publish.yml

name: Publish

on:
  workflow_call:
    inputs:
      app_version:
        type: string
        description: The version of the app.
        required: false
        default: "0.0.0"
      app_version_android:
        type: string
        description: The version of the app for Android, CANNOT be `0.0.0`
        required: true
      release_name:
        type: string
        description: The name of the release.
        required: false
        default: Release
      release_tag:
        type: string
        description: The tag to use for the release.
        required: true
      prerelease:
        type: boolean
        description: Whether to make the release a prerelease.
        required: false
        default: false
      delete_release:
        type: boolean
        description: Whether to delete the release.
        required: false
        default: true
      android_key_path:
        type: string
        description: The path to the Android key file, relative to app_root
        required: false
        default: "upload.jks"
      aur_package_name:
        type: string
        description: The name of the AUR package.
        required: false
        default: ""
      aur_key_algorithm:
        type: string
        description: The algorithm to use for the AUR key.
        required: false
        default: "ed25519"
      aur_version:
        type: string
        description: The version of the AUR package.
        required: true
      task_build:
        type: string
        description: The task to run for building the app.
        required: false
        default: "tauri:build"
      task_build_android:
        type: string
        description: The task to run for building the app for Android.
        required: false
        default: "tauri:build:android"
      android_key_alias:
        type: string
        description: The alias of the Android key.
        required: false
        default: "upload"
      include_devtools:
        type: boolean
        description: Whether to include devtools in the build.
        required: false
        default: false
    secrets:
      TAURI_SIGNING_PRIVATE_KEY:
        description: Sign app binaries for updater support.
        required: false
      TAURI_SIGNING_PRIVATE_KEY_PASSWORD:
        description: Password for the signing key.
        required: false
      ANDROID_KEYSTORE:
        description: Base64 of `jks` file for APK signing.
        required: false
      ANDROID_KEYSTORE_PASSWORD:
        description: Password for the keystore.
        required: false
      BUILD_ENV:
        description: "Environment variables to pass to `tauri build`. Format: `key1=value1\\nkey2=value2\\n...`."
        required: false
      AUR_SSH_PRIVATE_KEY:
        description: "SSH private key for AUR publishing."
        required: false
      GEMINI_API_KEY:
        description: Authenticate Google Gemini to generate changelog.
        required: false

jobs:
  create-release:
    runs-on: ubuntu-latest
    permissions:
      contents: write
    env:
      GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - name: Setup Node
        uses: actions/setup-node@v4
        with:
          node-version: 24
      - name: Install dependencies
        run: npm i -g node-fetch
      - name: Delete release
        if: inputs.delete_release == true
        run: |
          gh release delete ${{ inputs.release_tag }} --yes --cleanup-tag || true
          sleep 1
      - name: Create release
        env:
          tag: ${{ inputs.release_tag }}
          name: ${{ inputs.release_name }}
          branch: ${{ github.ref_name }}
        run: |
          notes=$(GEMINI_API_KEY="${{ secrets.GEMINI_API_KEY }}" node ./.github/scripts/generate-changelog.mjs)
          gh release create "$tag" --target "$branch" --title "$name" --notes "$notes" ${{ inputs.prerelease == true && '--prerelease' || '' }}

  publish-tauri:
    needs: [create-release]
    outputs:
      hash: ${{ steps.sha256sum.outputs.hash }}
    permissions:
      contents: write
    strategy:
      fail-fast: false
      matrix:
        include:
          - platform: "ubuntu-22.04"
            dist: "src-tauri/target/release/bundle/**/*.{deb,AppImage,rpm,sig}"
          - platform: "windows-latest"
            dist: "src-tauri/target/release/bundle/nsis"
          - platform: "macos-latest"
            args: "--target universal-apple-darwin"
            rust_targets: "aarch64-apple-darwin,x86_64-apple-darwin"
            dist: "src-tauri/target/universal-apple-darwin/release/bundle/**/*.{dmg,tar.gz,sig}"

    runs-on: ${{ matrix.platform }}
    steps:
      - uses: actions/checkout@v4

      #region Prepare environment
      - name: Linux - Install dependencies
        if: matrix.platform == 'ubuntu-22.04'
        run: |
          sudo apt-get update
          sudo apt-get install -y libwebkit2gtk-4.1-dev libappindicator3-dev librsvg2-dev patchelf libudev-dev
      - uses: pnpm/action-setup@v4
        id: pnpm
        name: Install pnpm
        with:
          run_install: false
      - name: Install Node.js
        uses: actions/setup-node@v4
        with:
          node-version: 24
          cache: "pnpm"
      - name: Install dependencies
        run: pnpm install --no-frozen-lockfile
      - name: Install Rust
        uses: dtolnay/rust-toolchain@stable
        with:
          targets: ${{ matrix.rust_targets }}
      - name: Rust cache
        uses: swatinem/rust-cache@v2
        with:
          workspaces: "app/src-tauri -> target"
      #endregion

