bundle.yml

name: bundle

on:
  push:
    branches: [main]
    tags:
      - "v*"
  pull_request:
    branches: [main]
    # PRs only re-bundle when something that affects the output changed.
    # Doc / workflow / other changes get a free pass.
    paths:
      - "**/Cargo.toml"
      - "Cargo.lock"
      - "cli/**"
      - "lib/**"
      - "ui/**"
      - ".github/workflows/bundle.yml"
  workflow_dispatch:

jobs:
  bundle:
    runs-on: ${{ matrix.os }}
    strategy:
      fail-fast: false
      matrix:
        # PRs run linux only as a smoke check; main/tag/manual runs cover all three OSes.
        # windows-2022 (not windows-latest): windows-latest aliases to VS18 preview,
        # whose MSVC 14.50 headers + cmake-rs can't resolve a Visual Studio generator
        # for aws-lc-sys, breaking `dx bundle`. Revisit once the ecosystem catches up.
        os: ${{ fromJSON(github.event_name == 'pull_request' && '["ubuntu-latest"]' || '["macos-latest","ubuntu-latest","windows-2022"]') }}

    env:
      BUILD_N0DES_API_SECRET: ${{ secrets.N0DES_API_SECRET }}
      BUILD_DATUM_CONNECT_RELAY_URLS: ${{ vars.BUILD_DATUM_CONNECT_RELAY_URLS }}
      BUILD_DATUM_CONNECT_CREATE_TRAFFIC_PROTECTION_POLICIES: ${{ vars.BUILD_DATUM_CONNECT_CREATE_TRAFFIC_PROTECTION_POLICIES }}
      DATUM_API_ENV: production

    steps:
      - uses: actions/checkout@v4

      - uses: dtolnay/rust-toolchain@stable

      # Use a stable shared-key per OS instead of the default Cargo.toml/Cargo.lock hash.
      # `cargo generate-lockfile` and the in-place version bump otherwise rotate the
      # default cache key on every run, throwing away dep compile artefacts.
      # Only save the cache from main / tag / manual runs so PRs don't pollute it.
      - uses: Swatinem/rust-cache@v2
        with:
          shared-key: bundle-${{ matrix.os }}
          save-if: ${{ github.event_name != 'pull_request' }}

      - name: Install system dependencies (Linux)
        if: runner.os == 'Linux'
        run: |
          sudo apt-get update
          sudo apt-get install -y \
            libwebkit2gtk-4.1-dev \
            libgtk-3-dev \
            libayatana-appindicator3-dev \
            librsvg2-dev \
            rpm \
            libfuse2 \
            libxdo-dev

      # Library deps in ui/Cargo.toml are pinned to dioxus =0.7.9, but the CLI is
      # held back at 0.7.2 because dx bundle path resolution regressed in 0.7.3+
      # and the upstream fix is still open:
      # https://github.com/DioxusLabs/dioxus/issues/5233
      # Bump in lockstep with the lib once that issue is resolved.
      #
      # Download the prebuilt `dx` binary from GitHub releases rather than
      # `cargo install dioxus-cli`, which compiles the whole CLI from source
      # (5–10 min per matrix leg, every run).
      - name: Install Dioxus CLI (Unix)
        if: runner.os != 'Windows'
        shell: bash
        run: |
          set -euo pipefail
          DX_VER=0.7.2
          TRIPLE=$(rustc -Vv | awk '/^host:/{print $2}')
          URL="https://github.com/DioxusLabs/dioxus/releases/download/v${DX_VER}/dx-${TRIPLE}.tar.gz"
          echo "Downloading $URL"
          mkdir -p "$HOME/.cargo/bin"
          curl -fsSL "$URL" | tar -xz -C "$HOME/.cargo/bin"
          chmod +x "$HOME/.cargo/bin/dx"
          "$HOME/.cargo/bin/dx" --version

      - name: Install Dioxus CLI (Windows)
        if: runner.os == 'Windows'
        shell: pwsh
        run: |
          $DX_VER = '0.7.2'
          $TRIPLE = ((rustc -Vv | Select-String '^host: ').ToString() -replace '^host: ','').Trim()
          $URL = "https://github.com/DioxusLabs/dioxus/releases/download/v$DX_VER/dx-$TRIPLE.zip"
          Write-Host "Downloading $URL"
          $tmp = Join-Path $env:RUNNER_TEMP 'dx.zip'
          Invoke-WebRequest -Uri $URL -OutFile $tmp -UseBasicParsing
          $dst = Join-Path $env:USERPROFILE '.cargo\bin'
          New-Item -ItemType Directory -Force -Path $dst | Out-Null
          Expand-Archive -Path $tmp -DestinationPath $dst -Force
          & (Join-Path $dst 'dx.exe') --version

