build-release.yml

name: Build Release

permissions:
  contents: write
  actions: write

on:
  release:
    types: [created]
  workflow_dispatch:
    inputs:
      release_url:
        description: 'Release upload URL'
        required: true
      version:
        description: 'Version tag'
        required: true

jobs:
  build-macos:
    name: Build macOS
    runs-on: macos-latest
    environment: Prod
    steps:
      - uses: actions/checkout@v4
        with:
          ref: ${{ github.event.release.tag_name || inputs.version }}
          fetch-depth: 0
      
      - name: Set up Node.js
        uses: actions/setup-node@v4
        with:
          node-version: 'lts/*'

      - name: Set up Go
        uses: actions/setup-go@v4
        with:
          go-version: '1.23'
          cache: true
        
      - name: Install Task
        uses: arduino/setup-task@v2
        with:
          version: 3.x
          repo-token: ${{ secrets.GITHUB_TOKEN }}

      - name: Setup Wails Dependencies
        run: |
          mkdir -p ../github
          cd ../github
          git clone https://github.com/ansxuman/wails.git
          cd wails
          git checkout start_on_login
          cd v3/cmd/wails3
          go install
          cd ../../../..

      - name: Update go.mod
        run: |
          sed -i '' 's|=> ../wails/v3|=> ../github/wails/v3|g' go.mod

      - name: Import Code-Signing Certificates
        uses: Apple-Actions/import-codesign-certs@v3
        with:
          p12-file-base64: ${{ secrets.APPLE_DEVELOPER_CERTIFICATE_P12_BASE64 }}
          p12-password: ${{ secrets.APPLE_DEVELOPER_CERTIFICATE_PASSWORD }}

      - name: Build and Sign Release Binaries
        run: |
          mkdir -p darwinBinaries
          wails3 doctor

          # Update build assets
          wails3 task common:update:build-assets

          # Build the app package
          task darwin:package:universal
          
          # Store signing identity and version in variables
          SIGN_IDENTITY="${{ secrets.APPLE_SIGNING_IDENTITY }}"
          VERSION="${{ github.event.release.tag_name || inputs.version }}"
          
          echo "Using version: $VERSION"
          
          # Sign the binary
          codesign --deep --force --verbose --options=runtime --sign "$SIGN_IDENTITY" bin/Clave.app/Contents/MacOS/Clave
          
          # Sign the app bundle
          codesign --deep --force --verbose --options=runtime --sign "$SIGN_IDENTITY" bin/Clave.app
          
          # Create DMG
          npm install --global create-dmg
          cd bin
          create-dmg Clave.app --dmg-title "Clave-${VERSION}"
          
          # Process and sign DMG
          # Move any .dmg file found to darwinBinaries with the correct name
          for dmg in *.dmg; do
            mv "$dmg" "../darwinBinaries/Clave-${VERSION}-universal.dmg"
            break
          done
          
          echo "universalDMGPath=darwinBinaries/Clave-${VERSION}-universal.dmg" >> $GITHUB_ENV
          
          cd ..
          ls -alh darwinBinaries

      - name: Notarize Release Binaries
        run: |
          xcrun notarytool submit ${{ env.universalDMGPath }} --apple-id ${{ secrets.MACOS_SIGNING_GON_USERNAME }} --team-id ${{secrets.APPLE_DEVELOPER_TEAM_ID}} --password ${{ secrets.MACOS_SIGNING_GON_APPLICATION_PASSWORD }} --verbose --wait 
          xcrun stapler staple ${{ env.universalDMGPath }}

      - name: Upload Release Asset
        uses: actions/upload-release-asset@v1
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        with:
          upload_url: ${{ github.event_name == 'workflow_dispatch' && inputs.release_url || github.event.release.upload_url }}
          asset_path: ${{ env.universalDMGPath }}
          asset_name: Clave-${{ github.event.release.tag_name || inputs.version }}-universal.dmg
          asset_content_type: application/x-apple-diskimage

  build-windows:
    name: Build Windows
    runs-on: windows-latest
    steps:
      - uses: actions/checkout@v4
        with:
          ref: ${{ github.event.release.tag_name || inputs.version }}
      
      - name: Set up Node.js
        uses: actions/setup-node@v4
        with:
          node-version: 'lts/*'

      - name: Set up Go
        uses: actions/setup-go@v4
        with:
          go-version: '1.23'
          cache: true

      - name: Install Task
        uses: arduino/setup-task@v2
        with:
          version: 3.x
          repo-token: ${{ secrets.GITHUB_TOKEN }}

      - name: Setup Wails Dependencies
        shell: cmd
        run: |
          mkdir ..\github
          cd ..\github
          git clone https://github.com/ansxuman/wails.git
          cd wails
          git checkout start_on_login
          cd v3\cmd\wails3
          go install
          cd ..\..\..\..

