release.yml

name: Release

on:
  push:
    tags:
      - 'v[0-9]+.[0-9]+.[0-9]+'

permissions:
  contents: write

jobs:
  # ── Extract release notes from CHANGELOG ───────────────────────────────────
  changelog:
    name: Extract release notes
    runs-on: ubuntu-latest
    outputs:
      notes: ${{ steps.extract.outputs.notes }}
      version: ${{ steps.version.outputs.version }}

    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Get version from tag
        id: version
        run: echo "version=${GITHUB_REF_NAME#v}" >> "$GITHUB_OUTPUT"

      - name: Extract CHANGELOG section
        id: extract
        run: |
          VERSION="${GITHUB_REF_NAME#v}"
          # Extract lines between the versioned header and the next header (or EOF)
          NOTES=$(awk "/^\[v${VERSION}\]/,/^\[v[0-9]/" CHANGELOG.md \
            | head -n -1 \
            | tail -n +2 \
            | sed '/^[[:space:]]*$/{ N; /^\n[[:space:]]*$/d }')
          if [[ -z "$NOTES" ]]; then
            NOTES="See [CHANGELOG.md](CHANGELOG.md) for details."
          fi
          # Write multi-line output safely
          {
            echo "notes<<EOF_NOTES"
            echo "$NOTES"
            echo "EOF_NOTES"
          } >> "$GITHUB_OUTPUT"

  # ── Linux build ────────────────────────────────────────────────────────────
  build-linux:
    name: Linux x64
    runs-on: ubuntu-latest
    needs: changelog
    env:
      TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
      TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}

    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Install Node.js
        uses: actions/setup-node@v4
        with:
          node-version: 22
          cache: npm

      - name: Install Rust stable
        uses: dtolnay/rust-toolchain@stable

      - name: Cache Rust build artifacts
        uses: Swatinem/rust-cache@v2
        with:
          workspaces: src-tauri

      - name: Install Linux system dependencies
        run: |
          sudo apt-get update
          sudo apt-get install -y \
            libwebkit2gtk-4.1-dev \
            libssl-dev \
            libayatana-appindicator3-dev \
            librsvg2-dev \
            patchelf \
            libasound2-dev \
            rpm

      - name: Install npm dependencies
        run: npm ci

      - name: Sync SvelteKit types
        run: npx svelte-kit sync

      - name: Import GPG signing key
        env:
          GPG_PRIVATE_KEY: ${{ secrets.GPG_PRIVATE_KEY }}
        run: echo "$GPG_PRIVATE_KEY" | gpg --batch --import

      - name: Build (release)
        run: npm run tauri build -- --config '{"bundle":{"createUpdaterArtifacts":true}}' --bundles deb,appimage,rpm
        env:
          CI: true

      - name: Sign Linux artifacts
        env:
          GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }}
        run: |
          for f in \
            src-tauri/target/release/bundle/deb/*.deb \
            src-tauri/target/release/bundle/rpm/*.rpm \
            src-tauri/target/release/bundle/appimage/*.AppImage; do
            echo "$GPG_PASSPHRASE" | gpg --batch --yes --passphrase-fd 0 \
              --pinentry-mode loopback --detach-sign --armor "$f"
          done

      - name: Upload Linux artifacts
        uses: actions/upload-artifact@v4
        with:
          name: pomotroid-linux-x64
          path: |
            src-tauri/target/release/bundle/deb/*.deb
            src-tauri/target/release/bundle/deb/*.deb.asc
            src-tauri/target/release/bundle/appimage/*.AppImage
            src-tauri/target/release/bundle/appimage/*.AppImage.asc
            src-tauri/target/release/bundle/appimage/*.AppImage.sig
            src-tauri/target/release/bundle/rpm/*.rpm
            src-tauri/target/release/bundle/rpm/*.rpm.asc
          if-no-files-found: error

  # ── macOS build ────────────────────────────────────────────────────────────
  build-macos:
    name: macOS (universal)
    runs-on: macos-latest
    needs: changelog
    env:
      TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
      TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}

    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Install Node.js
        uses: actions/setup-node@v4
        with:
          node-version: 22
          cache: npm

      - name: Install Rust stable (with universal targets)
        uses: dtolnay/rust-toolchain@stable
        with:
          targets: aarch64-apple-darwin,x86_64-apple-darwin

      - name: Cache Rust build artifacts
        uses: Swatinem/rust-cache@v2
        with:
          workspaces: src-tauri

      - name: Install npm dependencies
        run: npm ci

      - name: Sync SvelteKit types
        run: npx svelte-kit sync

      - name: Build (release, universal binary)
        run: npm run tauri build -- --config '{"bundle":{"createUpdaterArtifacts":true}}' --bundles app,dmg --target universal-apple-darwin
        env:
          CI: true

      - name: Upload macOS artifacts
        uses: actions/upload-artifact@v4
        with:
          name: pomotroid-macos-universal
          path: |
            src-tauri/target/universal-apple-darwin/release/bundle/dmg/*.dmg
            src-tauri/target/universal-apple-darwin/release/bundle/macos/*.app.tar.gz
            src-tauri/target/universal-apple-darwin/release/bundle/macos/*.app.tar.gz.sig
          if-no-files-found: error

  # ── Windows build ──────────────────────────────────────────────────────────
  build-windows:
    name: Windows x64
    runs-on: windows-latest
    needs: changelog
    env:
      TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
      TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
    outputs:
      installer_hash: ${{ steps.hash.outputs.sha256 }}

    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Install Node.js
        uses: actions/setup-node@v4
        with:
          node-version: 22
          cache: npm

