release.yml

name: Release

on:
  workflow_dispatch:
    inputs:
      bump:
        description: 'Which semver part to bump'
        type: choice
        required: true
        default: patch
        options:
          - patch
          - minor
          - major
      base_tag:
        description: 'Optional base tag (e.g. v1.2.3). Defaults to latest release tag'
        type: string
        required: false

permissions:
  contents: write

jobs:
  create_release:
    name: Create tag and prerelease (draft)
    runs-on: ubuntu-latest
    outputs:
      tag: ${{ steps.next.outputs.tag }}
      version: ${{ steps.next.outputs.version }}
      sha: ${{ steps.meta.outputs.sha }}
      previous: ${{ steps.next.outputs.previous }}
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
          fetch-tags: true
          ref: ${{ github.ref_name }}

      - name: Configure git
        shell: bash
        run: |
          set -euo pipefail
          git config user.name "github-actions[bot]"
          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"

      - name: Determine next version
        id: next
        shell: bash
        run: |
          set -euo pipefail
          BASE_TAG="${{ inputs.base_tag }}"
          if [ -z "${BASE_TAG}" ]; then
            BASE_TAG="$(
              gh release list --limit 100 --json tagName --jq '.[].tagName' \
                | grep -E '^v[0-9]+[.][0-9]+[.][0-9]+$' \
                | sort -V \
                | tail -n 1 \
                || true
            )"
          fi
          if [ -z "${BASE_TAG}" ]; then
            BASE_TAG="$(
              git for-each-ref --sort=-version:refname --format='%(refname:strip=2)' refs/tags \
                | grep -E '^v[0-9]+[.][0-9]+[.][0-9]+$' \
                | head -n 1 \
                || true
            )"
          fi
          BASE_TAG="$(printf '%s' "${BASE_TAG}" | tr -d '\r' | xargs)"
          if [ -z "${BASE_TAG}" ]; then
            echo "No base tag found (no stable releases and no vX.Y.Z tags)" >&2
            git tag -l || true
            exit 1
          fi

          if ! [[ "${BASE_TAG}" =~ ^v[0-9]+[.][0-9]+[.][0-9]+$ ]]; then
            echo "Base tag is not a stable semver tag: ${BASE_TAG}" >&2
            exit 1
          fi

          BASE_VERSION="${BASE_TAG#v}"
          IFS='.' read -r MAJOR MINOR PATCH <<< "${BASE_VERSION}"
          if [ -z "${MAJOR}" ] || [ -z "${MINOR}" ] || [ -z "${PATCH}" ]; then
            echo "Failed to parse base tag: ${BASE_TAG}" >&2
            exit 1
          fi

          case "${{ inputs.bump }}" in
            major)
              MAJOR=$((MAJOR + 1))
              MINOR=0
              PATCH=0
              ;;
            minor)
              MINOR=$((MINOR + 1))
              PATCH=0
              ;;
            patch)
              PATCH=$((PATCH + 1))
              ;;
            *)
              echo "Unknown bump: ${{ inputs.bump }}" >&2
              exit 1
              ;;
          esac

          NEXT_TAG="v${MAJOR}.${MINOR}.${PATCH}"
          NEXT_VERSION="${MAJOR}.${MINOR}.${PATCH}"

          if gh api "repos/${GITHUB_REPOSITORY}/git/ref/tags/${NEXT_TAG}" >/dev/null 2>&1; then
            echo "Tag already exists on remote: ${NEXT_TAG}" >&2
            exit 1
          fi
          if gh release view "${NEXT_TAG}" >/dev/null 2>&1; then
            echo "Release already exists: ${NEXT_TAG}" >&2
            exit 1
          fi

          echo "previous=${BASE_TAG}" >> "${GITHUB_OUTPUT}"
          echo "tag=${NEXT_TAG}" >> "${GITHUB_OUTPUT}"
          echo "version=${NEXT_VERSION}" >> "${GITHUB_OUTPUT}"
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

      - name: Capture release metadata
        id: meta
        shell: bash
        run: |
          set -euo pipefail
          SHA="$(git rev-parse HEAD)"
          echo "sha=${SHA}" >> "${GITHUB_OUTPUT}"

      - name: Tag (annotated)
        if: github.ref_name == 'main'
        shell: bash
        run: |
          set -euo pipefail
          TAG="${{ steps.next.outputs.tag }}"
          SHA="${{ steps.meta.outputs.sha }}"
          git tag -a "${TAG}" "${SHA}" -m "${TAG}"

      - name: Push tag
        if: github.ref_name == 'main'
        shell: bash
        run: |
          set -euo pipefail
          TAG="${{ steps.next.outputs.tag }}"
          git push origin "refs/tags/${TAG}"

      - name: Create prerelease (draft)
        if: github.ref_name == 'main'
        shell: bash
        run: |
          set -euo pipefail
          TAG="${{ steps.next.outputs.tag }}"
          PREV="${{ steps.next.outputs.previous }}"
          SHA="$(git rev-parse HEAD)"

