release.yml

name: Release

on:
  push:
    tags:
      - "v*"

env:
  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true

permissions:
  contents: write

concurrency:
  group: release-${{ github.ref }}
  cancel-in-progress: false

jobs:
  validate-tag:
    name: Validate release tag
    runs-on: ubuntu-latest
    outputs:
      version: ${{ steps.parse.outputs.version }}
      prerelease: ${{ steps.parse.outputs.prerelease }}
      tag: ${{ steps.parse.outputs.tag }}
    steps:
      - name: Parse SemVer tag
        id: parse
        shell: bash
        run: |
          set -euo pipefail
          TAG="${GITHUB_REF_NAME}"
          REGEX='^v([0-9]+)\.([0-9]+)\.([0-9]+)(-([0-9A-Za-z-]+(\.[0-9A-Za-z-]+)*))?$'

          if [[ ! "$TAG" =~ $REGEX ]]; then
            echo "Invalid tag format: $TAG" >&2
            echo "Expected: vMAJOR.MINOR.PATCH or vMAJOR.MINOR.PATCH-prerelease" >&2
            exit 1
          fi

          VERSION="${BASH_REMATCH[1]}.${BASH_REMATCH[2]}.${BASH_REMATCH[3]}"
          PRERELEASE="false"
          if [[ -n "${BASH_REMATCH[4]}" ]]; then
            PRERELEASE="true"
          fi

          echo "tag=$TAG" >> "$GITHUB_OUTPUT"
          echo "version=$VERSION" >> "$GITHUB_OUTPUT"
          echo "prerelease=$PRERELEASE" >> "$GITHUB_OUTPUT"

  test:
    name: Test (Ubuntu)
    needs: validate-tag
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v6

      - name: Setup Node.js
        uses: actions/setup-node@v6
        with:
          node-version: 22
          cache: npm
          cache-dependency-path: apps/desktop/package-lock.json

      - name: Setup Rust toolchain
        uses: dtolnay/rust-toolchain@stable

      - name: Install Linux dependencies
        shell: bash
        run: |
          sudo apt-get update
          sudo apt-get install -y \
            libwebkit2gtk-4.1-dev \
            libgtk-3-dev \
            libayatana-appindicator3-dev \
            librsvg2-dev \
            patchelf

      - name: Install npm dependencies
        working-directory: apps/desktop
        run: npm ci

      - name: Run frontend unit tests
        working-directory: apps/desktop
        run: npm test

      - name: Run Rust tests
        working-directory: apps/desktop/src-tauri
        run: cargo test

  marketing-screenshots:
    name: Marketing screenshots (Playwright)
    needs:
      - validate-tag
      - test
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v6

      - name: Setup Node.js
        uses: actions/setup-node@v6
        with:
          node-version: 22
          cache: npm
          cache-dependency-path: apps/desktop/package-lock.json

      - name: Install ImageMagick and zip
        shell: bash
        run: |
          sudo apt-get update
          sudo apt-get install -y imagemagick zip

      - name: Install npm dependencies
        working-directory: apps/desktop
        run: npm ci

      - name: Install Playwright Chromium
        working-directory: apps/desktop
        run: npx playwright install chromium --with-deps

      - name: Generate store & Flathub PNGs
        working-directory: apps/desktop
        env:
          CI: true
        run: npm run screenshots

      - name: Pack marketing screenshots
        shell: bash
        run: |
          set -euo pipefail
          out="marketing-screenshots-bundle"
          rm -rf "$out" marketing-screenshots.zip
          mkdir -p "$out"
          cp -a docs/media/screenshots/flathub "$out/"
          cp -a docs/media/screenshots/store-ms-snap "$out/"
          (cd "$out" && zip -r -q ../marketing-screenshots.zip .)

