release.yml

name: Release

on:
  push:
    tags: ['v*']

permissions:
  contents: write

env:
  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true

jobs:
  create-release:
    permissions:
      contents: write
    runs-on: ubuntu-latest
    outputs:
      release_id: ${{ steps.create.outputs.release_id }}
    steps:
      - uses: actions/checkout@v4
        with:
          submodules: recursive
      - name: Create draft release
        id: create
        env:
          GITHUB_TOKEN: ${{ secrets.RELEASE_TOKEN || secrets.GITHUB_TOKEN }}
        run: |
          RESPONSE=$(gh api \
            --method POST \
            -H "Accept: application/vnd.github+json" \
            /repos/${{ github.repository }}/releases \
            -f tag_name="${{ github.ref_name }}" \
            -f name="PearTree ${{ github.ref_name }}" \
            -f body="See the assets below to download PearTree for your platform." \
            -F draft=true \
            -F prerelease=false)
          echo "release_id=$(echo $RESPONSE | jq -r .id)" >> $GITHUB_OUTPUT

  build:
    needs: create-release
    permissions:
      contents: write
    strategy:
      fail-fast: false
      matrix:
        include:
          - platform: macos-latest
            args: '--target universal-apple-darwin'
          - platform: ubuntu-22.04
            args: ''
          - platform: windows-latest
            args: ''

    runs-on: ${{ matrix.platform }}
    steps:
      - uses: actions/checkout@v4
        with:
          submodules: recursive

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: 20

      - name: Install Rust stable
        uses: dtolnay/rust-toolchain@stable
        with:
          targets: ${{ matrix.platform == 'macos-latest' && 'aarch64-apple-darwin,x86_64-apple-darwin' || '' }}

      - name: Install Linux dependencies
        if: matrix.platform == 'ubuntu-22.04'
        run: |
          sudo apt-get update
          sudo apt-get install -y libwebkit2gtk-4.1-dev libappindicator3-dev librsvg2-dev patchelf

      - name: Install WiX toolset (Windows)
        if: matrix.platform == 'windows-latest'
        run: |
          Invoke-WebRequest -Uri https://github.com/wixtoolset/wix3/releases/download/wix3141rtm/wix314-binaries.zip -OutFile wix314.zip
          Expand-Archive wix314.zip -DestinationPath "$env:USERPROFILE\wix314"
          echo "$env:USERPROFILE\wix314" | Out-File -FilePath $env:GITHUB_PATH -Encoding utf8 -Append
        shell: pwsh

      - name: Install Node dependencies
        run: npm install

      - name: Set version from tag
        run: node scripts/set-version.js ${{ github.ref_name }}

      - name: Build and upload
        uses: tauri-apps/tauri-action@v0
        env:
          GITHUB_TOKEN: ${{ secrets.RELEASE_TOKEN || secrets.GITHUB_TOKEN }}
          # macOS code signing & notarization – set these secrets in GitHub repo settings.
          # Without them the macOS build will still succeed but will be unsigned.
          APPLE_CERTIFICATE: ${{ secrets.PROD_MACOS_CERTIFICATE }}
          APPLE_CERTIFICATE_PASSWORD: ${{ secrets.PROD_MACOS_CERTIFICATE_PWD }}
          APPLE_ID: ${{ secrets.PROD_MACOS_NOTARIZATION_APPLE_ID }}
          APPLE_PASSWORD: ${{ secrets.PROD_MACOS_NOTARIZATION_PWD }}
          APPLE_TEAM_ID: ${{ secrets.PROD_MACOS_NOTARIZATION_TEAM_ID }}
          # Tauri updater signing – generate keys with: npx tauri signer generate
          # Add the private key + password as GitHub secrets.
          TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
          TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
          # Passed to Rust via option_env!() so the About box shows the full tag.
          PEARTREE_VERSION_TAG: ${{ github.ref_name }}
        with:
          releaseId: ${{ needs.create-release.outputs.release_id }}
          args: ${{ matrix.args }}

  patch-updater-json:
    # After all platform builds finish, add the darwin-universal key to latest.json.
    # Tauri builds the macOS universal binary but tauri-action writes architecture-specific
    # keys (darwin-aarch64 / darwin-x86_64).  The running universal app reports its platform
    # as "darwin-universal", so the updater fails unless that key exists.
    needs: [create-release, build]
    runs-on: ubuntu-latest
    permissions:
      contents: write
    steps:
      - name: Patch darwin-universal into latest.json
        env:
          GITHUB_TOKEN: ${{ secrets.RELEASE_TOKEN || secrets.GITHUB_TOKEN }}
          RELEASE_ID: ${{ needs.create-release.outputs.release_id }}
        run: |
          # Find the latest.json asset that tauri-action uploaded
          ASSET_ID=$(gh api \
            /repos/${{ github.repository }}/releases/${RELEASE_ID}/assets \
            --jq '.[] | select(.name == "latest.json") | .id')