      #region Android - Prepare environment
      - name: Android - Setup Java
        if: matrix.android
        uses: actions/setup-java@v4
        with:
          distribution: "zulu"
          java-version: "17"
      - name: Android - Setup Android SDK
        if: matrix.android
        uses: android-actions/setup-android@v3
      - name: Android - Setup Android NDK
        if: matrix.android
        run: sdkmanager "ndk;27.0.11902837"
      - name: Android - Setup Android APK Signing
        if: matrix.android
        run: |
          cd app/src-tauri/gen/android
          cat > keystore.properties <<EOF
          password=${{ secrets.ANDROID_RELEASE_PASSWORD }}
          keyAlias=${{ inputs.android_key_alias }}
          storeFile=${{ inputs.android_key_path }}
          EOF
          echo "${{ secrets.ANDROID_RELEASE_KEYSTORE }}" | base64 --decode > app/${{ inputs.android_key_path }}
      #endregion
      #region Edit version
      - name: Set app version
        if: ${{ !matrix.android && !matrix.variant }}
        run: |
          node ./.github/scripts/set-version.mjs ${{ inputs.app_version }}
      - name: Set app version when variant exists
        if: ${{ !matrix.android && matrix.variant }}
        run: |
          node ./.github/scripts/set-version.mjs ${{ inputs.app_version }}-${{ matrix.variant }}
      - name: Enable DevTools
        if: ${{ inputs.include_devtools }}
        run: |
          node ./.github/scripts/set-tauri-features.mjs devtools
          node ./.github/scripts/enable-sourcemap.mjs
      - name: Android - Set app version
        if: matrix.android
        run: |
          node ./.github/scripts/set-version.mjs ${{ inputs.app_version_android }}
      - name: Variant - win7
        if: matrix.variant == 'win7'
        run: |
          (Get-Content ./app/src-tauri/tauri.conf.json).Replace('downloadBootstrapper', 'embedBootstrapper') | Set-Content ./app/src-tauri/tauri.conf.json
          cat ./app/src-tauri/tauri.conf.json
      #endregion
      #region Build
      - name: Write BUILD_ENV to .env file
        if: matrix.variant != 'foss'
        run: |
          echo "${{ secrets.BUILD_ENV }}" > app/.env
      - name: Build
        run: |
          pnpm run ${{ matrix.android && inputs.task_build_android || inputs.task_build }}
        env:
          TAURI_BUILD_ARGS: ${{ matrix.args }}
          NDK_HOME: ${{ env.ANDROID_HOME }}/ndk/27.0.11902837
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
          TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}

      - name: MacOS - Rename app.tar.gz
        if: matrix.platform == 'macos-latest'
        run: |
          cd app/src-tauri/target/*/release/bundle/macos
          mv *.app.tar.gz "Project Graph_${{ inputs.app_version }}_universal.app.tar.gz"
          mv *.app.tar.gz.sig "Project Graph_${{ inputs.app_version }}_universal.app.tar.gz.sig"
      - name: Linux - Rename rpm
        if: matrix.platform == 'ubuntu-22.04'
        run: |
          cd app/src-tauri/target/release/bundle/rpm
          mv *.rpm "Project Graph_${{ inputs.app_version }}_amd64.rpm"
      - name: Linux / MacOS - Upload
        if: matrix.platform != 'windows-latest'
        run: |
          gh release upload ${{ inputs.release_tag }} app/${{ matrix.dist }} --clobber
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
      - name: Windows - Upload
        if: matrix.platform == 'windows-latest'
        run: |
          gh release upload ${{ inputs.release_tag }} (Get-Item .\app\${{ matrix.dist }}\*.exe).FullName --clobber
          gh release upload ${{ inputs.release_tag }} (Get-Item .\app\${{ matrix.dist }}\*.sig).FullName --clobber
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