      - uses: actions/setup-node@v4
        if: runner.os == 'macOS'
        with:
          node-version: "22"
          cache: npm
          cache-dependency-path: ui/packaging/dmg/package-lock.json

      - name: Install appdmg (npm ci)
        if: runner.os == 'macOS'
        working-directory: ui/packaging/dmg
        run: npm ci

      - name: Import Apple Certificate
        if: runner.os == 'macOS'
        env:
          APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }}
          APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
          KEYCHAIN_PASSWORD: ${{ secrets.KEYCHAIN_PASSWORD }}
        run: |
          # Create variables
          CERTIFICATE_PATH=$RUNNER_TEMP/build_certificate.p12
          KEYCHAIN_PATH=$RUNNER_TEMP/app-signing.keychain-db

          # Import certificate from secrets
          echo -n "$APPLE_CERTIFICATE" | base64 --decode -o $CERTIFICATE_PATH

          # Create temporary keychain
          security create-keychain -p "$KEYCHAIN_PASSWORD" $KEYCHAIN_PATH
          security set-keychain-settings -lut 21600 $KEYCHAIN_PATH
          security unlock-keychain -p "$KEYCHAIN_PASSWORD" $KEYCHAIN_PATH

          # Import certificate to keychain
          security import $CERTIFICATE_PATH -P "$APPLE_CERTIFICATE_PASSWORD" -A -t cert -f pkcs12 -k $KEYCHAIN_PATH
          security set-key-partition-list -S apple-tool:,apple: -k "$KEYCHAIN_PASSWORD" $KEYCHAIN_PATH
          security list-keychain -d user -s $KEYCHAIN_PATH

      - name: Configure macOS Signing Identity
        if: runner.os == 'macOS'
        working-directory: ./ui
        env:
          APPLE_SIGNING_IDENTITY: ${{ secrets.APPLE_SIGNING_IDENTITY }}
        run: |
          # Update Dioxus.toml with the actual signing identity
          sed -i '' "s/signing_identity = \"-\"/signing_identity = \"$APPLE_SIGNING_IDENTITY\"/" Dioxus.toml
          echo "Updated signing identity in Dioxus.toml"
          grep signing_identity Dioxus.toml

      - name: Set Version (Unix)
        if: runner.os != 'Windows'
        working-directory: ./ui
        env:
          FULL_SHA: ${{ github.sha }}
          REF: ${{ github.ref }}
        run: |
          if echo "$REF" | grep -q '^refs/tags/'; then
            VERSION="${REF#refs/tags/v}"
            VERSION="${VERSION#refs/tags/}"
          else
            SHORT_SHA=${FULL_SHA::7}
            BUILD_DATE=$(date +'%Y.%-m.%-d' 2>/dev/null || date +'%Y.%m.%d' | sed 's/\.0\([0-9]\)/.\1/g')
            VERSION="${BUILD_DATE}-${SHORT_SHA}"
          fi
          echo "Setting version to: $VERSION"
          # Update Cargo.toml version
          sed -i.bak "s/^version = \".*\"/version = \"$VERSION\"/" Cargo.toml
          # Also update lib/Cargo.toml if it exists
          if [ -f ../lib/Cargo.toml ]; then
            sed -i.bak "s/^version = \".*\"/version = \"$VERSION\"/" ../lib/Cargo.toml
          fi

      - name: Set Version (Windows)
        if: runner.os == 'Windows'
        working-directory: ./ui
        env:
          FULL_SHA: ${{ github.sha }}
          REF: ${{ github.ref }}
        shell: pwsh
        run: |
          if ($env:REF -match '^refs/tags/') {
            $VERSION = $env:REF -replace '^refs/tags/v?', ''
          } else {
            $SHORT_SHA = $env:FULL_SHA.Substring(0, 7)
            $BUILD_DATE = Get-Date -Format "yyyy.M.d"
            $VERSION = "$BUILD_DATE-$SHORT_SHA"
          }
          Write-Host "Setting version to: $VERSION"
          # Update Cargo.toml version
          (Get-Content Cargo.toml) -replace '^version = ".*"', "version = `"$VERSION`"" | Set-Content Cargo.toml
          if (Test-Path ../lib/Cargo.toml) {
            (Get-Content ../lib/Cargo.toml) -replace '^version = ".*"', "version = `"$VERSION`"" | Set-Content ../lib/Cargo.toml
          }

