release.yml

name: Release

on:
  push:
    tags:
      - 'v*.*.*'
      
permissions:
  contents: write

jobs:
  release:
    name: Create Release
    strategy:
      matrix:
        os: [macos-latest, ubuntu-latest, windows-latest]
    runs-on: ${{ matrix.os }}
    
    steps:
    - name: Checkout code
      uses: actions/checkout@v6
      
    - name: Setup Node.js
      uses: actions/setup-node@v6
      with:
        node-version: '20.x'
        cache: 'npm'
        
    - name: Install dependencies
      run: npm ci
      
    - name: Install system dependencies (Linux)
      if: matrix.os == 'ubuntu-latest'
      run: |
        sudo apt-get update
        sudo apt-get install -y libnss3-dev libatk-bridge2.0-dev libdrm2 libgtk-3-dev libgbm-dev
        
    - name: Cache Electron binaries
      uses: actions/cache@v5
      with:
        path: ~/.cache/electron
        key: ${{ matrix.os }}-electron-${{ hashFiles('package-lock.json') }}
        restore-keys: |
          ${{ matrix.os }}-electron-
        
    - name: Build Next.js app
      run: npm run build

    - name: Import macOS signing certificate
      if: matrix.os == 'macos-latest'
      env:
        MACOS_CERTIFICATE: ${{ secrets.CSC_LINK }}
        MACOS_CERTIFICATE_PWD: ${{ secrets.CSC_KEY_PASSWORD }}
      run: |
        echo "$MACOS_CERTIFICATE" | base64 --decode > certificate.p12
        security create-keychain -p actions build.keychain
        security default-keychain -s build.keychain
        security unlock-keychain -p actions build.keychain
        security import certificate.p12 -k build.keychain -P "$MACOS_CERTIFICATE_PWD" -T /usr/bin/codesign
        security set-key-partition-list -S apple-tool:,apple:,codesign: -s -k actions build.keychain
        rm certificate.p12

    - name: Build and publish Electron app (with retry)
      uses: nick-fields/retry@v4
      with:
        timeout_minutes: 15
        max_attempts: 3
        retry_wait_seconds: 60
        command: npm run dist
      env:
        GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        # NOTARIZE_*-prefixed (not APPLE_*) so electron-builder doesn't fire its
        # own buggy notarize wrapper; scripts/notarize.js reads these instead.
        NOTARIZE_APPLE_ID: ${{ secrets.APPLE_ID }}
        NOTARIZE_APPLE_PASSWORD: ${{ secrets.APPLE_APP_SPECIFIC_PASSWORD }}
        NOTARIZE_APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
        
    - name: Upload release assets
      uses: softprops/action-gh-release@v3
      if: startsWith(github.ref, 'refs/tags/')
      with:
        files: |
          dist/*.exe
          dist/*.dmg
          dist/*.zip
          dist/*.AppImage
          dist/*.deb
          dist/*.rpm
          dist/*.blockmap
          dist/latest*.yml
        generate_release_notes: true
        draft: false
        prerelease: false
      env:
        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}