release.yml

name: Release Builds

on:
  workflow_dispatch:
  push:
    tags:
      - "v*"

permissions:
  contents: write

jobs:
  build:
    name: Build ${{ matrix.name }}
    runs-on: ${{ matrix.os }}
    strategy:
      fail-fast: false
      matrix:
        include:
          - name: Windows x64
            os: windows-latest
            artifact: windows-x64
            script: npm run dist:win:x64
          - name: Windows x86
            os: windows-latest
            artifact: windows-ia32
            script: npm run dist:win:ia32
          - name: Windows ARM64
            os: windows-latest
            artifact: windows-arm64
            script: npm run dist:win:arm64
          - name: Linux x64
            os: ubuntu-latest
            artifact: linux-x64
            script: npm run dist:linux:x64
          - name: Linux ARM64
            os: ubuntu-latest
            artifact: linux-arm64
            script: npm run dist:linux:arm64
          - name: macOS Universal
            os: macos-latest
            artifact: macos-universal
            script: npm run dist:mac:universal

    env:
      WIN_CSC_LINK: ${{ secrets.WIN_CSC_LINK }}
      WIN_CSC_KEY_PASSWORD: ${{ secrets.WIN_CSC_KEY_PASSWORD }}
      GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
      WINDOWS_CERTIFICATE_BASE64: ${{ secrets.WINDOWS_CERTIFICATE_BASE64 }}
      WINDOWS_CERTIFICATE_PASSWORD: ${{ secrets.WINDOWS_CERTIFICATE_PASSWORD }}
      MACOS_CERTIFICATE_BASE64: ${{ secrets.MACOS_CERTIFICATE_BASE64 }}
      MACOS_CERTIFICATE_PASSWORD: ${{ secrets.MACOS_CERTIFICATE_PASSWORD }}
      APPLE_ID: ${{ secrets.APPLE_ID }}
      APPLE_APP_SPECIFIC_PASSWORD: ${{ secrets.APPLE_APP_SPECIFIC_PASSWORD }}
      APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}

    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: 24
          cache: npm

      - name: Install dependencies
        shell: pwsh
        run: |
          $exitCode = 1
          for ($attempt = 1; $attempt -le 3; $attempt++) {
            Write-Host "npm ci attempt $attempt/3"
            npm ci
            $exitCode = $LASTEXITCODE
            if ($exitCode -eq 0) {
              exit 0
            }
            Start-Sleep -Seconds (15 * $attempt)
          }
          exit $exitCode

      - name: Install Linux packaging dependencies
        if: runner.os == 'Linux'
        run: |
          sudo apt-get update
          sudo apt-get install -y libarchive-tools rpm

      - name: Run tests
        shell: pwsh
        run: npm test

      - name: Run preflight
        shell: pwsh
        run: npm run verify

      - name: Decode Windows signing certificate
        if: runner.os == 'Windows' && env.WINDOWS_CERTIFICATE_BASE64 != ''
        shell: pwsh
        run: |
          $certPath = Join-Path $env:RUNNER_TEMP "windows-signing-cert.pfx"
          [IO.File]::WriteAllBytes($certPath, [Convert]::FromBase64String($env:WINDOWS_CERTIFICATE_BASE64))
          "WIN_CSC_LINK=$certPath" >> $env:GITHUB_ENV
          "WIN_CSC_KEY_PASSWORD=$env:WINDOWS_CERTIFICATE_PASSWORD" >> $env:GITHUB_ENV
          "CSC_LINK=$certPath" >> $env:GITHUB_ENV
          "CSC_KEY_PASSWORD=$env:WINDOWS_CERTIFICATE_PASSWORD" >> $env:GITHUB_ENV

      - name: Configure Windows signing certificate link
        if: runner.os == 'Windows' && env.WINDOWS_CERTIFICATE_BASE64 == '' && env.WIN_CSC_LINK != ''
        shell: pwsh
        run: |
          "CSC_LINK=$env:WIN_CSC_LINK" >> $env:GITHUB_ENV
          "CSC_KEY_PASSWORD=$env:WIN_CSC_KEY_PASSWORD" >> $env:GITHUB_ENV

      - name: Decode macOS signing certificate
        if: runner.os == 'macOS' && env.MACOS_CERTIFICATE_BASE64 != ''
        shell: bash
        run: |
          CERT_PATH="$RUNNER_TEMP/macos-signing-cert.p12"
          echo "$MACOS_CERTIFICATE_BASE64" | base64 --decode > "$CERT_PATH"
          echo "CSC_LINK=$CERT_PATH" >> "$GITHUB_ENV"
          echo "CSC_KEY_PASSWORD=$MACOS_CERTIFICATE_PASSWORD" >> "$GITHUB_ENV"
          echo "CSC_IDENTITY_AUTO_DISCOVERY=true" >> "$GITHUB_ENV"

      - name: Disable signing when no certificate is configured
        shell: pwsh
        run: |
          if ($env:CSC_LINK) {
            "CSC_IDENTITY_AUTO_DISCOVERY=true" >> $env:GITHUB_ENV
          } else {
            "CSC_IDENTITY_AUTO_DISCOVERY=false" >> $env:GITHUB_ENV
          }

      - name: Build packages
        shell: pwsh
        run: |
          $exitCode = 1
          for ($attempt = 1; $attempt -le 3; $attempt++) {
            Write-Host "Build attempt $attempt/3: $env:BUILD_SCRIPT"
            Invoke-Expression $env:BUILD_SCRIPT
            $exitCode = $LASTEXITCODE
            if ($exitCode -eq 0) {
              exit 0
            }
            Start-Sleep -Seconds (20 * $attempt)
          }
          exit $exitCode
        env:
          BUILD_SCRIPT: ${{ matrix.script }}
          ELECTRON_BUILDER_ALLOW_UNRESOLVED_DEPENDENCIES: true

      - name: Generate release notes
        if: startsWith(github.ref, 'refs/tags/v')
        shell: pwsh
        run: npm run release:notes -- release-notes.md

      - name: Normalize Windows update metadata
        if: runner.os == 'Windows' && matrix.artifact != 'windows-x64'
        shell: pwsh
        run: |
          $latest = Join-Path $PWD "release/latest.yml"
          if (Test-Path $latest) {
            Move-Item -LiteralPath $latest -Destination (Join-Path $PWD "release/latest-${{ matrix.artifact }}.yml") -Force
          }

      - name: Upload build artifacts
        uses: actions/upload-artifact@v4
        with:
          name: rigscope-${{ matrix.artifact }}-${{ github.run_number }}
          path: |
            release/**
            !release/**/builder-debug.yml
            !release/**/builder-effective-config.yaml
          if-no-files-found: error
          retention-days: 30

      - name: Publish GitHub Release assets
        if: startsWith(github.ref, 'refs/tags/v')
        uses: softprops/action-gh-release@v2
        with:
          body_path: release-notes.md
          files: |
            release/*.exe
            release/*.msi
            release/*.blockmap
            release/*.AppImage
            release/*.deb
            release/*.tar.gz
            release/*.dmg
            release/*.zip
            release/latest*.yml
            release/latest*.yaml