      - name: Install Rust stable
        uses: dtolnay/rust-toolchain@stable

      - name: Cache Rust build artifacts
        uses: Swatinem/rust-cache@v2
        with:
          workspaces: src-tauri

      - name: Install npm dependencies
        run: npm ci

      - name: Sync SvelteKit types
        run: npx svelte-kit sync

      - name: Build (release)
        run: npm run tauri build -- --config '{"bundle":{"createUpdaterArtifacts":true}}' --bundles nsis
        env:
          CI: true

      - name: Compute installer hash
        id: hash
        shell: bash
        run: |
          hash=$(sha256sum src-tauri/target/release/bundle/nsis/*-setup.exe | cut -d' ' -f1)
          echo "sha256=$hash" >> "$GITHUB_OUTPUT"

      - name: Upload Windows artifacts
        uses: actions/upload-artifact@v4
        with:
          name: pomotroid-windows-x64
          path: |
            src-tauri/target/release/bundle/nsis/*-setup.exe
            src-tauri/target/release/bundle/nsis/*-setup.exe.sig
            src-tauri/target/release/pomotroid.exe
          if-no-files-found: error

  # ── Create draft GitHub Release ────────────────────────────────────────────
  release:
    name: Create draft release
    runs-on: ubuntu-latest
    needs: [changelog, build-linux, build-macos, build-windows]

    steps:
      - name: Checkout repository
        uses: actions/checkout@v4
        with:
          ref: main
          token: ${{ secrets.GITHUB_TOKEN }}

      - name: Download Linux artifacts
        uses: actions/download-artifact@v4
        with:
          name: pomotroid-linux-x64
          path: dist/linux

      - name: Download macOS artifacts
        uses: actions/download-artifact@v4
        with:
          name: pomotroid-macos-universal
          path: dist/macos

      - name: Download Windows artifacts
        uses: actions/download-artifact@v4
        with:
          name: pomotroid-windows-x64
          path: dist/windows

      - name: Generate latest.json updater manifest
        run: |
          VERSION="${{ needs.changelog.outputs.version }}"
          REPO="https://github.com/Splode/pomotroid"
          PUB_DATE=$(date -u +"%Y-%m-%dT%H:%M:%SZ")

          # Derive actual filenames from the downloaded artifacts rather than
          # constructing them from the tag version — the tag version may differ
          # from the binary version in tauri.conf.json.
          APPIMAGE_FILE=$(find dist/linux -name "*.AppImage" ! -name "*.sig" | head -1)
          APPIMAGE_SIG=$(cat "${APPIMAGE_FILE}.sig" 2>/dev/null || echo "")
          APP_TAR_FILE=$(find dist/macos -name "*.app.tar.gz" ! -name "*.sig" | head -1)
          APP_TAR_SIG=$(cat "${APP_TAR_FILE}.sig" 2>/dev/null || echo "")
          NSIS_FILE=$(find dist/windows -name "*-setup.exe" ! -name "*.sig" | head -1)
          NSIS_SIG=$(cat "${NSIS_FILE}.sig" 2>/dev/null || echo "")

          jq -n \
            --arg version "$VERSION" \
            --arg pub_date "$PUB_DATE" \
            --arg notes "See $REPO/releases/tag/v$VERSION for release notes." \
            --arg linux_url "$REPO/releases/download/v$VERSION/$(basename "$APPIMAGE_FILE")" \
            --arg linux_sig "$APPIMAGE_SIG" \
            --arg darwin_url "$REPO/releases/download/v$VERSION/$(basename "$APP_TAR_FILE")" \
            --arg darwin_sig "$APP_TAR_SIG" \
            --arg windows_url "$REPO/releases/download/v$VERSION/$(basename "$NSIS_FILE")" \
            --arg windows_sig "$NSIS_SIG" \
            '{
              version: $version,
              notes: $notes,
              pub_date: $pub_date,
              platforms: {
                "linux-x86_64": { signature: $linux_sig, url: $linux_url },
                "darwin-aarch64": { signature: $darwin_sig, url: $darwin_url },
                "darwin-x86_64": { signature: $darwin_sig, url: $darwin_url },
                "windows-x86_64": { signature: $windows_sig, url: $windows_url }
              }
            }' > latest.json

      - name: Update Scoop manifest and commit latest.json
        run: |
          VERSION="${{ needs.changelog.outputs.version }}"
          HASH="${{ needs.build-windows.outputs.installer_hash }}"
          jq --arg v "$VERSION" --arg h "$HASH" \
            '.version = $v | .hash = $h | .url = "https://github.com/Splode/pomotroid/releases/download/v\($v)/Pomotroid_\($v)_x64-setup.exe#/dl.exe"' \
            pomotroid.json > pomotroid.json.tmp && mv pomotroid.json.tmp pomotroid.json
          git config user.name "github-actions[bot]"
          git config user.email "github-actions[bot]@users.noreply.github.com"
          git add pomotroid.json latest.json
          git commit -m "chore: update Scoop manifest and latest.json to v${VERSION} [skip ci]"
          git push origin HEAD:main

      - name: Create draft release
        uses: softprops/action-gh-release@v2
        with:
          draft: true
          name: ${{ github.ref_name }}
          body: ${{ needs.changelog.outputs.notes }}
          files: |
            dist/linux/**/*.deb
            dist/linux/**/*.deb.asc
            dist/linux/**/*.AppImage
            dist/linux/**/*.AppImage.asc
            dist/linux/**/*.rpm
            dist/linux/**/*.rpm.asc
            dist/macos/**/*.dmg
            dist/macos/**/*.app.tar.gz
            dist/windows/**/*-setup.exe
            dist/windows/**/pomotroid.exe