      - name: Upload marketing screenshots
        uses: actions/upload-artifact@v7
        with:
          name: marketing-screenshots
          if-no-files-found: error
          path: marketing-screenshots.zip

  build:
    name: Build ${{ matrix.artifact_name }}
    needs:
      - validate-tag
      - test
    runs-on: ${{ matrix.os }}
    strategy:
      fail-fast: false
      matrix:
        include:
          - os: ubuntu-latest
            artifact_name: linux
          - os: macos-latest
            artifact_name: macos
          - os: windows-latest
            artifact_name: windows
    env:
      RELEASE_VERSION: ${{ needs.validate-tag.outputs.version }}
    steps:
      - name: Checkout
        uses: actions/checkout@v6

      - name: Setup Node.js
        uses: actions/setup-node@v6
        with:
          node-version: 22
          cache: npm
          cache-dependency-path: apps/desktop/package-lock.json

      - name: Setup Python
        uses: actions/setup-python@v6
        with:
          python-version: "3.12"

      - name: Setup Rust toolchain
        uses: dtolnay/rust-toolchain@stable

      - name: Install Linux dependencies
        if: runner.os == 'Linux'
        shell: bash
        run: |
          sudo apt-get update
          sudo apt-get install -y \
            libwebkit2gtk-4.1-dev \
            libgtk-3-dev \
            libayatana-appindicator3-dev \
            librsvg2-dev \
            patchelf

      - name: Install npm dependencies
        working-directory: apps/desktop
        run: npm ci

      - name: Sync app version from tag
        shell: bash
        run: |
          set -euo pipefail
          node <<'NODE'
          const fs = require("fs");
          const version = process.env.RELEASE_VERSION;
          if (!version) {
            throw new Error("RELEASE_VERSION is missing");
          }

          const packageJsonPath = "apps/desktop/package.json";
          const tauriConfigPath = "apps/desktop/src-tauri/tauri.conf.json";
          const cargoTomlPath = "apps/desktop/src-tauri/Cargo.toml";

          const packageJson = JSON.parse(fs.readFileSync(packageJsonPath, "utf8"));
          packageJson.version = version;
          fs.writeFileSync(packageJsonPath, `${JSON.stringify(packageJson, null, 2)}\n`);

          const tauriConfig = JSON.parse(fs.readFileSync(tauriConfigPath, "utf8"));
          tauriConfig.version = version;
          tauriConfig.bundle = tauriConfig.bundle || {};
          tauriConfig.bundle.icon = [
            "icons/32x32.png",
            "icons/128x128.png",
            "icons/128x128@2x.png",
            "icons/icon.icns",
            "icons/icon.ico"
          ];
          fs.writeFileSync(tauriConfigPath, `${JSON.stringify(tauriConfig, null, 2)}\n`);

          const cargoToml = fs.readFileSync(cargoTomlPath, "utf8");
          let hasPackageVersion = false;
          const updatedCargoToml = cargoToml.replace(
            /(\[package\][\s\S]*?^version\s*=\s*")[^"]+(")/m,
            (_match, prefix, suffix) => {
              hasPackageVersion = true;
              return `${prefix}${version}${suffix}`;
            }
          );
          if (!hasPackageVersion) {
            throw new Error("Could not update version in Cargo.toml");
          }
          fs.writeFileSync(cargoTomlPath, updatedCargoToml);
          NODE

      - name: Build square icon source
        shell: bash
        run: |
          set -euo pipefail
          python -m pip install --upgrade pip pillow
          python <<'PY'
          from PIL import Image

          source = Image.open("img/logo_terminal.png").convert("RGBA")
          side = max(source.width, source.height)
          canvas = Image.new("RGBA", (side, side), (0, 0, 0, 0))
          offset = ((side - source.width) // 2, (side - source.height) // 2)
          canvas.paste(source, offset, source)
          canvas.save("apps/desktop/src-tauri/icons/icon-source-square.png")
          PY

      - name: Generate platform icons
        working-directory: apps/desktop
        run: npx @tauri-apps/cli icon src-tauri/icons/icon-source-square.png --output src-tauri/icons