      - id: sha256sum
        name: Linux - Calculate SHA256 hash for AUR package
        if: matrix.platform == 'ubuntu-22.04'
        run: |
          cd app/src-tauri/target/release/bundle/deb
          sha256sum ./*.deb | awk '{print $1}' > sha256sum.txt
          echo "hash=$(cat sha256sum.txt)" >> "$GITHUB_OUTPUT"
      #endregion

  # publish-tauri-linux-arm:
  #   runs-on: ubuntu-22.04
  #   needs: [create-release, build-frontend]
  #   permissions:
  #     contents: write

  #   strategy:
  #     matrix:
  #       arch: [aarch64]
  #       include:
  #         - arch: aarch64
  #           cpu: cortex-a72
  #           base_image: https://dietpi.com/downloads/images/DietPi_RPi5-ARMv8-Bookworm.img.xz
  #           deb: arm64
  #           rpm: aarch64
  #           appimage: aarch64
  #         # - arch: armv7l
  #         #   cpu: cortex-a53
  #         #   deb: armhfp
  #         #   rpm: arm
  #         #   appimage: armhf
  #         #   base_image: https://dietpi.com/downloads/images/DietPi_RPi-ARMv7-Bookworm.img.xz

  #   steps:
  #     - uses: actions/checkout@v3

  #     - name: Cache rust build artifacts
  #       uses: Swatinem/rust-cache@v2
  #       with:
  #         workspaces: src-tauri
  #         cache-on-failure: true

  #     - name: Build app
  #       uses: pguyot/arm-runner-action@v2.6.5
  #       with:
  #         base_image: ${{ matrix.base_image }}
  #         cpu: ${{ matrix.cpu }}
  #         bind_mount_repository: true
  #         image_additional_mb: 10240
  #         optimize_image: no
  #         #exit_on_fail: no
  #         commands: |
  #           # Prevent Rust from complaining about $HOME not matching eid home
  #           export HOME=/root

  #           # Workaround to CI worker being stuck on Updating crates.io index
  #           export CARGO_REGISTRIES_CRATES_IO_PROTOCOL=sparse

  #           # Install setup prerequisites
  #           apt-get update -y --allow-releaseinfo-change
  #           apt-get autoremove -y
  #           apt-get install -y --no-install-recommends --no-install-suggests curl libwebkit2gtk-4.1-dev build-essential libssl-dev libgtk-3-dev libayatana-appindicator3-dev librsvg2-dev patchelf libfuse2 file
  #           curl https://sh.rustup.rs -sSf | sh -s -- -y
  #           . "$HOME/.cargo/env"

  #           # Install Node.js
  #           curl -fsSL https://deb.nodesource.com/setup_lts.x | bash
  #           apt-get install -y nodejs

  #           # Install frontend dependencies
  #           npm i -g pnpm
  #           pnpm i

  #           # Build the application
  #           pnpm tauri:build

  #     - name: Upload
  #       run: |
  #         gh release upload ${{ inputs.release_tag }} app/src-tauri/target/release/bundle/*.{deb,rpm,AppImage} --clobber
  #       env:
  #         GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

  bump-aur-version:
    needs: publish-tauri
    runs-on: ubuntu-latest
    if: inputs.aur_package_name != ''
    steps:
      - uses: actions/checkout@v4
      - name: Setup Node
        uses: actions/setup-node@v4
        with:
          node-version: 24
      - name: Setup AUR private key
        run: |
          mkdir -p ~/.ssh
          echo "${{ secrets.AUR_SSH_PRIVATE_KEY }}" > ~/.ssh/id_${{ inputs.aur_key_algorithm }}
          chmod 600 ~/.ssh/id_${{ inputs.aur_key_algorithm }}
          ssh-keyscan -t "${{ inputs.aur_key_algorithm }}" aur.archlinux.org >> ~/.ssh/known_hosts
      - name: Clone AUR repository
        run: git clone ssh://aur@aur.archlinux.org/${{ inputs.aur_package_name }}.git ./aurpackage
      - name: Update version in PKGBUILD and .SRCINFO
        env:
          repo: ${{ github.repository }}
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          cd aurpackage
          node ../.github/scripts/generate-pkgbuild.mjs ${{ inputs.aur_package_name }} ${{ inputs.aur_version }} ${{ needs.publish-tauri.outputs.hash }}
      - name: Commit and push changes
        run: |
          cd aurpackage
          git config user.name "github-actions[bot]"
          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
          git add PKGBUILD .SRCINFO
          git commit -m "Bump version to ${{ inputs.app_version }}"
          git push origin master