:
      contents: write
    steps:
      - uses: actions/checkout@v4
        with:
          ref: ${{ github.event_name == 'workflow_dispatch' && inputs.checkout_ref || github.ref }}
          # Generated release notes need complete history and tags so the
          # workflow can choose the right previous tag for stable/prerelease
          # comparisons.
          fetch-depth: 0
          fetch-tags: true

      - uses: actions/download-artifact@v5
        with:
          path: release-bundles

      - name: Resolve release tag
        id: release_meta
        env:
          EVENT_NAME: ${{ github.event_name }}
          REF_NAME: ${{ github.ref_name }}
          INPUT_RELEASE_TAG: ${{ inputs.release_tag }}
        run: |
          set -euo pipefail

          if [ "$EVENT_NAME" = "workflow_dispatch" ]; then
            TAG="$INPUT_RELEASE_TAG"
          else
            TAG="$REF_NAME"
          fi

          if [ -z "$TAG" ]; then
            echo "release_tag is required when publish_release is enabled for workflow_dispatch" >&2
            exit 1
          fi

          echo "tag=$TAG" >> "$GITHUB_OUTPUT"

      - name: Verify tag matches package version
        env:
          TAG: ${{ steps.release_meta.outputs.tag }}
        run: |
          set -euo pipefail
          EXPECTED_VERSION="${TAG#v}"
          PACKAGE_VERSION="$(node -p "require('./package.json').version")"

          if [ "$EXPECTED_VERSION" != "$PACKAGE_VERSION" ]; then
            echo "Release tag $TAG does not match package.json version $PACKAGE_VERSION" >&2
            exit 1
          fi

      - name: Collect release assets
        run: |
          set -euo pipefail
          mkdir -p release-assets

          # Only installer bundles — exclude internal JSON (ICU data, package
          # manifests, tsconfig) that gets packaged inside Tauri resources.
          find release-bundles -type f \
            \( -name '*.AppImage' -o -name '*.deb' \
               -o -name '*.dmg' -o -name '*.app.tar.gz' \
               -o -name '*.msi' -o -name '*.exe' \
               -o -name '*.sig' \) \
            -exec cp '{}' release-assets/ \;

          if [ -z "$(find release-assets -maxdepth 1 -type f -print -quit)" ]; then
            echo "No desktop bundle files were found to publish" >&2
            find release-bundles -maxdepth 4 -type f | sort
            exit 1
          fi

          (
            cd release-assets
            sha256sum * > SHA256SUMS.txt
          )

      - name: Create release preface
        env:
          GH_REPO: ${{ github.repository }}
          TAG: ${{ steps.release_meta.outputs.tag }}
        run: |
          set -euo pipefail

          VERSION="${TAG#v}"

          RELEASE_DOWNLOAD_BASE="https://github.com/${GH_REPO}/releases/download/${TAG}"
          NPM_PACKAGE_URL="https://www.npmjs.com/package/clawmaster/v/${VERSION}"
          NPM_DIST_URL="https://www.npmjs.com/package/clawmaster?activeTab=versions"

          # Build direct asset URLs deterministically from the release tag.
          linux_appimage_url="${RELEASE_DOWNLOAD_BASE}/ClawMaster_${VERSION}_amd64.AppImage"
          linux_deb_url="${RELEASE_DOWNLOAD_BASE}/ClawMaster_${VERSION}_amd64.deb"
          macos_intel_url="${RELEASE_DOWNLOAD_BASE}/ClawMaster_${VERSION}_x64.dmg"
          macos_arm64_url="${RELEASE_DOWNLOAD_BASE}/ClawMaster_${VERSION}_aarch64.dmg"
          windows_msi_url="${RELEASE_DOWNLOAD_BASE}/ClawMaster_${VERSION}_x64_en-US.msi"
          windows_exe_url="${RELEASE_DOWNLOAD_BASE}/ClawMaster_${VERSION}_x64-setup.exe"
          checksums_url="${RELEASE_DOWNLOAD_BASE}/SHA256SUMS.txt"