      - name: Update Cargo.lock
        if: runner.os == 'macOS'
        # Run from workspace root to update lock file for all workspace members
        run: cargo generate-lockfile

      - name: Bundle (macOS)
        if: runner.os == 'macOS'
        working-directory: ./ui
        env:
          # Baked into the binary via `option_env!("SENTRY_DSN")` in ui/src/main.rs.
          # If the secret isn't set the binary just runs without Sentry reporting.
          SENTRY_DSN: ${{ secrets.SENTRY_DSN }}
        run: dx bundle --locked --desktop --release --package-types macos

      - name: Build DMG (appdmg)
        if: runner.os == 'macOS'
        env:
          APPLE_SIGNING_IDENTITY: ${{ secrets.APPLE_SIGNING_IDENTITY }}
        run: |
          mkdir -p ui/dist
          if [ ! -d ui/dist/Datum.app ]; then
            if [ -d ui/target/dx/Datum/release/macos/Datum.app ]; then
              cp -R ui/target/dx/Datum/release/macos/Datum.app ui/dist/
            else
              APP=$(find ui/target/dx -path '*/release/macos/*.app' -type d 2>/dev/null | head -1)
              if [ -n "$APP" ]; then
                cp -R "$APP" ui/dist/Datum.app
              fi
            fi
          fi
          test -d ui/dist/Datum.app
          ./ui/packaging/dmg/mk-dmg-icns-from-linux-png.sh
          if [ -f ui/packaging/dmg/dmg-background@2x.png ]; then
            ./ui/packaging/dmg/sync-dmg-background-1x.sh
          fi
          rm -f ui/dist/*.dmg
          ./ui/packaging/dmg/node_modules/.bin/appdmg \
            ui/packaging/dmg/appdmg.json \
            ui/dist/Datum.dmg
          ./ui/packaging/dmg/apply-dmg-finder-icon.sh \
            ui/dist/Datum.dmg \
            ui/packaging/dmg/Datum-dmg.icns
          if [ -z "${APPLE_SIGNING_IDENTITY:-}" ]; then
            echo "APPLE_SIGNING_IDENTITY is empty"
            exit 1
          fi
          codesign --force --sign "$APPLE_SIGNING_IDENTITY" --timestamp ui/dist/Datum.dmg

      - name: Generate dSYM (macOS)
        if: runner.os == 'macOS' && startsWith(github.ref, 'refs/tags/v')
        run: |
          # `debug = "line-tables-only"` in workspace Cargo.toml leaves DWARF
          # distributed across the `.o` files in target/<triple>/<profile>/deps/
          # with only N_OSO references in the binary. Without a .dSYM bundle
          # sentry-cli has nothing to symbolicate against on macOS, so we run
          # dsymutil manually and stage the result outside the .app bundle so
          # it doesn't get packaged into the DMG.
          APP="ui/dist/Datum.app"
          if [ ! -d "$APP" ]; then
            APP=$(find ui/target/dx -path '*/release/macos/*.app' -type d 2>/dev/null | head -1)
          fi
          if [ -z "$APP" ] || [ ! -d "$APP" ]; then
            echo "macOS .app not found (expected ui/dist/Datum.app after DMG step)" >&2
            find ui/target/dx -type d -name '*.app' 2>/dev/null | head -20 >&2 || true
            exit 1
          fi
          EXEC=$(/usr/libexec/PlistBuddy -c 'Print :CFBundleExecutable' "$APP/Contents/Info.plist")
          BIN="$APP/Contents/MacOS/$EXEC"
          DSYM_DIR="$RUNNER_TEMP/dsyms"
          mkdir -p "$DSYM_DIR"
          if [ ! -f "$BIN" ]; then
            echo "Bundled binary not found at $BIN (app: $APP)" >&2
            ls -la "$APP/Contents/MacOS" >&2 || true
            exit 1
          fi
          dsymutil "$BIN" -o "$DSYM_DIR/Datum.dSYM"
          ls -la "$DSYM_DIR/Datum.dSYM"
          dwarfdump --uuid "$DSYM_DIR/Datum.dSYM"

