release.yml

name: Release

on:
  push:
    tags:
      - 'v*'
  workflow_dispatch:

permissions:
  contents: write

jobs:
  build-macos:
    runs-on: macos-latest
    env:
      MACOS_TARGET: aarch64-apple-darwin
    steps:
      - uses: actions/checkout@v4

      - name: Install Rust stable
        uses: dtolnay/rust-install@master
        with:
          toolchain: stable

      - name: Rust cache
        uses: Swatinem/rust-cache@v2
        with:
          workspaces: src-tauri

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: 20
          cache: npm
          cache-dependency-path: ui/package-lock.json

      - name: Install frontend dependencies
        run: npm install --prefix ui

      - name: Install Tauri CLI
        run: cargo install tauri-cli --version "^2"

      - name: Import signing certificate
        env:
          APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }}
          APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
        run: |
          KEYCHAIN_PATH=$RUNNER_TEMP/app-signing.keychain-db
          KEYCHAIN_PASSWORD=$(openssl rand -base64 32)

          # Create temporary keychain
          security create-keychain -p "$KEYCHAIN_PASSWORD" "$KEYCHAIN_PATH"
          security set-keychain-settings -lut 21600 "$KEYCHAIN_PATH"
          security unlock-keychain -p "$KEYCHAIN_PASSWORD" "$KEYCHAIN_PATH"

          # Import certificate
          echo "$APPLE_CERTIFICATE" | base64 --decode > $RUNNER_TEMP/certificate.p12
          security import $RUNNER_TEMP/certificate.p12 \
            -P "$APPLE_CERTIFICATE_PASSWORD" \
            -A \
            -t cert \
            -f pkcs12 \
            -k "$KEYCHAIN_PATH"
          security set-key-partition-list -S apple-tool:,apple: -k "$KEYCHAIN_PASSWORD" "$KEYCHAIN_PATH"

          # Add to search list
          security list-keychain -d user -s "$KEYCHAIN_PATH" login.keychain-db

      - name: Write API key to file
        env:
          APPLE_API_PRIVATE_KEY: ${{ secrets.APPLE_API_PRIVATE_KEY }}
        run: |
          echo "$APPLE_API_PRIVATE_KEY" > $RUNNER_TEMP/AuthKey.p8

      - name: Download MCP sidecar binary
        run: |
          VERSION=$(cat NATIVE_DEVTOOLS_VERSION)
          ARCHIVE="native-devtools-mcp-aarch64-apple-darwin.tar.gz"
          URL="https://github.com/anthropics/native-devtools-mcp/releases/download/v${VERSION}/${ARCHIVE}"
          mkdir -p src-tauri/binaries
          curl -fSL -o "/tmp/${ARCHIVE}" "$URL"

          # Verify checksum if available
          EXPECTED=$(grep "${ARCHIVE}" checksums.txt | awk '{print $1}' || true)
          if [ -n "$EXPECTED" ]; then
            ACTUAL=$(shasum -a 256 "/tmp/${ARCHIVE}" | awk '{print $1}')
            if [ "$ACTUAL" != "$EXPECTED" ]; then
              echo "Checksum mismatch for ${ARCHIVE}"
              exit 1
            fi
          fi

          tar -xzf "/tmp/${ARCHIVE}" -C src-tauri/binaries
          mv src-tauri/binaries/native-devtools-mcp src-tauri/binaries/native-devtools-mcp-aarch64-apple-darwin
          chmod +x src-tauri/binaries/native-devtools-mcp-aarch64-apple-darwin

      - name: Build signed + notarized DMG
        env:
          APPLE_SIGNING_IDENTITY: ${{ secrets.APPLE_SIGNING_IDENTITY }}
          APPLE_API_KEY_PATH: ${{ runner.temp }}/AuthKey.p8
          APPLE_API_KEY: ${{ secrets.APPLE_API_KEY_ID }}
          APPLE_API_ISSUER: ${{ secrets.APPLE_API_ISSUER }}
        run: cargo tauri build --target ${{ env.MACOS_TARGET }}

      - name: Notarize DMG
        env:
          APPLE_API_KEY_PATH: ${{ runner.temp }}/AuthKey.p8
          APPLE_API_KEY_ID: ${{ secrets.APPLE_API_KEY_ID }}
          APPLE_API_ISSUER: ${{ secrets.APPLE_API_ISSUER }}
        run: |
          DMG=$(find target/${{ env.MACOS_TARGET }}/release/bundle/dmg -name '*.dmg' -type f | head -1)
          xcrun notarytool submit "$DMG" \
            --key "$APPLE_API_KEY_PATH" \
            --key-id "$APPLE_API_KEY_ID" \
            --issuer "$APPLE_API_ISSUER" \
            --wait
          xcrun stapler staple "$DMG"

