publish-desktop.yml

name: Publish Desktop App
run-name: "${{ format('publish desktop {0}', github.event_name == 'workflow_dispatch' && inputs.tag || github.ref_name) }}"

on:
  workflow_dispatch:
    inputs:
      tag:
        description: Git tag to publish (e.g. v1.4.1)
        required: true
        type: string

permissions:
  contents: read

concurrency:
  group: publish-desktop-${{ github.ref }}
  cancel-in-progress: false

jobs:
  build:
    permissions:
      contents: read
    strategy:
      fail-fast: false
      matrix:
        include:
          - os: macos-latest
            arch: arm64
            platform: mac
            cli-asset: executor-darwin-arm64.zip
          - os: macos-latest
            arch: x64
            platform: mac
            cli-asset: executor-darwin-x64.zip
          - os: ubuntu-latest
            arch: x64
            platform: linux
            cli-asset: executor-linux-x64.tar.gz
          - os: windows-latest
            arch: x64
            platform: win
            cli-asset: executor-windows-x64.zip

    runs-on: ${{ matrix.os }}

    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          persist-credentials: false

      - name: Setup Bun
        uses: oven-sh/setup-bun@v2
        with:
          bun-version: 1.3.11

      - name: Validate release tag
        env:
          RAW_RELEASE_TAG: ${{ inputs.tag }}
        run: bun run scripts/validate-release-ref.ts --tag-env RAW_RELEASE_TAG --write-env RELEASE_TAG

      - name: Checkout release tag
        env:
          GH_TOKEN: ${{ secrets.RELEASE_PAT || github.token }}
        shell: bash
        run: |
          auth_remote="https://x-access-token:${GH_TOKEN}@github.com/${GITHUB_REPOSITORY}.git"
          git fetch --force --tags "$auth_remote" "refs/tags/$RELEASE_TAG:refs/tags/$RELEASE_TAG"
          git checkout --detach "$RELEASE_TAG"

      - name: Setup Node
        uses: actions/setup-node@v4
        with:
          node-version: 24

      - name: Install dependencies
        run: bun install --frozen-lockfile

      - name: Build web app
        run: bun run build
        working-directory: apps/local

      - name: Download and extract CLI sidecar (unix)
        if: matrix.platform != 'win'
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          mkdir -p apps/desktop/resources
          gh release download "$RELEASE_TAG" --repo "$GITHUB_REPOSITORY" --pattern "${{ matrix.cli-asset }}" --dir /tmp/cli-download
          cd /tmp/cli-download
          if [[ "${{ matrix.cli-asset }}" == *.tar.gz ]]; then
            tar -xzf "${{ matrix.cli-asset }}"
          else
            unzip -o "${{ matrix.cli-asset }}"
          fi
          cp executor "${{ github.workspace }}/apps/desktop/resources/executor"
          chmod +x "${{ github.workspace }}/apps/desktop/resources/executor"
          if [ -f emscripten-module.wasm ]; then
            cp emscripten-module.wasm "${{ github.workspace }}/apps/desktop/resources/"
          fi

      - name: Download and extract CLI sidecar (windows)
        if: matrix.platform == 'win'
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        shell: pwsh
        run: |
          New-Item -ItemType Directory -Force -Path "apps/desktop/resources"
          gh release download "$env:RELEASE_TAG" --repo "$env:GITHUB_REPOSITORY" --pattern "${{ matrix.cli-asset }}" --dir "$env:TEMP/cli-download"
          Expand-Archive -Path "$env:TEMP/cli-download/${{ matrix.cli-asset }}" -DestinationPath "$env:TEMP/cli-extract" -Force
          Copy-Item "$env:TEMP/cli-extract/executor.exe" "apps/desktop/resources/executor.exe"
          if (Test-Path "$env:TEMP/cli-extract/emscripten-module.wasm") {
            Copy-Item "$env:TEMP/cli-extract/emscripten-module.wasm" "apps/desktop/resources/"
          }

      - name: Build desktop app (TypeScript)
        run: bunx tsc -p tsconfig.json
        working-directory: apps/desktop

      - name: Prepare Linux package output directory
        if: matrix.platform == 'linux'
        run: mkdir -p apps/desktop/dist/@executor-js

      - name: Build desktop distributables
        run: npx electron-builder --${{ matrix.platform }} --${{ matrix.arch }}
        working-directory: apps/desktop

      - name: Upload artifacts
        uses: actions/upload-artifact@v4
        with:
          name: desktop-${{ matrix.platform }}-${{ matrix.arch }}
          path: |
            apps/desktop/dist/*.dmg
            apps/desktop/dist/*.exe
            apps/desktop/dist/*.AppImage
            apps/desktop/dist/*.deb
          if-no-files-found: warn

  release:
    needs: build
    runs-on: ubuntu-latest
    permissions:
      contents: write

    steps:
      - name: Checkout validation script
        uses: actions/checkout@v4
        with:
          persist-credentials: false

      - name: Setup Bun
        uses: oven-sh/setup-bun@v2
        with:
          bun-version: 1.3.11

      - name: Validate release tag
        env:
          RAW_RELEASE_TAG: ${{ inputs.tag }}
        run: bun run scripts/validate-release-ref.ts --tag-env RAW_RELEASE_TAG --write-env RELEASE_TAG

      - name: Download all artifacts
        uses: actions/download-artifact@v4
        with:
          path: artifacts
          merge-multiple: true

      - name: Upload to GitHub Release
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          find artifacts -type f \( -name "*.dmg" -o -name "*.exe" -o -name "*.AppImage" -o -name "*.deb" \) | while read file; do
            echo "Uploading: $file"
            gh release upload "$RELEASE_TAG" "$file" --repo "$GITHUB_REPOSITORY" --clobber || true
          done