      - name: Upload Debug Symbols to Sentry (macOS)
        if: runner.os == 'macOS' && startsWith(github.ref, 'refs/tags/v')
        env:
          SENTRY_AUTH_TOKEN: ${{ secrets.SENTRY_AUTH_TOKEN }}
          SENTRY_URL: ${{ secrets.SENTRY_URL }}
          SENTRY_ORG: ${{ secrets.SENTRY_ORG }}
          SENTRY_PROJECT: ${{ secrets.SENTRY_PROJECT }}
        run: |
          if [ -n "$SENTRY_AUTH_TOKEN" ]; then
            export INSTALL_DIR=$HOME/.local/bin
            mkdir -p "$INSTALL_DIR"
            export PATH="$INSTALL_DIR:$PATH"
            curl -sL https://sentry.io/get-cli/ | SENTRY_CLI_VERSION=3.2.3 sh
            MACOS_BIN_DIR="ui/dist/Datum.app/Contents/MacOS"
            if [ ! -d "$MACOS_BIN_DIR" ]; then
              APP=$(find ui/target/dx -path '*/release/macos/*.app' -type d 2>/dev/null | head -1)
              MACOS_BIN_DIR="${APP}/Contents/MacOS"
            fi
            if [ ! -d "$MACOS_BIN_DIR" ]; then
              echo "Sentry: macOS Contents/MacOS not found under ui/dist or ui/target/dx" >&2
              exit 1
            fi
            sentry-cli debug-files upload --include-sources \
              "$RUNNER_TEMP/dsyms" \
              "$MACOS_BIN_DIR"
          else
            echo "SENTRY_AUTH_TOKEN not set, skipping debug symbol upload"
          fi

      - name: Notarize macOS App
        if: runner.os == 'macOS' && github.event_name == 'push' && (github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/tags/'))
        env:
          APPLE_ID: ${{ secrets.APPLE_ID }}
          APPLE_APP_SPECIFIC_PASSWORD: ${{ secrets.APPLE_APP_SPECIFIC_PASSWORD }}
          APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
        run: |
          # Find the DMG file
          DMG_FILE=$(find ui/dist -name "*.dmg" | head -1)
          if [ -n "$DMG_FILE" ]; then
            echo "Notarizing $DMG_FILE..."
            
            # Submit for notarization
            xcrun notarytool submit "$DMG_FILE" \
              --apple-id "$APPLE_ID" \
              --password "$APPLE_APP_SPECIFIC_PASSWORD" \
              --team-id "$APPLE_TEAM_ID" \
              --wait
            
            # Staple the notarization ticket to the DMG
            xcrun stapler staple "$DMG_FILE"
            
            echo "Notarization complete!"
          else
            echo "No DMG file found to notarize"
            exit 1
          fi

      # DMG build leaves Datum.app under ui/dist; upload-artifact uses ui/dist/** and the release
      # step used artifacts/**/*, so every file inside the bundle (fonts, PNGs, CodeResources, …)
      # became a separate GitHub release asset. The DMG already contains the app.
      - name: Remove unpacked macOS .app from dist before artifact upload
        if: runner.os == 'macOS'
        run: rm -rf ui/dist/Datum.app

      - name: Cleanup macOS Keychain
        if: runner.os == 'macOS' && always()
        run: |
          security delete-keychain $RUNNER_TEMP/app-signing.keychain-db || true

      - name: Update Cargo.lock
        if: runner.os == 'Linux'
        # Run from workspace root to update lock file for all workspace members
        run: cargo generate-lockfile

      - name: Bundle (Linux)
        if: runner.os == 'Linux'
        working-directory: ./ui
        # TODO: stripping fails currently, it seems to be a known issues
        # See https://github.com/DioxusLabs/dioxus/issues/3426
        # and https://github.com/linuxdeploy/linuxdeploy/issues/272
        # For now we set NO_STRIP, which makes the bundles *huge*...
        env:
          NO_STRIP: true
          # Baked into the binary via `option_env!("SENTRY_DSN")` in ui/src/main.rs.
          SENTRY_DSN: ${{ secrets.SENTRY_DSN }}
        run: dx bundle --locked --desktop --release --package-types appimage

      - name: Repack AppImage using system libs (Linux)
        if: runner.os == 'Linux'
        run: |
          APPIMAGE=$(find ui/dist -name "*.AppImage" | head -1)
          cd "$(dirname "$APPIMAGE")"
          APPIMAGE_NAME=$(basename "$APPIMAGE")