          {
            echo "Previous: ${PREV}"
            echo "Tag: ${TAG}"
            echo "SHA: ${SHA}"
          } >> "${GITHUB_STEP_SUMMARY}"

          gh release create "${TAG}" \
            --verify-tag \
            --target "${SHA}" \
            --generate-notes \
            --notes-start-tag "${PREV}" \
            --prerelease \
            --draft
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

      - name: Note
        if: github.ref_name != 'main'
        shell: bash
        run: |
          set -euo pipefail
          {
            echo "Ref: ${GITHUB_REF_NAME}"
            echo ""
            echo "This run did not push/tag/release because it is not running from main."
          } >> "${GITHUB_STEP_SUMMARY}"

  build:
    name: Build & upload assets (${{ matrix.os }})
    runs-on: ${{ matrix.os }}
    needs: create_release
    if: github.ref_name == 'main'
    strategy:
      matrix:
        os: [macos-latest, ubuntu-latest]
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
          fetch-tags: true
          ref: refs/tags/${{ needs.create_release.outputs.tag }}

      - uses: pnpm/action-setup@v4

      - uses: actions/setup-node@v4
        with:
          node-version: '22.15.1'
          cache: 'pnpm'

      - name: Set version from tag
        shell: bash
        run: |
          set -euo pipefail
          VERSION="${{ needs.create_release.outputs.version }}"
          if [ -z "${VERSION}" ]; then
            echo "Missing version output" >&2
            exit 1
          fi
          node -e 'const fs=require("fs"); const p=JSON.parse(fs.readFileSync("package.json","utf8")); p.version=process.env.VERSION; fs.writeFileSync("package.json", JSON.stringify(p,null,2)+"\n");'
        env:
          VERSION: ${{ needs.create_release.outputs.version }}

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      - name: Build application
        run: pnpm --filter @snowtree/core build && pnpm --filter @snowtree/desktop build && pnpm --filter @snowtree/ui build

      - name: Prepare release app directory (prod deps)
        shell: bash
        run: |
          set -euo pipefail
          RELEASE_APP_DIR="${RUNNER_TEMP}/release-app"
          echo "RELEASE_APP_DIR=${RELEASE_APP_DIR}" >> "${GITHUB_ENV}"

          rm -rf "${RELEASE_APP_DIR}"
          mkdir -p "${RELEASE_APP_DIR}/packages/desktop" "${RELEASE_APP_DIR}/packages/ui" "${RELEASE_APP_DIR}/packages/core"

          cp package.json pnpm-lock.yaml pnpm-workspace.yaml .npmrc LICENSE "${RELEASE_APP_DIR}/"
          cp -R packages/desktop/dist "${RELEASE_APP_DIR}/packages/desktop/dist"
          cp -R packages/desktop/assets "${RELEASE_APP_DIR}/packages/desktop/assets"
          cp packages/desktop/package.json "${RELEASE_APP_DIR}/packages/desktop/package.json"
          cp -R packages/ui/dist "${RELEASE_APP_DIR}/packages/ui/dist"

          cp "${GITHUB_WORKSPACE}/packages/core/package.json" "${RELEASE_APP_DIR}/packages/core/package.json"
          cp -R "${GITHUB_WORKSPACE}/packages/core/dist" "${RELEASE_APP_DIR}/packages/core/dist"
          cp -R "${GITHUB_WORKSPACE}/packages/core/dist-cjs" "${RELEASE_APP_DIR}/packages/core/dist-cjs"

          pushd "${RELEASE_APP_DIR}"
          pnpm install -P --frozen-lockfile --ignore-scripts
          popd

      - name: Rebuild native dependencies (Electron)
        shell: bash
        run: |
          set -euo pipefail
          pushd "${RELEASE_APP_DIR}"
          "${GITHUB_WORKSPACE}/node_modules/.bin/electron-builder" install-app-deps
          popd

      - name: Prepare Apple API Key
        if: runner.os == 'macOS'
        shell: bash
        run: |
          set -euo pipefail
          APPLE_API_KEY_PATH="${RUNNER_TEMP}/AuthKey_${APPLE_API_KEY_ID}.p8"
          echo "${APPLE_API_KEY}" | base64 -d > "${APPLE_API_KEY_PATH}"
          echo "APPLE_API_KEY_PATH=${APPLE_API_KEY_PATH}" >> "${GITHUB_ENV}"
        env:
          APPLE_API_KEY: ${{ secrets.APPLE_API_KEY }}
          APPLE_API_KEY_ID: ${{ secrets.APPLE_API_KEY_ID }}

