release.yml

name: Publish Cross-Platform

on:
  push:
    tags:
      - "v*"
  workflow_dispatch:

env:
  VITE_REDIRECT_URL: ${{ secrets.VITE_REDIRECT_URL }}
  VITE_SUPABASE_URL: ${{ secrets.VITE_SUPABASE_URL }}
  VITE_SUPABASE_ANON_KEY: ${{ secrets.VITE_SUPABASE_ANON_KEY }}
  TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
  TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
  TAURI_BUNDLE: all

jobs:
  publish-tauri:
    permissions:
      contents: write
      packages: write
    strategy:
      fail-fast: false
      matrix:
        include:
          - platform: "macos-latest"
            args: ""
          - platform: "macos-latest"
            args: '--target x86_64-apple-darwin'
          - platform: "ubuntu-24.04"
            args: ""
          - platform: "ubuntu-22.04-arm"
            args: "--bundles deb"
          - platform: "windows-latest"
            args: ""
          - platform: "windows-latest"
            args: "--target aarch64-pc-windows-msvc"

    runs-on: ${{ matrix.platform }}
    env:
      APPLE_ID: ${{ secrets.APPLE_ID }}
      APPLE_PASSWORD: ${{ secrets.APPLE_PASSWORD }}
      APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
    steps:
      - uses: actions/checkout@v5

      - name: setup node
        uses: actions/setup-node@v6

      - name: Install Bun
        uses: oven-sh/setup-bun@v2

      - name: install Rust stable
        uses: dtolnay/rust-toolchain@stable
        with:
          # Those targets are only used on macos runners so it's in an `if` to slightly speed up windows and linux builds.
          targets: ${{ matrix.platform == 'macos-latest' && 'aarch64-apple-darwin,x86_64-apple-darwin' || matrix.platform == 'windows-latest' && 'x86_64-pc-windows-msvc,aarch64-pc-windows-msvc' || '' }}

      - name: Setup Rust cache
        uses: Swatinem/rust-cache@v2
        with:
          workspaces: "src-tauri"

      - name: Import Apple Developer Certificate
        if: runner.os == 'macOS'
        env:
          APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }}
          APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
          KEYCHAIN_PASSWORD: ${{ secrets.KEYCHAIN_PASSWORD }}
        run: |
          echo $APPLE_CERTIFICATE | base64 --decode > certificate.p12
          security create-keychain -p "$KEYCHAIN_PASSWORD" build.keychain
          security default-keychain -s build.keychain
          security unlock-keychain -p "$KEYCHAIN_PASSWORD" build.keychain
          security set-keychain-settings -t 3600 -u build.keychain
          security import certificate.p12 -k build.keychain -P "$APPLE_CERTIFICATE_PASSWORD" -T /usr/bin/codesign
          security set-key-partition-list -S apple-tool:,apple:,codesign: -s -k "$KEYCHAIN_PASSWORD" build.keychain
          security find-identity -v -p codesigning build.keychain
      - name: Verify Certificate
        if: runner.os == 'macOS'
        run: |
          CERT_INFO=$(security find-identity -v -p codesigning build.keychain | grep "Developer ID Application")
          CERT_ID=$(echo "$CERT_INFO" | awk -F'"' '{print $2}')
          echo "CERT_ID=$CERT_ID" >> $GITHUB_ENV
          echo "Certificate imported."

      - name: install dependencies (ubuntu only)
        if: runner.os == 'Linux'
        run: |
          sudo apt-get update
          sudo apt-get install -y libwebkit2gtk-4.1-dev libappindicator3-dev librsvg2-dev patchelf

      - name: install frontend dependencies
        run: bun install

      - name: Read Release Notes
        id: notes
        shell: bash
        run: |
          if [[ -f ./docs/RELEASE_NOTE.md ]]; then
            {
              echo 'body<<EOF'
              cat ./docs/RELEASE_NOTE.md
              printf '\nEOF\n'
            } >> "$GITHUB_OUTPUT"
          else
            echo "body=🚀 New release v__VERSION__" >> "$GITHUB_OUTPUT"
          fi

      - uses: tauri-apps/tauri-action@v0
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }}
          APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
          APPLE_SIGNING_IDENTITY: ${{ env.CERT_ID }}
        with:
          tagName: v__VERSION__ # the action automatically replaces \_\_VERSION\_\_ with the app version.
          releaseName: "v__VERSION__"
          releaseBody: ${{ steps.notes.outputs.body }}
          releaseDraft: false
          prerelease: false
          args: ${{ matrix.args }}

      - name: Clean up keychain
        if: runner.os == 'macOS'
        run: |
          security delete-keychain build.keychain
          rm -f certificate.p12

  update-homebrew:
    permissions:
      contents: write
    needs: publish-tauri
    runs-on: ubuntu-24.04
    if: startsWith(github.ref, 'refs/tags/')
    steps:
      - uses: actions/checkout@v5

      - name: Install jq
        run: sudo apt-get update && sudo apt-get install -y jq

      - name: Update Homebrew tap
        env:
          GITHUB_TOKEN: ${{ secrets.HOMEBREW_TAP_TOKEN }}
        run: |
          bash scripts/update-homebrew-tap.sh