          # Extract the built AppImage
          APPIMAGE_EXTRACT_AND_RUN=1 "./$APPIMAGE_NAME" --appimage-extract

          # Remove all standard system libs bundled by linuxdeploy from Ubuntu.
          # Bundling these causes symbol version conflicts on other distros (Fedora,
          # Arch, etc.) because the Ubuntu-built WebKit/GTK/GStreamer/GLib are
          # incompatible with the host's EGL and graphics stack.
          # The AppImage relies on the system-provided versions instead.
          #
          # System deps required at runtime:
          #   Fedora:        sudo dnf install webkit2gtk4.1
          #   Debian/Ubuntu: sudo apt install libwebkit2gtk-4.1-0
          #   Arch:          sudo pacman -S webkit2gtk-4.1
          rm -f squashfs-root/usr/lib/libwebkit2gtk-4.1.so*
          rm -f squashfs-root/usr/lib/libjavascriptcoregtk-4.1.so*
          rm -f squashfs-root/usr/lib/libgtk-3.so* squashfs-root/usr/lib/libgdk-3.so*
          rm -f squashfs-root/usr/lib/libglib-2.0.so* squashfs-root/usr/lib/libgmodule-2.0.so*
          rm -f squashfs-root/usr/lib/libgio-2.0.so* squashfs-root/usr/lib/libgobject-2.0.so*
          rm -f squashfs-root/usr/lib/libgstreamer-1.0.so* squashfs-root/usr/lib/libgst*.so*
          rm -f squashfs-root/usr/lib/libgdk_pixbuf-2.0.so*
          rm -f squashfs-root/usr/lib/libcairo.so* squashfs-root/usr/lib/libcairo-gobject.so*
          rm -f squashfs-root/usr/lib/libpango-1.0.so* squashfs-root/usr/lib/libpangocairo-1.0.so*
          rm -f squashfs-root/usr/lib/libpangoft2-1.0.so* squashfs-root/usr/lib/libpixman-1.so*
          rm -f squashfs-root/usr/lib/libatk-1.0.so* squashfs-root/usr/lib/libatk-bridge-2.0.so*
          rm -f squashfs-root/usr/lib/libatspi.so* squashfs-root/usr/lib/libepoxy.so*
          rm -f squashfs-root/usr/lib/libdbus-1.so* squashfs-root/usr/lib/libsoup-3.0.so*
          rm -f squashfs-root/usr/lib/libsecret-1.so* squashfs-root/usr/lib/libssl.so*
          rm -f squashfs-root/usr/lib/libcrypto.so* squashfs-root/usr/lib/libxml2.so*
          rm -f squashfs-root/usr/lib/libxslt.so* squashfs-root/usr/lib/libsqlite3.so*
          rm -f squashfs-root/usr/lib/libffi.so* squashfs-root/usr/lib/libpcre2-8.so*
          rm -f squashfs-root/usr/lib/libsystemd.so* squashfs-root/usr/lib/libudev.so*
          rm -f squashfs-root/usr/lib/libselinux.so* squashfs-root/usr/lib/libmount.so*
          rm -f squashfs-root/usr/lib/libblkid.so* squashfs-root/usr/lib/libzstd.so*
          rm -f squashfs-root/usr/lib/liblz4.so* squashfs-root/usr/lib/liblzma.so*
          rm -f squashfs-root/usr/lib/libpng16.so* squashfs-root/usr/lib/libjpeg.so*
          rm -f squashfs-root/usr/lib/libtiff.so* squashfs-root/usr/lib/libwebp*.so*
          rm -f squashfs-root/usr/lib/libharfbuzz*.so* squashfs-root/usr/lib/libgraphite2.so*
          rm -f squashfs-root/usr/lib/libfreetype*.so* squashfs-root/usr/lib/libfontconfig*.so*
          rm -f squashfs-root/usr/lib/libicu*.so* squashfs-root/usr/lib/libseccomp.so*
          rm -f squashfs-root/usr/lib/libwayland-*.so* squashfs-root/usr/lib/libxkbcommon.so*
          rm -f squashfs-root/usr/lib/libX*.so* squashfs-root/usr/lib/libxcb*.so*
          rm -f squashfs-root/usr/lib/libavahi-*.so* squashfs-root/usr/lib/libcups.so*
          rm -f squashfs-root/usr/lib/libkrb5*.so* squashfs-root/usr/lib/libk5crypto.so*
          rm -f squashfs-root/usr/lib/libgssapi_krb5.so* squashfs-root/usr/lib/libkeyutils.so*
          rm -f squashfs-root/usr/lib/libgnutls.so* squashfs-root/usr/lib/libnettle.so*
          rm -f squashfs-root/usr/lib/libhogweed.so* squashfs-root/usr/lib/libp11-kit.so*
          rm -f squashfs-root/usr/lib/libtasn1.so* squashfs-root/usr/lib/libidn2.so*
          rm -f squashfs-root/usr/lib/libunistring.so* squashfs-root/usr/lib/libpsl.so*
          rm -f squashfs-root/usr/lib/libnghttp2.so* squashfs-root/usr/lib/libbrotli*.so*
          rm -f squashfs-root/usr/lib/liborc-0.4.so* squashfs-root/usr/lib/libmanette-0.2.so*
          rm -f squashfs-root/usr/lib/libenchant-2.so* squashfs-root/usr/lib/libhyphen.so*
          rm -f squashfs-root/usr/lib/libcolord.so* squashfs-root/usr/lib/libgudev-1.0.so*
          rm -f squashfs-root/usr/lib/librsvg-2.so* squashfs-root/usr/lib/libwoff2*.so*
          rm -f squashfs-root/usr/lib/liblcms2.so* squashfs-root/usr/lib/libLerc.so*
          rm -f squashfs-root/usr/lib/libdeflate.so* squashfs-root/usr/lib/libjbig.so*
          rm -f squashfs-root/usr/lib/libsharpyuv.so* squashfs-root/usr/lib/libevdev.so*
          rm -f squashfs-root/usr/lib/libdw.so* squashfs-root/usr/lib/libelf.so*
          rm -f squashfs-root/usr/lib/libunwind.so* squashfs-root/usr/lib/libgcrypt.so*
          rm -f squashfs-root/usr/lib/libcap.so* squashfs-root/usr/lib/libmd.so*
          rm -f squashfs-root/usr/lib/libbsd.so* squashfs-root/usr/lib/libbz2.so*
          rm -f squashfs-root/usr/lib/libdatrie.so* squashfs-root/usr/lib/libthai.so*
          rm -f squashfs-root/usr/lib/im-*.so squashfs-root/usr/lib/libprintbackend-*.so
          rm -f squashfs-root/usr/lib/libpixbufloader-*.so
          rm -rf squashfs-root/usr/lib/x86_64-linux-gnu