      - name: Build artifacts (no publish)
        shell: bash
        run: |
          set -euo pipefail
          "${GITHUB_WORKSPACE}/node_modules/.bin/electron-builder" --projectDir "${RELEASE_APP_DIR}" --publish never
        env:
          CSC_LINK: ${{ secrets.CSC_LINK }}
          CSC_KEY_PASSWORD: ${{ secrets.CSC_KEY_PASSWORD }}
          APPLE_API_KEY: ${{ env.APPLE_API_KEY_PATH }}
          APPLE_API_KEY_ID: ${{ secrets.APPLE_API_KEY_ID }}
          APPLE_API_ISSUER: ${{ secrets.APPLE_API_ISSUER }}

      - name: Verify packaged app contains core (macOS)
        if: runner.os == 'macOS'
        shell: bash
        run: |
          set -euo pipefail
          ZIP="$(ls -1 "${RELEASE_APP_DIR}/dist-electron/"*macOS-arm64.zip | head -n 1)"
          TMP_DIR="${RUNNER_TEMP}/verify-app"
          rm -rf "${TMP_DIR}"
          mkdir -p "${TMP_DIR}"
          unzip -q "${ZIP}" -d "${TMP_DIR}"
          APP_ASAR="$(find "${TMP_DIR}" -path '*snowtree.app/Contents/Resources/app.asar' | head -n 1)"
          echo "Verifying asar: ${APP_ASAR}"
          "${GITHUB_WORKSPACE}/node_modules/.bin/asar" list "${APP_ASAR}" | grep -q "node_modules/@snowtree/core/dist-cjs/types/models.js"

      - name: Verify code signing (macOS)
        if: runner.os == 'macOS'
        shell: bash
        run: |
          set -euo pipefail
          ZIP="$(ls -1 "${RELEASE_APP_DIR}/dist-electron/"*macOS-arm64.zip | head -n 1)"
          TMP_DIR="${RUNNER_TEMP}/verify-signing"
          rm -rf "${TMP_DIR}"
          mkdir -p "${TMP_DIR}"
          unzip -q "${ZIP}" -d "${TMP_DIR}"
          APP="$(find "${TMP_DIR}" -name 'snowtree.app' -type d | head -n 1)"

          echo "Verifying code signature for: ${APP}"
          codesign -dv --verbose=4 "${APP}" 2>&1 | tee /tmp/codesign-output.txt

          # Check if signed
          if ! codesign -v "${APP}" 2>&1; then
            echo "❌ App is not properly signed"
            exit 1
          fi

          echo "✅ App is properly signed"

          # Verify DMG signature
          DMG="$(ls -1 "${RELEASE_APP_DIR}/dist-electron/"*macOS-arm64.dmg | head -n 1)"
          echo "Verifying DMG signature: ${DMG}"
          codesign -dv --verbose=4 "${DMG}" 2>&1 || echo "⚠️  DMG signature check (non-fatal)"

      - name: Publish to GitHub Releases
        shell: bash
        run: |
          set -euo pipefail
          "${GITHUB_WORKSPACE}/node_modules/.bin/electron-builder" --projectDir "${RELEASE_APP_DIR}" --publish always
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          CSC_LINK: ${{ secrets.CSC_LINK }}
          CSC_KEY_PASSWORD: ${{ secrets.CSC_KEY_PASSWORD }}
          APPLE_API_KEY: ${{ runner.os == 'macOS' && env.APPLE_API_KEY_PATH || '' }}
          APPLE_API_KEY_ID: ${{ secrets.APPLE_API_KEY_ID }}
          APPLE_API_ISSUER: ${{ secrets.APPLE_API_ISSUER }}

      - name: Ensure release assets uploaded (gh upload)
        shell: bash
        run: |
          set -euo pipefail
          TAG="${{ needs.create_release.outputs.tag }}"
          VER="${TAG#v}"
          DIST="${RELEASE_APP_DIR}/dist-electron"

          if [ ! -d "${DIST}" ]; then
            echo "Missing dist dir: ${DIST}" >&2
            exit 1
          fi

          FILES=()
          while IFS= read -r file; do
            [ -n "${file}" ] || continue
            FILES+=("${file}")
          done < <(
            find "${DIST}" -maxdepth 1 -type f \
              \( -name "latest-*.yml" -o -name "snowtree-${VER}-*" \) \
              -print
          )

          if [ "${#FILES[@]}" -eq 0 ]; then
            echo "No release assets found to upload in ${DIST}" >&2
            exit 1
          fi

          gh release upload "${TAG}" "${FILES[@]}" --clobber
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

  finalize_release:
    name: Publish prerelease (undraft)
    runs-on: ubuntu-latest
    needs: [create_release, build]
    if: github.ref_name == 'main' && needs.build.result == 'success'
    steps:
      - name: Publish release (undraft, keep prerelease)
        shell: bash
        run: |
          set -euo pipefail
          TAG="${{ needs.create_release.outputs.tag }}"
          if [ -z "${TAG}" ]; then
            echo "Missing tag output" >&2
            exit 1
          fi

          echo "Publishing prerelease: ${TAG}"
          gh release edit "${TAG}" --draft=false --prerelease --repo "${GITHUB_REPOSITORY}"
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}