release.yml

name: Release

# Build and publish a GitHub Release with installers for macOS, Linux and
# Windows whenever a version tag (e.g. v0.1.0a) is pushed. Run by hand, it
# only builds the macOS app (no release) to check the pipeline and signing.
on:
  push:
    tags:
      - 'v*'
      - '[0-9]*'
  workflow_dispatch:
    inputs:
      cli_version:
        description: jucode CLI release to bundle (default src-tauri/jucode-cli.version)
        required: false
        type: string

permissions:
  contents: write

jobs:
  release:
    strategy:
      fail-fast: false
      matrix:
        # macOS Apple Silicon, Linux x86_64, Windows x86_64; a manual run
        # builds macOS only.
        include: ${{ fromJSON(github.event_name == 'workflow_dispatch'
          && '[{"os":"macos-latest","target":"aarch64-apple-darwin"}]'
          || '[{"os":"macos-latest","target":"aarch64-apple-darwin"},{"os":"ubuntu-22.04","target":"x86_64-unknown-linux-gnu"},{"os":"windows-latest","target":"x86_64-pc-windows-msvc"}]') }}
    runs-on: ${{ matrix.os }}
    steps:
      - uses: actions/checkout@v4
        with:
          # The release notes list the commits since the previous tag.
          fetch-depth: 0

      - name: Install Linux dependencies
        if: matrix.os == 'ubuntu-22.04'
        run: |
          sudo apt-get update
          sudo apt-get install -y libwebkit2gtk-4.1-dev libgtk-3-dev \
            libayatana-appindicator3-dev librsvg2-dev libxdo-dev \
            build-essential file libssl-dev

      - uses: pnpm/action-setup@v4
      - uses: actions/setup-node@v4
        with:
          node-version: 22
          cache: pnpm
      - uses: dtolnay/rust-toolchain@stable
      - uses: Swatinem/rust-cache@v2
        with:
          workspaces: src-tauri

      - run: pnpm install --frozen-lockfile

      # The app ships the jucode CLI release named in src-tauri/jucode-cli.version
      # (a sidecar, see src-tauri/src/app_cli.rs and tauri.bundle.conf.json).
      - name: Bundle the jucode CLI
        shell: bash
        run: |
          version="${{ inputs.cli_version }}"
          [ -n "$version" ] || version="$(tr -d '[:space:]' < src-tauri/jucode-cli.version)"
          ext=""; [ "${{ matrix.target }}" = "x86_64-pc-windows-msvc" ] && ext=".exe"
          name="jucode-${{ matrix.target }}${ext}"
          # Bundled as jucode-cli: on macOS and Windows a jucode would collide
          # with the app's own JuCode executable.
          bin="src-tauri/binaries/jucode-cli-${{ matrix.target }}${ext}"
          mkdir -p src-tauri/binaries
          curl -fsSL --retry 3 -o "$bin" \
            "https://github.com/JuCode-Team/JuCode-CLI/releases/download/v${version}/${name}"
          chmod +x "$bin"
          reported="$("$bin" --version | awk '{print $NF}' | tr -d '\r')"
          [ "$reported" = "$version" ] || { echo "::error::bundled jucode reports $reported, expected $version"; exit 1; }
          curl -fsSL --retry 3 -o static/jucode-cli-third-party-notices.txt \
            "https://github.com/JuCode-Team/JuCode-CLI/releases/download/v${version}/jucode-third-party-notices.txt" \
            || [ "${{ github.event_name }}" = "workflow_dispatch" ]

      # macOS builds are signed with a fixed self-signed certificate (not
      # notarized): macOS keeps granted permissions (microphone, screen
      # recording) across updates only while the signing identity stays the
      # same. The public certificate is src-tauri/macos-signing-cert.pem;
      # see docs/updater.md for the key.
      - name: Import the macOS signing certificate
        if: runner.os == 'macOS'
        env:
          APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }}
          APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
        run: |
          keychain="$RUNNER_TEMP/signing.keychain-db"
          password="$(openssl rand -hex 16)"
          echo "$APPLE_CERTIFICATE" | base64 --decode > "$RUNNER_TEMP/signing.p12"
          security create-keychain -p "$password" "$keychain"
          security set-keychain-settings -lut 21600 "$keychain"
          security unlock-keychain -p "$password" "$keychain"
          security import "$RUNNER_TEMP/signing.p12" -k "$keychain" -P "$APPLE_CERTIFICATE_PASSWORD" -T /usr/bin/codesign
          security set-key-partition-list -S apple-tool:,apple: -s -k "$password" "$keychain" > /dev/null
          security list-keychains -d user -s "$keychain" $(security list-keychains -d user | tr -d '"')
          # codesign only uses an identity the system trusts for code signing.
          sudo security add-trusted-cert -d -r trustRoot -p codeSign -k /Library/Keychains/System.keychain src-tauri/macos-signing-cert.pem
          security find-identity -v -p codesigning "$keychain"
          rm "$RUNNER_TEMP/signing.p12"

      # tauri-action runs beforeBuildCommand (pnpm build), bundles the app with
      # the jucode sidecar and uploads the installers to a release named after
      # the tag.
      #
      # Auto-update: with TAURI_SIGNING_PRIVATE_KEY set (repo secret) and
      # bundle.createUpdaterArtifacts enabled in tauri.conf.json, tauri-action
      # additionally signs the updater bundles (.sig files) and generates +
      # uploads latest.json, which installed clients poll via the endpoint in
      # plugins.updater. Key generation & setup: see docs/updater.md.
      # What the update prompt shows (latest.json `notes`) and the release
      # page leads with: release-notes/<tag>.md when there is one, else the
      # commit subjects since the previous tag. The install note follows a
      # `---` rule; the app shows only what comes before it.
      - name: Release notes
        id: notes
        shell: bash
        run: |
          tag="${GITHUB_REF_NAME}"
          if [ -f "release-notes/${tag}.md" ]; then
            notes="$(cat "release-notes/${tag}.md")"
          else
            prev="$(git describe --tags --abbrev=0 "${tag}^" 2>/dev/null || true)"
            notes="$(git log --no-merges --pretty='- %s' ${prev:+"$prev.."}"$tag" | grep -v '^- Version ' || true)"
          fi
          {
            echo 'body<<NOTES_EOF'
            echo "$notes"
            echo
            echo '---'
            echo
            echo 'The beta builds are not code-signed yet. To open them the first time and grant their permissions, see the [install guide](https://github.com/JuCode-Team/JuCode-Desktop/blob/main/docs/install.md).'
            echo 'NOTES_EOF'
          } >> "$GITHUB_OUTPUT"

      - uses: tauri-apps/tauri-action@v0
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
          TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
          APPLE_SIGNING_IDENTITY: ${{ runner.os == 'macOS' && 'JuCode Self-Signed' || '' }}
        with:
          # A manual run builds without publishing.
          tagName: ${{ github.event_name == 'push' && github.ref_name || '' }}
          releaseName: ${{ github.event_name == 'push' && github.ref_name || '' }}
          releaseDraft: false
          prerelease: false
          args: --config src-tauri/tauri.bundle.conf.json
          releaseBody: ${{ steps.notes.outputs.body }}

      - name: Keep the manual build
        if: github.event_name == 'workflow_dispatch'
        uses: actions/upload-artifact@v4
        with:
          name: macos-app
          path: src-tauri/target/release/bundle/macos/*.app.tar.gz