          # Bundle libayatana-appindicator3 and its direct dependencies.
          # libappindicator-sys uses dlopen at runtime, so linuxdeploy never
          # detects it as an ELF dependency and never bundles it. On distros
          # that don't ship it by default (e.g. Fedora Silverblue) the app
          # panics immediately on startup with "Failed to load ayatana-appindicator3".
          # libdbusmenu-gtk3/glib are also missing for the same reason — they are
          # linked by appindicator but linuxdeploy never traversed that dep tree.
          for lib_prefix in libayatana-appindicator3 libayatana-indicator3 libdbusmenu-gtk3 libdbusmenu-glib libayatana-ido3-0.4; do
            find /usr/lib/x86_64-linux-gnu -maxdepth 1 -name "${lib_prefix}.so*" 2>/dev/null \
              | xargs -I{} cp -P {} squashfs-root/usr/lib/ 2>/dev/null || true
          done

          # Replace the GTK apprun hook with a distro-agnostic version.
          # The original uses Ubuntu-specific paths (x86_64-linux-gnu) that
          # don't exist on Fedora/Arch. Keep GDK_BACKEND=x11 — WebKitGTK
          # crashes with the Wayland backend (tauri-apps/tauri#8541).
          # (printf used instead of heredoc to avoid YAML indentation issues)
          printf '%s\n' \
            '#!/usr/bin/env bash' \
            'gsettings get org.gnome.desktop.interface gtk-theme 2>/dev/null | grep -qi "dark" && GTK_THEME_VARIANT="dark" || GTK_THEME_VARIANT="light"' \
            'APPIMAGE_GTK_THEME="${APPIMAGE_GTK_THEME:-"Adwaita:$GTK_THEME_VARIANT"}"' \
            'export APPDIR="${APPDIR:-"$(dirname "$(realpath "$0")")"}"' \
            'export GTK_THEME="$APPIMAGE_GTK_THEME"' \
            'export GDK_BACKEND=x11' \
            'export XDG_DATA_DIRS="$APPDIR/usr/share:/usr/share:${XDG_DATA_DIRS:-}"' \
            > squashfs-root/apprun-hooks/linuxdeploy-plugin-gtk.sh

