release.yml

name: Release

on:
  workflow_dispatch:

permissions:
  contents: write

jobs:
  build_macos:
    name: macOS unsigned bundles (${{ matrix.arch }})
    runs-on: ${{ matrix.runner }}
    strategy:
      fail-fast: false
      matrix:
        include:
          - runner: macos-15
            arch: aarch64
            deployment_target: "11.0"
          - runner: macos-15-intel
            arch: x64
            deployment_target: "10.15"
    env:
      MACOSX_DEPLOYMENT_TARGET: ${{ matrix.deployment_target }}
      CMAKE_OSX_DEPLOYMENT_TARGET: ${{ matrix.deployment_target }}
      CFLAGS: -mmacosx-version-min=${{ matrix.deployment_target }}
      CXXFLAGS: -mmacosx-version-min=${{ matrix.deployment_target }}
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - uses: actions/setup-node@v4
        with:
          node-version: 20
          cache: npm

      - uses: dtolnay/rust-toolchain@stable

      - uses: swatinem/rust-cache@v2
        with:
          workspaces: './src-tauri -> target'

      - name: Install dependencies
        run: |
          brew install cmake openssl@3
          npm ci

      - name: Build app bundle
        run: npm run tauri -- build --bundles app --config src-tauri/tauri.unsigned.conf.json

      - name: Build daemon binaries
        run: cargo build --release --bin codex_monitor_daemon --bin codex_monitor_daemonctl
        working-directory: src-tauri

      - name: Bundle OpenSSL and ad-hoc sign
        env:
          CODESIGN_IDENTITY: "-"
        run: scripts/macos-fix-openssl.sh

      - name: Package macOS artifacts
        run: |
          set -euo pipefail
          VERSION=$(node -p "require('./package.json').version")
          mkdir -p release-artifacts "release-dmg-root-${{ matrix.arch }}"

          ditto "src-tauri/target/release/bundle/macos/Codex Monitor.app" \
            "release-dmg-root-${{ matrix.arch }}/Codex Monitor.app"

          ditto -c -k --keepParent \
            "src-tauri/target/release/bundle/macos/Codex Monitor.app" \
            "release-artifacts/CodexMonitor_${VERSION}_${{ matrix.arch }}.zip"

          hdiutil create -volname "Codex Monitor" \
            -srcfolder "release-dmg-root-${{ matrix.arch }}" \
            -ov -format UDZO \
            "release-artifacts/CodexMonitor_${VERSION}_${{ matrix.arch }}.dmg"

          COPYFILE_DISABLE=1 tar -czf \
            "release-artifacts/CodexMonitor_${VERSION}_${{ matrix.arch }}.app.tar.gz" \
            -C src-tauri/target/release/bundle/macos "Codex Monitor.app"

      - name: Upload macOS artifacts
        uses: actions/upload-artifact@v4
        with:
          name: macos-artifacts-${{ matrix.arch }}
          path: |
            release-artifacts/*.zip
            release-artifacts/*.dmg
            release-artifacts/*.app.tar.gz

  build_linux:
    name: Linux unsigned bundles (${{ matrix.arch }})
    runs-on: ${{ matrix.runner }}
    strategy:
      fail-fast: false
      matrix:
        include:
          - runner: ubuntu-24.04
            arch: x86_64
          - runner: ubuntu-24.04-arm
            arch: aarch64
    steps:
      - uses: actions/checkout@v4

      - name: Install system dependencies
        run: |
          sudo apt-get update
          sudo apt-get install -y \
            cmake \
            libwebkit2gtk-4.1-dev \
            libgtk-3-dev \
            libayatana-appindicator3-dev \
            librsvg2-dev \
            patchelf \
            libfuse2 \
            xdg-utils \
            libasound2-dev \
            rpm \
            pkg-config

      - uses: actions/setup-node@v4
        with:
          node-version: 20
          cache: npm

