release.yaml

name: "Aurus Release Build"

on:
  push:
    tags:
      - "v*"

jobs:
  create-release:
    permissions:
      contents: write
    runs-on: ubuntu-22.04
    outputs:
      release_id: ${{ steps.create-release.outputs.result }}

    steps:
      - uses: actions/checkout@v4

      - name: Get version from tag
        id: get_version
        run: echo "VERSION=${GITHUB_REF#refs/tags/v}" >> $GITHUB_OUTPUT

      - name: Create Release
        id: create-release
        uses: actions/github-script@v7
        with:
          script: |
            const { data } = await github.rest.repos.createRelease({
              owner: context.repo.owner,
              repo: context.repo.repo,
              tag_name: `v${{ steps.get_version.outputs.VERSION }}`,
              name: `Aurus Voice Intelligence v${{ steps.get_version.outputs.VERSION }}`,
              body: `## What's New in v${{ steps.get_version.outputs.VERSION }}

            ### Cross-Device Sync
            - **Ephemeral P2P Sync** — CRDT-based real-time sync via WebRTC
            - **Local Network Discovery** — mDNS + SPAKE2 pairing
            - **Cross-Network Relay** — signaling server for remote sync
            - **End-to-End Encryption** — ring crypto with forward secrecy
            - **Sync UI** — pairing modal, status badge, auto-sync

            ### Mobile Support
            - iOS build support with platform-gated features
            - Android project scaffolding
            - Offline Whisper transcription fallback

            ### Security
            - Security audit remediation — 32 findings across 5 severity phases
            - CSP hardening for Tauri IPC protocol
            - Heartbeat, timeout, and forward secrecy for sync

            ### AI Agents
            - **Action Items** - Extract tasks and deadlines from voice notes
            - **Tone Shifter** - Rewrite text in 8 different tones
            - **Music Matcher** - Find music matching your mood

            ### Features
            - Real-time voice transcription via Deepgram Nova-2
            - Voice Activity Detection with visual feedback
            - Spotlight-style interface (Cmd+Shift+V)
            - Secure API key storage in OS keychain
            - No external data storage — everything stays local

            ### Downloads
            Choose the installer for your platform below.

            ---
            *Built with Tauri v2 + Next.js 14*`,
              draft: true,
              prerelease: false
            })
            return data.id

  build-tauri:
    needs: create-release
    permissions:
      contents: write
    strategy:
      fail-fast: false
      matrix:
        include:
          # Use macos-15-intel for reliable cross-compilation to both architectures
          - platform: macos-15-intel
            args: --target aarch64-apple-darwin
          - platform: macos-15-intel
            args: --target x86_64-apple-darwin
          - platform: ubuntu-22.04
            args: ""
          - platform: windows-latest
            args: ""

    runs-on: ${{ matrix.platform }}

    steps:
      - uses: actions/checkout@v4

      - name: Setup Node
        uses: actions/setup-node@v4
        with:
          node-version: 20

      - name: Install pnpm
        uses: pnpm/action-setup@v4
        with:
          version: 10

      - name: Install Rust stable
        uses: dtolnay/rust-toolchain@stable
        with:
          targets: ${{ matrix.platform == 'macos-15-intel' && 'aarch64-apple-darwin,x86_64-apple-darwin' || '' }}

      - name: Install dependencies (Ubuntu)
        if: matrix.platform == 'ubuntu-22.04'
        run: |
          sudo apt-get update
          sudo apt-get install -y libgtk-3-dev libwebkit2gtk-4.1-dev libappindicator3-dev librsvg2-dev patchelf libasound2-dev

      - name: Install frontend dependencies
        run: pnpm install

      - name: Build Tauri app
        uses: tauri-apps/tauri-action@v0
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        with:
          releaseId: ${{ needs.create-release.outputs.release_id }}
          args: ${{ matrix.args }}

  publish-release:
    needs: [create-release, build-tauri]
    permissions:
      contents: write
    runs-on: ubuntu-22.04

    steps:
      - name: Publish Release
        uses: actions/github-script@v7
        with:
          script: |
            await github.rest.repos.updateRelease({
              owner: context.repo.owner,
              repo: context.repo.repo,
              release_id: ${{ needs.create-release.outputs.release_id }},
              draft: false
            })