      # Import Apple Developer ID certificate into a temporary keychain (macOS only).
      # Requires repository secrets:
      #   - APPLE_CERTIFICATE          base64-encoded `.p12` of the Developer ID Application cert
      #   - APPLE_CERTIFICATE_PASSWORD password used when exporting the .p12
      #   - APPLE_SIGNING_IDENTITY     full identity string, e.g. "Developer ID Application: Name (TEAMID)"
      # Skipped (warns only) when secrets are missing so non-official forks can still build.
      - name: Import Apple signing certificate
        if: matrix.artifact_name == 'macos'
        env:
          APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }}
          APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
        shell: bash
        run: |
          set -euo pipefail
          if [[ -z "${APPLE_CERTIFICATE:-}" ]]; then
            echo "::warning::APPLE_CERTIFICATE secret is unset — skipping macOS code signing."
            exit 0
          fi
          KEYCHAIN_PATH="$RUNNER_TEMP/build.keychain-db"
          KEYCHAIN_PASSWORD="$(uuidgen)"
          security create-keychain -p "$KEYCHAIN_PASSWORD" "$KEYCHAIN_PATH"
          security set-keychain-settings -lut 21600 "$KEYCHAIN_PATH"
          security unlock-keychain -p "$KEYCHAIN_PASSWORD" "$KEYCHAIN_PATH"
          echo "$APPLE_CERTIFICATE" | base64 --decode > "$RUNNER_TEMP/cert.p12"
          security import "$RUNNER_TEMP/cert.p12" \
            -k "$KEYCHAIN_PATH" \
            -P "$APPLE_CERTIFICATE_PASSWORD" \
            -T /usr/bin/codesign
          security set-key-partition-list -S apple-tool:,apple:,codesign: -s -k "$KEYCHAIN_PASSWORD" "$KEYCHAIN_PATH" >/dev/null
          security list-keychain -d user -s "$KEYCHAIN_PATH" $(security list-keychains -d user | tr -d '"')

      # Code signing / notarization env vars that Tauri reads automatically when present:
      #   macOS    APPLE_SIGNING_IDENTITY              Developer ID Application identity string
      #   macOS    APPLE_ID + APPLE_PASSWORD           App-Store-Connect account + app-specific password
      #   macOS    APPLE_TEAM_ID                       Apple Developer team ID (e.g. ABCDE12345)
      #   macOS    APPLE_API_KEY/...PATH/...ISSUER     Alternative to APPLE_ID for App-Store-Connect API
      #   Windows  TAURI_WINDOWS_SIGN_COMMAND          Full sign command (e.g. AzureSignTool / signtool)
      #
      # Tauri's bundler treats an *empty* APPLE_SIGNING_IDENTITY as "sign with the empty identity"
      # rather than "skip signing", so we must not export those variables at all when the secret is
      # unset. This step writes them to $GITHUB_ENV only when their secrets are non-empty so the
      # bundler skips signing cleanly on forks / releases without certificates configured.
      - name: Configure code-signing env (only when secrets are present)
        shell: bash
        env:
          APPLE_SIGNING_IDENTITY_SECRET: ${{ secrets.APPLE_SIGNING_IDENTITY }}
          APPLE_ID_SECRET: ${{ secrets.APPLE_ID }}
          APPLE_PASSWORD_SECRET: ${{ secrets.APPLE_PASSWORD }}
          APPLE_TEAM_ID_SECRET: ${{ secrets.APPLE_TEAM_ID }}
          APPLE_API_KEY_SECRET: ${{ secrets.APPLE_API_KEY }}
          APPLE_API_KEY_PATH_SECRET: ${{ secrets.APPLE_API_KEY_PATH }}
          APPLE_API_ISSUER_SECRET: ${{ secrets.APPLE_API_ISSUER }}
          TAURI_WINDOWS_SIGN_COMMAND_SECRET: ${{ secrets.TAURI_WINDOWS_SIGN_COMMAND }}
          ARTIFACT_NAME: ${{ matrix.artifact_name }}
        run: |
          set -euo pipefail
          propagate() {
            local name="$1" value="${2:-}"
            if [[ -n "$value" ]]; then
              echo "$name=$value" >> "$GITHUB_ENV"
            fi
          }
          if [[ "$ARTIFACT_NAME" == "macos" ]]; then
            propagate APPLE_SIGNING_IDENTITY "${APPLE_SIGNING_IDENTITY_SECRET:-}"
            propagate APPLE_ID                "${APPLE_ID_SECRET:-}"
            propagate APPLE_PASSWORD          "${APPLE_PASSWORD_SECRET:-}"
            propagate APPLE_TEAM_ID           "${APPLE_TEAM_ID_SECRET:-}"
            propagate APPLE_API_KEY           "${APPLE_API_KEY_SECRET:-}"
            propagate APPLE_API_KEY_PATH      "${APPLE_API_KEY_PATH_SECRET:-}"
            propagate APPLE_API_ISSUER        "${APPLE_API_ISSUER_SECRET:-}"
          fi
          if [[ "$ARTIFACT_NAME" == "windows" ]]; then
            propagate TAURI_WINDOWS_SIGN_COMMAND "${TAURI_WINDOWS_SIGN_COMMAND_SECRET:-}"
          fi