          # Download appimagetool and repack
          wget -q "https://github.com/AppImage/appimagetool/releases/download/continuous/appimagetool-x86_64.AppImage" -O /tmp/appimagetool
          chmod +x /tmp/appimagetool
          rm "$APPIMAGE_NAME"
          ARCH=x86_64 APPIMAGE_EXTRACT_AND_RUN=1 /tmp/appimagetool squashfs-root "$APPIMAGE_NAME"
          rm -rf squashfs-root

      - name: Upload Debug Symbols to Sentry (Linux)
        if: runner.os == 'Linux' && startsWith(github.ref, 'refs/tags/v')
        env:
          SENTRY_AUTH_TOKEN: ${{ secrets.SENTRY_AUTH_TOKEN }}
          SENTRY_URL: ${{ secrets.SENTRY_URL }}
          SENTRY_ORG: ${{ secrets.SENTRY_ORG }}
          SENTRY_PROJECT: ${{ secrets.SENTRY_PROJECT }}
        run: |
          if [ -n "$SENTRY_AUTH_TOKEN" ]; then
            export INSTALL_DIR=$HOME/.local/bin
            mkdir -p "$INSTALL_DIR"
            export PATH="$INSTALL_DIR:$PATH"
            curl -sL https://sentry.io/get-cli/ | SENTRY_CLI_VERSION=3.2.3 sh
            sentry-cli debug-files upload --include-sources \
              ui/target/dx/Datum/release/linux/
          else
            echo "SENTRY_AUTH_TOKEN not set, skipping debug symbol upload"
          fi

      - name: Update Cargo.lock
        if: runner.os == 'Windows'
        # Run from workspace root to update lock file for all workspace members
        run: cargo generate-lockfile

      - name: Bundle (Windows)
        working-directory: ./ui
        if: runner.os == 'Windows'
        env:
          # Baked into the binary via `option_env!("SENTRY_DSN")` in ui/src/main.rs.
          SENTRY_DSN: ${{ secrets.SENTRY_DSN }}
        run: dx bundle --locked --desktop --release --package-types nsis

      - name: Upload Debug Symbols to Sentry (Windows)
        if: runner.os == 'Windows' && startsWith(github.ref, 'refs/tags/v')
        env:
          SENTRY_AUTH_TOKEN: ${{ secrets.SENTRY_AUTH_TOKEN }}
          SENTRY_URL: ${{ secrets.SENTRY_URL }}
          SENTRY_ORG: ${{ secrets.SENTRY_ORG }}
          SENTRY_PROJECT: ${{ secrets.SENTRY_PROJECT }}
        shell: pwsh
        run: |
          if ($env:SENTRY_AUTH_TOKEN) {
            $version = "3.2.3"
            $url = "https://github.com/getsentry/sentry-cli/releases/download/$version/sentry-cli-Windows-x86_64.exe"
            Invoke-WebRequest -Uri $url -OutFile sentry-cli.exe -UseBasicParsing
            .\sentry-cli.exe debug-files upload --include-sources ui/target/dx/Datum/release/windows/
          } else {
            Write-Host "SENTRY_AUTH_TOKEN not set, skipping debug symbol upload"
          }

      - name: Upload artifacts
        uses: actions/upload-artifact@v6
        with:
          name: DatumConnect-${{ runner.os }}
          path: ui/dist/**

  release:
    needs: [bundle]
    runs-on: ubuntu-latest
    permissions:
      contents: write
    # Only create releases for v* tags (no rolling release on main)
    if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags/v')
    outputs:
      # Matches desktop updater: pre-release tags (e.g. v1.0.0-beta.1) => beta channel + GitHub prerelease
      is_prerelease: ${{ steps.channel.outputs.prerelease }}
    steps:
      - name: Classify stable vs beta (semver pre-release tag)
        id: channel
        run: |
          TAG_NAME="${{ github.ref_name }}"
          V="${TAG_NAME#v}"
          if [[ "$V" == *-* ]]; then
            echo "prerelease=true" >> $GITHUB_OUTPUT
          else
            echo "prerelease=false" >> $GITHUB_OUTPUT
          fi