          # Download it (auth required for draft releases)
          curl -sSfL \
            -H "Authorization: Bearer ${GITHUB_TOKEN}" \
            -H "Accept: application/octet-stream" \
            "https://api.github.com/repos/${{ github.repository }}/releases/assets/${ASSET_ID}" \
            -o latest.json

          # Add darwin-universal (same as darwin-aarch64 – both install the universal binary)
          jq '.platforms["darwin-universal"] = .platforms["darwin-aarch64"]' \
            latest.json > latest_patched.json

          # Replace the asset
          gh api --method DELETE \
            /repos/${{ github.repository }}/releases/assets/${ASSET_ID}

          curl -sSfL \
            -X POST \
            -H "Authorization: Bearer ${GITHUB_TOKEN}" \
            -H "Content-Type: application/octet-stream" \
            --data-binary @latest_patched.json \
            "https://uploads.github.com/repos/${{ github.repository }}/releases/${RELEASE_ID}/assets?name=latest.json"

  bundle-embed:
    needs: create-release
    runs-on: ubuntu-latest
    permissions:
      contents: write
    steps:
      - uses: actions/checkout@v4
        with:
          submodules: recursive
          ref: main
          fetch-depth: 0

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: 20

      - name: Install Node dependencies
        run: npm install

      - name: Set version from tag
        run: node scripts/set-version.js ${{ github.ref_name }}

      - name: Build single-file bundle
        env:
          PEARTREE_VERSION_TAG: ${{ github.ref_name }}
        run: npm run bundle

      - name: Upload bundle to release
        env:
          GITHUB_TOKEN: ${{ secrets.RELEASE_TOKEN || secrets.GITHUB_TOKEN }}
          RELEASE_ID: ${{ needs.create-release.outputs.release_id }}
        run: |
          curl -sSfL \
            -X POST \
            -H "Authorization: Bearer ${GITHUB_TOKEN}" \
            -H "Content-Type: application/octet-stream" \
            --data-binary @dist/peartree.bundle.min.js \
            "https://uploads.github.com/repos/${{ github.repository }}/releases/${RELEASE_ID}/assets?name=peartree.bundle.min.js"

      - name: Assemble webapp
        run: |
          mkdir -p webapp/data webapp/img webapp/logo
          cp peartree/index.html                webapp/index.html
          cp dist/peartree.bundle.min.js        webapp/peartree.bundle.min.js
          cp peartree/img/peartree.svg          webapp/img/peartree.svg
          cp peartree/img/peartree.png          webapp/img/peartree.png
          cp logo/peartree.svg                  webapp/logo/peartree.svg
          cp logo/peartree.png                  webapp/logo/peartree.png
          cp peartree/data/ebov.tree            webapp/data/ebov.tree
          cp peartree/data/VARV.tree            webapp/data/VARV.tree
          cp peartree/data/large_tree.tree      webapp/data/large_tree.tree
          cp peartree/data/SARS-CoV-2_15K.tree  webapp/data/SARS-CoV-2_15K.tree
          cp peartree/data/ebov.csv             webapp/data/ebov.csv
          cp peartree/about.md                  webapp/about.md
          cp peartree/help.md                   webapp/help.md
          tar -czf peartree-webapp.tgz -C webapp .

      - name: Upload webapp tgz to release
        env:
          GITHUB_TOKEN: ${{ secrets.RELEASE_TOKEN || secrets.GITHUB_TOKEN }}
          RELEASE_ID: ${{ needs.create-release.outputs.release_id }}
        run: |
          curl -sSfL \
            -X POST \
            -H "Authorization: Bearer ${GITHUB_TOKEN}" \
            -H "Content-Type: application/gzip" \
            --data-binary @peartree-webapp.tgz \
            "https://uploads.github.com/repos/${{ github.repository }}/releases/${RELEASE_ID}/assets?name=peartree-webapp.tgz"