release.yml

name: Release

on:
  push:
    tags:
      - 'v*'
  workflow_dispatch:
    inputs:
      tag:
        description: Release tag to publish, for example v0.1.0
        required: true
        type: string

permissions:
  contents: write

concurrency:
  group: release-${{ github.ref_name || inputs.tag }}
  cancel-in-progress: false

jobs:
  release-windows:
    runs-on: [self-hosted, windows, switchify-signing]

    env:
      SWITCHIFY_SIGNING_MODE: certum-simplysign
      SWITCHIFY_CERTUM_CERT_THUMBPRINT: ${{ vars.CERTUM_CERT_THUMBPRINT }}
      SWITCHIFY_CERTUM_TIMESTAMP_URL: http://time.certum.pl

    steps:
      - name: Resolve release tag
        shell: powershell
        run: |
          $tag = '${{ github.ref_name }}'
          if ('${{ github.event_name }}' -eq 'workflow_dispatch') {
            $tag = '${{ inputs.tag }}'
          }
          if (-not $tag.StartsWith('v')) {
            throw "Release tag must start with v. Received: $tag"
          }
          "RELEASE_TAG=$tag" | Out-File -FilePath $env:GITHUB_ENV -Append

      - name: Checkout
        uses: actions/checkout@v6
        with:
          ref: ${{ github.event_name == 'workflow_dispatch' && inputs.tag || github.ref }}

      - name: Setup Node.js
        uses: actions/setup-node@v6
        with:
          node-version: 25
          cache: npm

      - name: Install dependencies
        run: npm ci

      - name: Typecheck
        run: npm run typecheck

      - name: Test
        run: npm test

      - name: Verify Certum signing certificate
        shell: powershell
        run: |
          $thumbprint = '${{ vars.CERTUM_CERT_THUMBPRINT }}' -replace '[^a-fA-F0-9]', ''
          if (-not $thumbprint) {
            throw 'CERTUM_CERT_THUMBPRINT repository variable is not set.'
          }

          $cert = Get-ChildItem Cert:\CurrentUser\My -CodeSigningCert |
            Where-Object { $_.Thumbprint -eq $thumbprint } |
            Select-Object -First 1

          if (-not $cert) {
            throw "Certum code-signing certificate $thumbprint was not found in Cert:\CurrentUser\My. Make sure SimplySign Desktop is logged in before running the release."
          }

          if (-not $cert.HasPrivateKey) {
            throw "Certum certificate $thumbprint is present but has no private key."
          }

          Write-Host "Using Certum signing certificate: $($cert.Subject)"

      - name: Build native cursor overlay helper
        run: npm run native:build-overlay

      - name: Smoke native cursor overlay helper
        run: npm run native:smoke-overlay

      - name: Package Windows installer
        run: npm run package:win

      - name: Verify release tag matches package version
        shell: powershell
        run: |
          $package = Get-Content package.json | ConvertFrom-Json
          $expectedTag = "v$($package.version)"
          if ($env:RELEASE_TAG -ne $expectedTag) {
            throw "Release tag $env:RELEASE_TAG does not match package.json version $expectedTag."
          }

      - name: Publish GitHub release
        shell: powershell
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          $assets = @(Get-ChildItem -Path dist -File | Select-Object -ExpandProperty FullName)
          if ($assets.Count -eq 0) {
            throw 'No release assets found in dist.'
          }

          $releaseExists = $true
          $ErrorActionPreference = 'Continue'
          gh release view $env:RELEASE_TAG 1>$null 2>$null
          $releaseViewExitCode = $LASTEXITCODE
          $ErrorActionPreference = 'Stop'
          if ($releaseViewExitCode -ne 0) {
            $releaseExists = $false
          }
          $global:LASTEXITCODE = 0

          if ($releaseExists) {
            gh release upload $env:RELEASE_TAG @assets --clobber
          } else {
            gh release create $env:RELEASE_TAG @assets --title $env:RELEASE_TAG --generate-notes
          }

      - name: Upload workflow artifacts
        uses: actions/upload-artifact@v7
        with:
          name: switchify-pc-windows-${{ env.RELEASE_TAG }}
          path: |
            dist/*
            !dist/win-unpacked/**
          if-no-files-found: error