      - name: Update go.mod
        shell: pwsh
        run: |
          (Get-Content go.mod) -replace 'replace.*=> ../wails/v3', 'replace github.com/wailsapp/wails/v3 => ../github/wails/v3' | Set-Content go.mod

      - name: Build Release Binaries
        shell: pwsh
        run: |
          mkdir windowsBinaries
          wails3 doctor

          # Update build assets
          wails3 task common:update:build-assets

          # Build the app package
          task package

          $VERSION="${{ github.event.release.tag_name || inputs.version }}"
          Move-Item -Path "bin\Clave-amd64-installer.exe" -Destination "windowsBinaries\Clave-Setup-${VERSION}-x64.exe"
          echo "WINDOWS_INSTALLER_PATH=windowsBinaries/Clave-Setup-${VERSION}-x64.exe" >> $env:GITHUB_ENV

      - name: Upload Release Asset
        uses: actions/upload-release-asset@v1
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        with:
          upload_url: ${{ github.event_name == 'workflow_dispatch' && inputs.release_url || github.event.release.upload_url }}
          asset_path: ${{ env.WINDOWS_INSTALLER_PATH }}
          asset_name: Clave-Setup-${{ github.event.release.tag_name || inputs.version }}-x64.exe
          asset_content_type: application/vnd.microsoft.portable-executable

  build-linux:
    name: Build Linux
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          ref: ${{ github.event.release.tag_name || inputs.version }}
      
      - name: Set up Node.js
        uses: actions/setup-node@v4
        with:
          node-version: 'lts/*'

      - name: Set up Go
        uses: actions/setup-go@v4
        with:
          go-version: '1.23'
          cache: true

      - name: Install Task
        uses: arduino/setup-task@v2
        with:
          version: 3.x
          repo-token: ${{ secrets.GITHUB_TOKEN }}
          
      - name: Install System Dependencies
        run: |
          sudo apt-get update
          sudo apt-get install -y libwebkit2gtk-4.1-dev gcc libgtk-3-dev pkg-config

      - name: Setup Wails Dependencies
        run: |
          mkdir -p ../github
          cd ../github
          git clone https://github.com/ansxuman/wails.git
          cd wails
          git checkout start_on_login
          cd v3/cmd/wails3
          go install
          cd ../../../..

      - name: Update go.mod
        run: |
          sed -i 's|=> ../wails/v3|=> ../github/wails/v3|g' go.mod

      - name: Build Release Binaries
        run: |
          mkdir -p linuxAppImage
          wails3 doctor

          # Update build assets
          wails3 task common:update:build-assets

          # Build the app package
          task package
          
          VERSION="${{ github.event.release.tag_name || inputs.version }}"
          mv bin/clave-x86_64.AppImage "linuxAppImage/clave_${VERSION}_amd64.AppImage"
          echo "LINUX_APP_PATH=linuxAppImage/clave_${VERSION}_amd64.AppImage" >> $GITHUB_ENV
          
          ls -alh linuxAppImage

      - name: Build deb using dpkg
        run: |
          VERSION="${{ github.event.release.tag_name || inputs.version }}"
          CLEAN_VERSION="${VERSION#v}"
          mkdir linuxDeb
          mkdir build_deb
          cd build_deb
          mkdir -p clave_${VERSION}_amd64/{DEBIAN,opt,usr,var}
          cat > clave_${VERSION}_amd64/DEBIAN/control <<- EOF
          Package: clave
          Version: $CLEAN_VERSION
          Section: net
          Priority: optional
          Architecture: amd64
          Maintainer: Clave <ansxuman@gmail.com>
          Description: A lightweight cross-platform desktop authenticator app.
          Depends: libwebkit2gtk-4.1-0, libwebkit2gtk-4.1-dev
          EOF

          mkdir -p clave_${VERSION}_amd64/usr/{bin,share}
          cp ../bin/Clave clave_${VERSION}_amd64/usr/bin/clave
          chmod +x clave_${VERSION}_amd64/usr/bin/clave
          mkdir clave_${VERSION}_amd64/usr/share/{applications,icons}
          cat > clave_${VERSION}_amd64/usr/share/applications/clave.desktop <<- EOF
          [Desktop Entry]
          Type=Application
          Name=Clave
          Exec=/usr/bin/clave
          Icon=/usr/share/icons/appicon.png
          Categories=Utility;
          Terminal=false
          EOF
          cp ../build/appicon.png clave_${VERSION}_amd64/usr/share/icons
          dpkg-deb --build clave_${VERSION}_amd64
          ls -alh
          mv *.deb ../linuxDeb/clave_${VERSION}_amd64.deb
          cd ..
          echo "LINUX_DEB_PATH=linuxDeb/clave_${VERSION}_amd64.deb" >> $GITHUB_ENV
          ls -alh linuxDeb/


      - name: Upload AppImage to Release
        uses: actions/upload-release-asset@v1
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        with:
          upload_url: ${{ github.event_name == 'workflow_dispatch' && inputs.release_url || github.event.release.upload_url }}
          asset_path: ${{ env.LINUX_APP_PATH }}
          asset_name: clave_${{ github.event.release.tag_name || inputs.version }}_amd64.AppImage
          asset_content_type: application/x-executable

      - name: Upload deb to Release
        uses: actions/upload-release-asset@v1
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        with:
          upload_url: ${{ github.event_name == 'workflow_dispatch' && inputs.release_url || github.event.release.upload_url }}
          asset_path: ${{ env.LINUX_DEB_PATH }}
          asset_name: clave_${{ github.event.release.tag_name || inputs.version }}_amd64.deb
          asset_content_type: application/x-debian-package