      - uses: dtolnay/rust-toolchain@stable

      - uses: swatinem/rust-cache@v2
        with:
          workspaces: './src-tauri -> target'

      - name: Install dependencies
        run: npm ci

      - name: Build AppImage and RPM
        run: npm run tauri -- build --bundles appimage,rpm --config src-tauri/tauri.unsigned.conf.json

      - name: Upload Linux artifacts
        uses: actions/upload-artifact@v4
        with:
          name: linux-artifacts-${{ matrix.arch }}
          path: |
            src-tauri/target/release/bundle/appimage/*.AppImage
            src-tauri/target/release/bundle/rpm/*.rpm

  build_windows:
    name: Windows unsigned bundles
    runs-on: windows-latest
    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-node@v4
        with:
          node-version: 20
          cache: npm

      - uses: dtolnay/rust-toolchain@stable

      - uses: swatinem/rust-cache@v2
        with:
          workspaces: './src-tauri -> target'

      - name: Install LLVM for bindgen
        run: choco install llvm -y --no-progress

      - name: Configure LLVM for bindgen
        run: |
          echo "LIBCLANG_PATH=C:\Program Files\LLVM\bin" >> $env:GITHUB_ENV
          echo "C:\Program Files\LLVM\bin" >> $env:GITHUB_PATH

      - name: Install dependencies
        run: npm ci

      - name: Build Windows bundles
        run: npm run tauri -- build --config src-tauri/tauri.windows.unsigned.conf.json

      - name: Upload Windows artifacts
        uses: actions/upload-artifact@v4
        with:
          name: windows-artifacts
          path: |
            src-tauri/target/release/bundle/nsis/*.exe
            src-tauri/target/release/bundle/msi/*.msi

  release:
    name: Publish GitHub release
    runs-on: ubuntu-latest
    needs:
      - build_macos
      - build_linux
      - build_windows
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - uses: actions/download-artifact@v4
        with:
          path: release-artifacts
          merge-multiple: true

      - name: Normalize filenames and generate checksums
        run: |
          set -euo pipefail
          rm -rf release-upload
          mkdir -p release-upload

          while IFS= read -r -d '' artifact; do
            file=$(basename "$artifact")
            normalized="${file// /.}"
            target="release-upload/${normalized}"
            if [ -e "$target" ]; then
              echo "Duplicate release artifact filename after normalization: ${normalized}"
              exit 1
            fi
            cp "$artifact" "$target"
          done < <(find release-artifacts -type f -print0)

          find release-upload -maxdepth 1 -type f | sort
          (cd release-upload && sha256sum * > SHA256SUMS.txt)

      - name: Build release notes
        run: |
          set -euo pipefail
          VERSION=$(node -p "require('./package.json').version")
          LAST_TAG=$(git tag --sort=-version:refname | grep -v "^v${VERSION}$" | head -n 1 || true)
          if [ -n "$LAST_TAG" ]; then
            git log "${LAST_TAG}..${GITHUB_SHA}" --pretty=format:"%s" > release-upload/release-commits.txt
          else
            git log "${GITHUB_SHA}" --pretty=format:"%s" > release-upload/release-commits.txt
          fi

          {
            echo "Unsigned community build."
            echo
            echo "macOS and Windows artifacts are not notarized or code-signed with a paid certificate."
            echo
            echo "## Changes"
            sed 's/^/- /' release-upload/release-commits.txt
          } > release-upload/release-notes.md

      - name: Create GitHub release
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          set -euo pipefail
          VERSION=$(node -p "require('./package.json').version")
          mapfile -t artifacts < <(
            find release-upload -maxdepth 1 -type f \
              ! -name release-notes.md \
              ! -name release-commits.txt \
              | sort
          )
          gh release create "v${VERSION}" \
            --title "v${VERSION}" \
            --notes-file release-upload/release-notes.md \
            --target "$GITHUB_SHA" \
            "${artifacts[@]}"