      - name: Prepare release artifacts
        id: artifacts
        run: |
          DMG=$(find target/${{ env.MACOS_TARGET }}/release/bundle/dmg -name '*.dmg' -type f | head -1)
          DMG_NAME=$(basename "$DMG")
          shasum -a 256 "$DMG" > "${DMG}.sha256"
          echo "dmg=$DMG" >> "$GITHUB_OUTPUT"
          echo "dmg_name=$DMG_NAME" >> "$GITHUB_OUTPUT"
          echo "checksum=${DMG}.sha256" >> "$GITHUB_OUTPUT"

      - name: Create GitHub Release
        if: startsWith(github.ref, 'refs/tags/')
        uses: softprops/action-gh-release@v2
        with:
          draft: true
          generate_release_notes: true
          files: |
            ${{ steps.artifacts.outputs.dmg }}
            ${{ steps.artifacts.outputs.checksum }}

      - name: Upload artifacts (manual dispatch)
        if: github.event_name == 'workflow_dispatch'
        uses: actions/upload-artifact@v4
        with:
          name: clickweave-macos-dmg
          path: |
            ${{ steps.artifacts.outputs.dmg }}
            ${{ steps.artifacts.outputs.checksum }}

      - name: Cleanup keychain
        if: always()
        run: security delete-keychain $RUNNER_TEMP/app-signing.keychain-db || true

  build-windows:
    runs-on: windows-latest
    steps:
      - uses: actions/checkout@v4

      - name: Install Rust stable
        uses: dtolnay/rust-install@master
        with:
          toolchain: stable

      - name: Rust cache
        uses: Swatinem/rust-cache@v2
        with:
          workspaces: src-tauri

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: 20
          cache: npm
          cache-dependency-path: ui/package-lock.json

      - name: Install frontend dependencies
        run: npm install --prefix ui

      - name: Install Tauri CLI
        run: cargo install tauri-cli --version "^2"

      - name: Download MCP sidecar binary
        shell: bash
        run: |
          VERSION=$(cat NATIVE_DEVTOOLS_VERSION)
          ARCHIVE="native-devtools-mcp-x86_64-pc-windows-msvc.zip"
          URL="https://github.com/anthropics/native-devtools-mcp/releases/download/v${VERSION}/${ARCHIVE}"
          mkdir -p src-tauri/binaries
          curl -fSL -o "${TEMP}/${ARCHIVE}" "$URL"

          # Verify checksum if available
          EXPECTED=$(grep "${ARCHIVE}" checksums.txt | awk '{print $1}' || true)
          if [ -n "$EXPECTED" ]; then
            ACTUAL=$(sha256sum "${TEMP}/${ARCHIVE}" | awk '{print $1}')
            if [ "$ACTUAL" != "$EXPECTED" ]; then
              echo "Checksum mismatch for ${ARCHIVE}"
              exit 1
            fi
          fi

          unzip -o "${TEMP}/${ARCHIVE}" -d src-tauri/binaries
          mv src-tauri/binaries/native-devtools-mcp.exe src-tauri/binaries/native-devtools-mcp-x86_64-pc-windows-msvc.exe

      - name: Build NSIS installer
        run: cargo tauri build

      - name: Prepare release artifacts
        id: artifacts
        shell: bash
        run: |
          INSTALLER=$(find target/release/bundle/nsis -name '*.exe' -type f | head -1)
          INSTALLER_NAME=$(basename "$INSTALLER")
          sha256sum "$INSTALLER" > "${INSTALLER}.sha256"
          echo "installer=$INSTALLER" >> "$GITHUB_OUTPUT"
          echo "installer_name=$INSTALLER_NAME" >> "$GITHUB_OUTPUT"
          echo "checksum=${INSTALLER}.sha256" >> "$GITHUB_OUTPUT"

      - name: Create GitHub Release
        if: startsWith(github.ref, 'refs/tags/')
        uses: softprops/action-gh-release@v2
        with:
          draft: true
          generate_release_notes: true
          files: |
            ${{ steps.artifacts.outputs.installer }}
            ${{ steps.artifacts.outputs.checksum }}

      - name: Upload artifacts (manual dispatch)
        if: github.event_name == 'workflow_dispatch'
        uses: actions/upload-artifact@v4
        with:
          name: clickweave-windows-nsis
          path: |
            ${{ steps.artifacts.outputs.installer }}
            ${{ steps.artifacts.outputs.checksum }}