release.yml

name: release

on:
  push:
    tags:
      - "v*"

permissions:
  contents: write

env:
  NODE_VERSION: 22.19.0
  PNPM_VERSION: 11.13.0
  RUST_VERSION: 1.94.0

jobs:
  build:
    name: ${{ matrix.label }} bundle
    strategy:
      fail-fast: true
      matrix:
        include:
          - label: macOS-arm64
            os: macos-14
            bundles: dmg
          - label: Windows-x64
            os: windows-2022
            bundles: nsis
    runs-on: ${{ matrix.os }}
    timeout-minutes: 90
    # Apple signing secrets are hoisted to job level so steps can gate on them
    # with `env.* != ''`. Empty on forks without secrets → unsigned build.
    env:
      APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }}
      APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
      APPLE_SIGNING_IDENTITY: ${{ secrets.APPLE_SIGNING_IDENTITY }}
      APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
      APPLE_API_ISSUER: ${{ secrets.APPLE_API_ISSUER }}
      APPLE_API_KEY: ${{ secrets.APPLE_API_KEY_ID }}
      APPLE_API_KEY_P8_BASE64: ${{ secrets.APPLE_API_KEY_P8_BASE64 }}
    steps:
      - name: Check out source
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - name: Verify tag matches source versions
        shell: bash
        run: |
          set -euo pipefail
          tag_version="${GITHUB_REF_NAME#v}"
          pkg_version="$(node -p "require('./package.json').version")"
          conf_version="$(node -p "require('./src-tauri/tauri.conf.json').version")"
          cargo_version="$(sed -n 's/^version = "\(.*\)"$/\1/p' src-tauri/Cargo.toml | head -n 1)"
          for source_version in "$pkg_version" "$conf_version" "$cargo_version"; do
            if [[ "$tag_version" != "$source_version" ]]; then
              echo "Tag $GITHUB_REF_NAME does not match package.json=$pkg_version tauri.conf.json=$conf_version Cargo.toml=$cargo_version" >&2
              exit 1
            fi
          done
      - name: Set up Node.js
        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version: ${{ env.NODE_VERSION }}
      - name: Install pinned toolchains and dependencies
        shell: bash
        run: |
          set -euo pipefail
          npm install --global "pnpm@${PNPM_VERSION}"
          rustup toolchain install "${RUST_VERSION}" --profile minimal
          rustup default "${RUST_VERSION}"
          pnpm install --frozen-lockfile
      - name: Stage Apple notary key
        if: matrix.label == 'macOS-arm64' && env.APPLE_API_KEY_P8_BASE64 != ''
        shell: bash
        run: |
          set -euo pipefail
          printf '%s' "$APPLE_API_KEY_P8_BASE64" | base64 --decode > "$RUNNER_TEMP/notary.p8"
          echo "APPLE_API_KEY_PATH=$RUNNER_TEMP/notary.p8" >> "$GITHUB_ENV"
      - name: Build bundles
        shell: bash
        # Windows ships NSIS only: the WiX/MSI path needs light.exe, which the
        # hosted runner cannot link reliably and which no signed release depends
        # on. macOS ships the DMG. When the APPLE_* secrets are present (job env)
        # Tauri Developer ID signs and notarizes the macOS bundle; with no
        # secrets (forks) it builds unsigned and users verify by SHA-256. Windows
        # stays unsigned until a code-signing certificate is configured.
        run: pnpm tauri build --ci --bundles ${{ matrix.bundles }}
      - name: Notarize and staple the DMG
        if: matrix.label == 'macOS-arm64' && env.APPLE_API_KEY_PATH != ''
        shell: bash
        run: |
          set -euo pipefail
          dmg="$(find src-tauri/target/release/bundle/dmg -maxdepth 1 -name '*.dmg' -print -quit)"
          [[ -n "$dmg" ]] || { echo "No dmg to notarize" >&2; exit 1; }
          # Tauri already notarizes and staples the .app; also notarize and
          # staple the DMG so the download itself is offline-verifiable.
          xcrun notarytool submit "$dmg" --key "$APPLE_API_KEY_PATH" \
            --key-id "$APPLE_API_KEY" --issuer "$APPLE_API_ISSUER" --wait --timeout 20m
          xcrun stapler staple "$dmg"
          xcrun stapler validate "$dmg"
      - name: Collect and checksum artifacts
        shell: bash
        run: |
          set -euo pipefail
          version="${GITHUB_REF_NAME#v}"
          mkdir -p out
          bundle_dir="src-tauri/target/release/bundle"
          case "${{ matrix.label }}" in
            macOS-arm64)
              dmg="$(find "$bundle_dir/dmg" -maxdepth 1 -name '*.dmg' -print -quit)"
              [[ -n "$dmg" ]] || { echo "No dmg produced" >&2; exit 1; }
              cp "$dmg" "out/codecli-community-${version}-macos-arm64.dmg"
              ;;
            Windows-x64)
              setup="$(find "$bundle_dir/nsis" -maxdepth 1 -name '*.exe' -print -quit)"
              [[ -n "$setup" ]] || { echo "No nsis setup produced" >&2; exit 1; }
              cp "$setup" "out/codecli-community-${version}-windows-x64-setup.exe"
              ;;
          esac
          cd out
          if command -v sha256sum >/dev/null 2>&1; then
            sha256sum -- * > "checksums-${{ matrix.label }}.sha256"
          else
            shasum -a 256 -- * > "checksums-${{ matrix.label }}.sha256"
          fi
          cat "checksums-${{ matrix.label }}.sha256"
      - name: Upload artifacts
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: bundles-${{ matrix.label }}
          path: out/*
          if-no-files-found: error
          retention-days: 14

  release:
    name: Draft GitHub release
    needs: build
    runs-on: ubuntu-24.04
    timeout-minutes: 15
    steps:
      - name: Download artifacts
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          path: artifacts
          merge-multiple: true
      - name: Assemble checksums and release notes
        shell: bash
        run: |
          set -euo pipefail
          cd artifacts
          cat checksums-*.sha256 | sort -k2 > SHA256SUMS.txt
          rm -f checksums-*.sha256
          ls -l
          {
            echo "## 校验与安装说明"
            echo
            echo "- 本发布物由 GitHub Actions 从本仓库标签源码构建。"
            echo "- **macOS**：Apple Developer ID 签名并经 Apple 公证（notarized + stapled），"
            echo "  正常双击打开，无「未知开发者」提示。"
            echo "- **Windows**：当前**未做代码签名**，SmartScreen 提示时点「更多信息 → 仍要运行」。"
            echo "- 下载后请先用 \`SHA256SUMS.txt\` 核对哈希，再运行安装包。"
            echo "- 源码与构建日志见本次 release 关联的 Actions run。"
          } > NOTES.md
      - name: Create draft release
        shell: bash
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          set -euo pipefail
          gh release create "$GITHUB_REF_NAME" \
            --repo "$GITHUB_REPOSITORY" \
            --draft \
            --verify-tag \
            --title "CodeCLI Community $GITHUB_REF_NAME" \
            --notes-file artifacts/NOTES.md \
            artifacts/codecli-community-* artifacts/SHA256SUMS.txt