      - name: Set Version Info and Paths
        id: set_paths
        run: |
          TAG_NAME="${{ github.ref_name }}"
          echo "RELEASE_VERSION=${TAG_NAME#v}" >> $GITHUB_ENV
          echo "RELEASE_TAG=${TAG_NAME}" >> $GITHUB_ENV
          echo "RELEASE_NAME=${TAG_NAME}" >> $GITHUB_ENV
          echo "CURRENT_DATE_STR=$(date)" >> $GITHUB_ENV

      - name: Download All Artifacts
        uses: actions/download-artifact@v7
        with:
          path: artifacts

      - name: Create stable asset aliases
        run: |
          mkdir -p artifacts/aliases
          DMG_FILE=$(find artifacts -name "*.dmg" | head -1)
          APPIMAGE_FILE=$(find artifacts -name "*.AppImage" | head -1)
          EXE_FILE=$(find artifacts -name "*-setup.exe" -o -name "*setup*.exe" | head -1)
          if [ -n "$DMG_FILE" ]; then
            cp "$DMG_FILE" artifacts/aliases/Datum.dmg
          fi
          if [ -n "$APPIMAGE_FILE" ]; then
            cp "$APPIMAGE_FILE" artifacts/aliases/Datum.AppImage
          fi
          if [ -n "$EXE_FILE" ]; then
            cp "$EXE_FILE" artifacts/aliases/Datum-setup.exe
          fi

      - name: Create Release
        uses: softprops/action-gh-release@v2
        with:
          name: ${{ env.RELEASE_NAME }}
          tag_name: ${{ env.RELEASE_TAG }}
          make_latest: ${{ steps.channel.outputs.prerelease != 'true' }}
          prerelease: ${{ steps.channel.outputs.prerelease == 'true' }}
          body: |
            Version: ${{ env.RELEASE_VERSION }}
            Tag: ${{ env.RELEASE_TAG }}
            Commit: ${{ github.sha }}
            Built: ${{ env.CURRENT_DATE_STR }}
            Workflow: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}

            Assets: Datum.dmg, Datum.AppImage, Datum-setup.exe (see SHA256 checksums below).
          # Do not use artifacts/**/* — that uploads every nested file from historical artifact layouts.
          files: |
            artifacts/aliases/*
            artifacts/**/ui/dist/*.dmg
            artifacts/**/ui/dist/*.AppImage
            artifacts/**/ui/dist/*.exe
          generate_release_notes: false

  update-homebrew:
    needs: [release]
    runs-on: ubuntu-latest
    # Stable tags only — beta/pre-release builds must not replace the Homebrew cask
    if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags/v') && needs.release.outputs.is_prerelease == 'false'
    steps:
      - name: Generate GitHub App token
        id: app-token
        uses: actions/create-github-app-token@v1
        with:
          app-id: ${{ secrets.RELEASE_BOT_APP_ID }}
          private-key: ${{ secrets.RELEASE_BOT_APP_PRIVATE_KEY }}
          repositories: homebrew-tap

      - name: Download macOS artifacts
        uses: actions/download-artifact@v7
        with:
          name: DatumConnect-macOS
          path: macos-dist

      - name: Update Homebrew Tap
        env:
          GH_TOKEN: ${{ steps.app-token.outputs.token }}
          TAG: ${{ github.ref_name }}
        run: |
          VERSION="${TAG#v}"
          DMG_FILE=$(find macos-dist -name "*.dmg" | head -1)
          DMG_SHA=$(sha256sum "$DMG_FILE" | cut -d' ' -f1)
          REPO="datum-cloud/app"

          git clone https://x-access-token:${GH_TOKEN}@github.com/datum-cloud/homebrew-tap.git tap
          mkdir -p tap/Casks
          rm -f tap/Casks/datum.rb

          cat > tap/Casks/desktop.rb <<RUBY
          cask "desktop" do
            version "${VERSION}"
            sha256 "${DMG_SHA}"

            url "https://github.com/${REPO}/releases/download/${TAG}/Datum.dmg"
            name "Datum"
            desc "Quickly and safely expose local environments to the internet, for free."
            homepage "https://www.datum.net/"

            depends_on macos: ">= :big_sur"

            app "Datum.app"
          end
          RUBY

          cd tap
          git config user.name "Datum Release Bot"
          git config user.email "releases@datum.net"
          git add Casks/
          git diff --cached --quiet && exit 0
          git commit -m "Brew cask update for Datum Desktop version ${TAG}"
          git push