release.yml

name: Release

# Build installers for every platform and publish them to a GitHub Release
# whenever a v* tag is pushed. Run manually (workflow_dispatch) to dry-build
# without publishing.
on:
  push:
    tags:
      - "v*"
  workflow_dispatch:

permissions:
  contents: write

jobs:
  build:
    name: Build (${{ matrix.os }})
    runs-on: ${{ matrix.os }}
    strategy:
      fail-fast: false
      matrix:
        include:
          - os: macos-latest
            args: --mac
          - os: windows-latest
            args: --win
          - os: ubuntu-latest
            args: --linux
    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-node@v4
        with:
          node-version: 20
          cache: npm

      # node-gyp (used to rebuild native node-pty) imports distutils, which was
      # removed in Python 3.12. Pin 3.11 and install setuptools so the distutils
      # shim is available across all runners.
      - uses: actions/setup-python@v5
        with:
          python-version: "3.11"

      - name: Provide distutils for node-gyp
        run: python -m pip install --upgrade setuptools

      - name: Install dependencies
        run: npm ci

      - name: Compile (electron-vite → out/)
        run: npm run build

      - name: Package installers
        # GH_TOKEN lets electron-builder skip its own publish; we upload via the
        # release step below for full control over the asset set.
        run: npx electron-builder ${{ matrix.args }} --publish never
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          # macOS code signing + notarization — MUST be macOS-only. CSC_LINK is the
          # Apple Developer ID .p12; if it leaks into the Windows/Linux runners,
          # electron-builder tries to sign those targets with the mac cert and the
          # build hard-fails ("cannot extract publisher name"). So gate on the OS.
          #   APPLE_CERTIFICATE_P12       = base64 of the "Developer ID Application" .p12
          #   APPLE_CERTIFICATE_PASSWORD  = that .p12's export password (REQUIRED if P12 set,
          #                                 else electron-builder imports with an empty
          #                                 password and fails "MAC verification failed")
          # All optional: with the secrets unset every runner builds unsigned and stays green.
          CSC_LINK: ${{ matrix.os == 'macos-latest' && secrets.APPLE_CERTIFICATE_P12 || '' }}
          CSC_KEY_PASSWORD: ${{ matrix.os == 'macos-latest' && secrets.APPLE_CERTIFICATE_PASSWORD || '' }}
          APPLE_ID: ${{ matrix.os == 'macos-latest' && secrets.APPLE_ID || '' }}
          APPLE_APP_SPECIFIC_PASSWORD: ${{ matrix.os == 'macos-latest' && secrets.APPLE_APP_SPECIFIC_PASSWORD || '' }}
          APPLE_TEAM_ID: ${{ matrix.os == 'macos-latest' && secrets.APPLE_TEAM_ID || '' }}

      - name: Generate checksums
        shell: bash
        run: |
          cd dist
          # hash only the distributable artifacts, not blockmaps/yml
          files=$(ls *.dmg *.exe *.AppImage 2>/dev/null || true)
          [ -z "$files" ] && { echo "no artifacts to hash"; exit 0; }
          if command -v sha256sum >/dev/null 2>&1; then
            sha256sum $files > "SHA256SUMS-${{ matrix.os }}.txt"
          else
            shasum -a 256 $files > "SHA256SUMS-${{ matrix.os }}.txt"
          fi
          cat "SHA256SUMS-${{ matrix.os }}.txt"

      - name: Upload build artifacts
        uses: actions/upload-artifact@v4
        with:
          name: ${{ matrix.os }}-dist
          path: |
            dist/*.dmg
            dist/*.exe
            dist/*.AppImage
            dist/SHA256SUMS-*.txt
          if-no-files-found: warn

  publish:
    name: Publish release
    needs: build
    if: startsWith(github.ref, 'refs/tags/')
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - uses: actions/download-artifact@v4
        with:
          path: artifacts

      - name: Flatten + merge checksums
        run: |
          mkdir -p release
          find artifacts -type f \( -name '*.dmg' -o -name '*.exe' -o -name '*.AppImage' \) -exec cp {} release/ \;
          cat artifacts/*/SHA256SUMS-*.txt > release/SHA256SUMS.txt 2>/dev/null || true
          ls -la release

      - name: Publish to GitHub Release
        uses: softprops/action-gh-release@v2
        with:
          # RELEASE.md is the human-facing notes; GitHub shows it as the body.
          body_path: RELEASE.md
          fail_on_unmatched_files: false
          files: |
            release/*.dmg
            release/*.exe
            release/*.AppImage
            release/SHA256SUMS.txt