          # Use printf instead of heredoc because YAML's `run: |` indentation
          # leaks into the heredoc content — turning every heading into an
          # indented code block in the rendered markdown.
          {
            printf '## Install\n\n'
            printf '### CLI + Web Console (Recommended)\n\n'
            printf '```bash\n'
            printf 'npm install -g clawmaster\n'
            printf 'clawmaster\n'
            printf '```\n\n'
            printf '`clawmaster` starts the local service and opens the landing page in your browser by default.\n\n'
            printf 'If the browser does not open automatically, use the backup local address: http://localhost:16223\n\n'
            printf -- '- npm package: [%s](%s)\n' "clawmaster@${VERSION}" "$NPM_PACKAGE_URL"
            printf -- '- all published versions: [%s](%s)\n\n' "npm versions" "$NPM_DIST_URL"
            printf '> To pin this exact version: `npm install -g clawmaster@%s`\n\n' "$VERSION"
            printf '### Desktop App (Beta)\n\n'
            printf 'Direct downloads for this release. Checksums: [`SHA256SUMS.txt`](%s)\n\n' "$checksums_url"
            printf '| Platform | Downloads |\n'
            printf '|---|---|\n'
            printf '| Linux x64 | [AppImage](%s) · [deb](%s) |\n' "$linux_appimage_url" "$linux_deb_url"
            printf '| macOS Intel | [dmg](%s) |\n' "$macos_intel_url"
            printf '| macOS Apple Silicon | [dmg](%s) |\n' "$macos_arm64_url"
            printf '| Windows x64 | [msi](%s) · [exe](%s) |\n\n' "$windows_msi_url" "$windows_exe_url"
            printf '> Desktop builds are in beta. The CLI + Web Console is the recommended install method.\n\n'
          } > RELEASE_PREFACE.md

      - name: Generate release notes body
        env:
          GH_REPO: ${{ github.repository }}
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          TAG: ${{ steps.release_meta.outputs.tag }}
        run: |
          set -euo pipefail
          node scripts/release-notes.mjs "$TAG" > RELEASE_CHANGES.md
          cat RELEASE_PREFACE.md RELEASE_CHANGES.md > RELEASE_BODY.md

      - name: Resolve release options
        id: release_options
        env:
          TAG: ${{ steps.release_meta.outputs.tag }}
          EVENT_NAME: ${{ github.event_name }}
          INPUT_DRAFT: ${{ inputs.draft_release }}
          INPUT_PRERELEASE: ${{ inputs.prerelease }}
        run: |
          set -euo pipefail

          draft="false"
          prerelease="false"

          if [ "$EVENT_NAME" = "workflow_dispatch" ]; then
            if [ "$INPUT_DRAFT" = "true" ]; then
              draft="true"
            fi
            if [ "$INPUT_PRERELEASE" = "true" ]; then
              prerelease="true"
            fi
          else
            if printf '%s' "$TAG" | grep -Eq -- '-(beta|rc)'; then
              prerelease="true"
            fi
          fi

          make_latest="true"
          if [ "$prerelease" = "true" ]; then
            make_latest="false"
          fi

          echo "draft=$draft" >> "$GITHUB_OUTPUT"
          echo "prerelease=$prerelease" >> "$GITHUB_OUTPUT"
          echo "make_latest=$make_latest" >> "$GITHUB_OUTPUT"

      - name: Create or update GitHub release
        uses: ncipollo/release-action@v1
        with:
          tag: ${{ steps.release_meta.outputs.tag }}
          name: ClawMaster ${{ steps.release_meta.outputs.tag }}
          bodyFile: RELEASE_BODY.md
          artifacts: release-assets/*
          artifactErrorsFailBuild: true
          allowUpdates: true
          replacesArtifacts: true
          draft: ${{ steps.release_options.outputs.draft }}
          prerelease: ${{ steps.release_options.outputs.prerelease }}
          makeLatest: ${{ steps.release_options.outputs.make_latest }}

      - name: Add workflow summary
        env:
          REPOSITORY: ${{ github.repository }}
          TAG: ${{ steps.release_meta.outputs.tag }}
        run: |
          {
            echo "## Desktop Downloads"
            echo
            echo "GitHub Release: https://github.com/$REPOSITORY/releases/tag/$TAG"
            echo
            echo "Artifacts in this release:"
            while IFS= read -r file; do
              echo "- $(basename "$file")"
            done < <(find release-assets -maxdepth 1 -type f | sort)
          } >> "$GITHUB_STEP_SUMMARY"