      # Embeds production Ed25519 verify key at compile time (see license.rs `option_env!`).
      # Repository secret: 64 hex chars (32-byte public key), same as desktop `NOSUCKSHELL_LICENSE_PUBKEY_HEX`.
      # If unset, binaries fall back to the public dev key (fine for forks; official releases should set the secret).
      - name: Build Tauri app bundles
        working-directory: apps/desktop
        env:
          NOSUCKSHELL_LICENSE_PUBKEY_HEX: ${{ secrets.NOSUCKSHELL_LICENSE_PUBKEY_HEX }}
        run: npm run tauri:build

      - name: Post-process Linux AppImage (strip bundled libpcre2-8)
        if: matrix.artifact_name == 'linux'
        shell: bash
        run: |
          set -euo pipefail
          sudo apt-get update
          sudo apt-get install -y curl fuse3 squashfs-tools
          bash scripts/postprocess-linux-appimage-libs.sh

      - name: Upload platform bundles
        uses: actions/upload-artifact@v7
        with:
          name: bundle-${{ matrix.artifact_name }}
          if-no-files-found: warn
          path: target/release/bundle/

  build-arch:
    name: Build Arch Linux package
    needs:
      - validate-tag
      - build
    runs-on: ubuntu-latest
    env:
      RELEASE_VERSION: ${{ needs.validate-tag.outputs.version }}
    steps:
      - name: Checkout
        uses: actions/checkout@v6

      - name: Download Linux bundles
        uses: actions/download-artifact@v8
        with:
          name: bundle-linux
          path: target/release/bundle/

      - name: Build Arch Linux package
        shell: bash
        run: |
          set -euo pipefail
          VERSION="${RELEASE_VERSION}"
          # Arch versions cannot have hyphens
          PKGVER="${VERSION//-/.}"
          
          cd apps/desktop/src-tauri
          
          # Inject version into PKGBUILD
          sed -i "s/pkgver=\${_PKGVER}/pkgver=${PKGVER}/" PKGBUILD

          # Use a Docker container to run makepkg since Ubuntu doesn't have it natively
          # Pre-install dependencies as root
          docker run --rm \
            -v "$(pwd)/../../..:/repo" \
            -w /repo/apps/desktop/src-tauri \
            archlinux:latest \
            bash -c "pacman -Sy --noconfirm base-devel binutils gtk3 webkit2gtk-4.1 libayatana-appindicator librsvg libsoup3 openssl && \
                     useradd -m builduser && \
                     chown -R builduser:builduser /repo && \
                     sudo -u builduser makepkg --noconfirm"

      - name: Upload Arch Linux package
        uses: actions/upload-artifact@v7
        with:
          name: bundle-linux-arch
          if-no-files-found: error
          path: apps/desktop/src-tauri/*.pkg.tar.zst

  release:
    name: Publish GitHub release
    needs:
      - validate-tag
      - build
      - build-arch
      - marketing-screenshots
    runs-on: ubuntu-latest
    steps:
      - name: Download all platform artifacts
        uses: actions/download-artifact@v8
        with:
          pattern: bundle-*
          merge-multiple: true
          path: release-artifacts

      - name: Download marketing screenshots
        uses: actions/download-artifact@v8
        with:
          name: marketing-screenshots
          path: marketing-screenshots-artifact

      - name: Create GitHub release
        uses: softprops/action-gh-release@v3
        with:
          tag_name: ${{ needs.validate-tag.outputs.tag }}
          name: NoSuckShell ${{ needs.validate-tag.outputs.tag }}
          prerelease: ${{ needs.validate-tag.outputs.prerelease == 'true' }}
          generate_release_notes: true
          body: |
            Automated release for `${{ needs.validate-tag.outputs.tag }}`.

            **Marketing screenshots** (Flathub + Microsoft Store / Snap sizes): `marketing-screenshots.zip` in the assets below. Unzip and copy into `docs/media/screenshots/` if you want the repo to match the release visuals.
          files: |
            release-artifacts/**/*.AppImage
            release-artifacts/**/*.deb
            release-artifacts/**/*.rpm
            release-artifacts/**/*.dmg
            release-artifacts/**/*.msi
            release-artifacts/**/*.exe
            release-artifacts/**/*.pkg.tar.zst
            marketing-screenshots-artifact/marketing-screenshots.zip