release.yml

name: release

on:
  workflow_dispatch:
    inputs:
      tag_name:
        description: "Existing release tag to publish, for example v0.1.0"
        required: true
        type: string

permissions:
  contents: read

env:
  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"
  NODE_VERSION: "26"
  PNPM_VERSION: "11.13.1"

jobs:
  release:
    name: GoReleaser
    if: >-
      endsWith(github.workflow_ref, format('@refs/heads/{0}', github.event.repository.default_branch)) &&
      github.ref == format('refs/heads/{0}', github.event.repository.default_branch)
    runs-on: ubuntu-latest
    timeout-minutes: 30
    permissions:
      contents: write
    steps:
      - name: Check out
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          fetch-depth: 0
          persist-credentials: false
          ref: ${{ inputs.tag_name || github.ref }}

      - name: Set up Go
        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
        with:
          go-version-file: go.mod
          cache: true

      - name: Set up pnpm
        uses: pnpm/action-setup@008330803749db0355799c700092d9a85fd074e9 # v6.0.9
        with:
          version: ${{ env.PNPM_VERSION }}

      - name: Set up Node
        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version: ${{ env.NODE_VERSION }}
          cache: pnpm

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      - name: Run local gate
        run: pnpm check

      - name: Set web asset version
        run: echo "CLICKCLACK_WEB_VERSION=$(git rev-parse --short=12 HEAD)" >> "$GITHUB_ENV"

      - name: Run GoReleaser
        uses: goreleaser/goreleaser-action@f06c13b6b1a9625abc9e6e439d9c05a8f2190e94 # v7.2.3
        with:
          distribution: goreleaser
          version: "v2.17.0"
          args: release --clean
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

  desktop:
    name: ${{ matrix.name }}
    if: >-
      endsWith(github.workflow_ref, format('@refs/heads/{0}', github.event.repository.default_branch)) &&
      github.ref == format('refs/heads/{0}', github.event.repository.default_branch)
    strategy:
      fail-fast: false
      matrix:
        include:
          - name: Windows Desktop
            os: windows-latest
            platform: win
            builder_args: --win nsis zip --x64
            files: |
              apps/desktop/release/*.exe
              apps/desktop/release/*.zip
          - name: Linux Desktop
            os: ubuntu-latest
            platform: linux
            builder_args: --linux AppImage deb --x64
            files: |
              apps/desktop/release/*.AppImage
              apps/desktop/release/*.deb
    runs-on: ${{ matrix.os }}
    timeout-minutes: 30
    env:
      CSC_IDENTITY_AUTO_DISCOVERY: "false"
    steps:
      - name: Check out
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          persist-credentials: false
          ref: ${{ inputs.tag_name || github.ref }}

      - name: Resolve release version
        id: release
        shell: bash
        env:
          RELEASE_TAG: ${{ inputs.tag_name || github.ref_name }}
        run: |
          version="${RELEASE_TAG#v}"
          if [[ ! "$version" =~ ^(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)(-[0-9A-Za-z.-]+)?(\+[0-9A-Za-z.-]+)?$ ]]; then
            echo "Release tag must be semantic version vMAJOR.MINOR.PATCH: $RELEASE_TAG" >&2
            exit 1
          fi
          echo "version=$version" >> "$GITHUB_OUTPUT"

      - name: Set up pnpm
        uses: pnpm/action-setup@008330803749db0355799c700092d9a85fd074e9 # v6.0.9
        with:
          version: ${{ env.PNPM_VERSION }}

      - name: Set up Node
        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version: ${{ env.NODE_VERSION }}
          cache: pnpm

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      - name: Test desktop contract
        run: pnpm test:desktop

      - name: Typecheck desktop
        run: pnpm --filter @clickclack/desktop typecheck

      - name: Build desktop app
        run: pnpm --filter @clickclack/desktop build

      - name: Package desktop installers
        run: pnpm --filter @clickclack/desktop exec electron-builder ${{ matrix.builder_args }} --config.extraMetadata.version=${{ steps.release.outputs.version }} --publish never

      - name: Write desktop checksums
        run: node apps/desktop/scripts/release-artifacts.mjs ${{ matrix.platform }} ${{ steps.release.outputs.version }} apps/desktop/release

      - name: Upload desktop release candidates
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: ClickClack-desktop-${{ matrix.platform }}
          path: |
            ${{ matrix.files }}
            apps/desktop/release/ClickClack-*-SHA256SUMS.txt
          if-no-files-found: error
          retention-days: 14

  verify-macos:
    name: Verify signed macOS release assets
    if: >-
      endsWith(github.workflow_ref, format('@refs/heads/{0}', github.event.repository.default_branch)) &&
      github.ref == format('refs/heads/{0}', github.event.repository.default_branch)
    runs-on: macos-latest
    timeout-minutes: 20
    permissions:
      contents: write
    steps:
      - name: Check out trusted verifier
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          persist-credentials: false
          ref: ${{ github.workflow_sha }}

      - name: Download signed macOS draft assets
        env:
          GH_TOKEN: ${{ github.token }}
          RELEASE_TAG: ${{ inputs.tag_name }}
        run: |
          set -euo pipefail
          version="${RELEASE_TAG#v}"
          mkdir -p macos-release
          gh release download "$RELEASE_TAG" \
            --repo "$GITHUB_REPOSITORY" \
            --dir macos-release \
            --pattern "ClickClack-${version}-mac-*.dmg" \
            --pattern "ClickClack-${version}-mac-*.zip" \
            --pattern "ClickClack-${version}-mac-SHA256SUMS.txt"

      - name: Verify checksums and sealed apps
        env:
          RELEASE_TAG: ${{ inputs.tag_name }}
        run: |
          set -euo pipefail
          version="${RELEASE_TAG#v}"
          (
            cd macos-release
            shasum -a 256 --check "ClickClack-${version}-mac-SHA256SUMS.txt"
          )
          apps/desktop/scripts/verify-macos-release.sh "$RELEASE_TAG" macos-release

  publish-desktop:
    name: Publish desktop apps
    if: >-
      endsWith(github.workflow_ref, format('@refs/heads/{0}', github.event.repository.default_branch)) &&
      github.ref == format('refs/heads/{0}', github.event.repository.default_branch)
    needs:
      - release
      - desktop
      - verify-macos
    runs-on: ubuntu-latest
    timeout-minutes: 10
    permissions:
      contents: write
    steps:
      - name: Download desktop release candidates
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          pattern: ClickClack-desktop-*
          path: desktop-release
          merge-multiple: true

      - name: Verify desktop checksums
        working-directory: desktop-release
        run: sha256sum --check ClickClack-*-SHA256SUMS.txt

      - name: Attach desktop apps to GitHub Release
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          RELEASE_TAG: ${{ inputs.tag_name || github.ref_name }}
        run: gh release upload "$RELEASE_TAG" desktop-release/* --clobber --repo "$GITHUB_REPOSITORY"

      - name: Publish verified GitHub Release
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          RELEASE_TAG: ${{ inputs.tag_name || github.ref_name }}
        run: gh release edit "$RELEASE_TAG" --draft=false --repo "$GITHUB_REPOSITORY"