release.yml

name: Release

on:
  push:
    tags:
      - "v*"

permissions:
  contents: write

env:
  CARGO_TERM_COLOR: always

# Tag-triggered build. For each tag push, this workflow produces TWO
# DMGs — one for Intel (x86_64) and one for Apple Silicon (arm64) —
# signed + notarized when the Developer ID secrets are populated,
# unsigned when they're missing.
#
# It also produces Windows + Linux installers (build-desktop → release-desktop):
# Linux .deb + .AppImage and a Windows NSIS .exe, appended to the same GitHub
# Release. These are UNSIGNED today (Windows code-signing needs a cert — see the
# build-desktop job) and ship WITHOUT the auto-updater (the updater latest.json
# stays macOS-only; Win/Linux users update by re-downloading). The desktop jobs
# are decoupled from the macOS build/release jobs — a Win/Linux failure can't
# block a macOS release, and vice versa.
#
# Required secrets for signing (all six must be set, gated on
# APPLE_TEAM_ID since it's the last to provision):
#   APPLE_CERTIFICATE_BASE64    .p12 with the Developer ID Application
#                               cert + private key, base64-encoded
#                               (`base64 -i cert.p12 | pbcopy` on macOS)
#   APPLE_CERTIFICATE_PASSWORD  passphrase set when exporting the .p12
#   APPLE_SIGNING_IDENTITY      e.g. "Developer ID Application: Foo
#                               (TEAMID)" — the codesign --sign value
#   APPLE_ID                    the developer's Apple ID (email)
#   APPLE_PASSWORD              app-specific password from appleid.apple.com
#   APPLE_TEAM_ID               10-char team id from developer.apple.com
#
# Optional, for the auto-updater:
#   TAURI_SIGNING_PRIVATE_KEY            the Tauri updater private key
#   TAURI_SIGNING_PRIVATE_KEY_PASSWORD   its passphrase

jobs:
  build:
    runs-on: macos-latest
    timeout-minutes: 90
    strategy:
      fail-fast: false
      matrix:
        include:
          # Filename suffixes spell out the chip family — "x64" and
          # "arm64" leave non-technical users guessing which DMG
          # matches their Mac. Apple uses these exact terms on
          # https://support.apple.com/en-us/HT211814.
          - target: x86_64-apple-darwin
            suffix: intel
          - target: aarch64-apple-darwin
            suffix: apple-silicon
    env:
      # GitHub Actions forbids `secrets.*` in step-level `if:` conditionals,
      # so we promote the gate to a job-level env var and check that
      # downstream. "true" iff all six Apple Developer ID secrets are
      # wired (we gate on APPLE_TEAM_ID since it's set last).
      HAS_APPLE_SIGNING: ${{ secrets.APPLE_TEAM_ID != '' }}
      # Same trick for the updater signing key — gates the .app.tar.gz +
      # signature production used by the auto-updater (latest.json).
      HAS_UPDATER_SIGNING: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY != '' }}
    steps:
      - uses: actions/checkout@v6

      - uses: pnpm/action-setup@v6
        with:
          version: 10

      - uses: actions/setup-node@v6
        with:
          node-version: 22
          cache: pnpm

      - uses: dtolnay/rust-toolchain@stable
        with:
          targets: ${{ matrix.target }}

      - uses: Swatinem/rust-cache@v2
        with:
          workspaces: src-tauri
          key: ${{ matrix.target }}

      - name: Install
        run: pnpm install --frozen-lockfile

      - name: Import Apple Developer ID certificate
        # Creates a short-lived keychain on the runner, imports the .p12,
        # and sets ACLs so codesign can use the private key non-interactively.
        # Gated on APPLE_TEAM_ID — when secrets are missing, the workflow
        # falls through to an unsigned DMG.
        if: ${{ env.HAS_APPLE_SIGNING == 'true' }}
        env:
          APPLE_CERTIFICATE_BASE64: ${{ secrets.APPLE_CERTIFICATE_BASE64 }}
          APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
        run: |
          set -euo pipefail
          KEYCHAIN_PATH="$RUNNER_TEMP/markup-signing.keychain-db"
          KEYCHAIN_PASSWORD="$(openssl rand -hex 24)"
          echo "$APPLE_CERTIFICATE_BASE64" | base64 --decode > "$RUNNER_TEMP/cert.p12"
          security create-keychain -p "$KEYCHAIN_PASSWORD" "$KEYCHAIN_PATH"
          security set-keychain-settings -lut 21600 "$KEYCHAIN_PATH"
          security unlock-keychain -p "$KEYCHAIN_PASSWORD" "$KEYCHAIN_PATH"
          security import "$RUNNER_TEMP/cert.p12" \
            -P "$APPLE_CERTIFICATE_PASSWORD" \
            -A -t cert -f pkcs12 \
            -k "$KEYCHAIN_PATH"
          security set-key-partition-list -S apple-tool:,apple: \
            -k "$KEYCHAIN_PASSWORD" "$KEYCHAIN_PATH" >/dev/null
          security list-keychains -d user -s "$KEYCHAIN_PATH" $(security list-keychains -d user | tr -d '"')
          security default-keychain -s "$KEYCHAIN_PATH"
          rm -f "$RUNNER_TEMP/cert.p12"
          echo "MARKUP_KEYCHAIN_PATH=$KEYCHAIN_PATH" >> "$GITHUB_ENV"
          security find-identity -v -p codesigning "$KEYCHAIN_PATH"

      - name: Build (Tauri app bundle, ${{ matrix.target }})
        env:
          TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
          TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
        run: |
          set -euo pipefail
          BUNDLE_DIR="src-tauri/target/${{ matrix.target }}/release/bundle"
          # App-only: we assemble the DMG ourselves with dmgbuild, which
          # writes the icon layout headlessly. (Tauri's --bundles dmg uses
          # a Finder AppleScript that no-ops on CI — icons land top-left —
          # and it deletes the standalone .app we need to sign/package.)
          pnpm tauri build --target ${{ matrix.target }} --bundles app
          if [ ! -d "$BUNDLE_DIR/macos/Markup.app" ]; then
            echo "::error ::Markup.app missing — app bundle step failed"; exit 1
          fi

      - name: Sign Markup.app (hardened runtime + entitlements)
        if: ${{ env.HAS_APPLE_SIGNING == 'true' }}
        env:
          APPLE_SIGNING_IDENTITY: ${{ secrets.APPLE_SIGNING_IDENTITY }}
        run: |
          set -euo pipefail
          APP="src-tauri/target/${{ matrix.target }}/release/bundle/macos/Markup.app"
          codesign --force --deep --options runtime \
            --entitlements src-tauri/Entitlements.plist \
            --sign "$APPLE_SIGNING_IDENTITY" \
            --timestamp \
            "$APP"
          codesign --verify --deep --strict --verbose=2 "$APP"

      - name: Assemble DMG (dmgbuild — large centered icons, headless layout)
        run: |
          set -euo pipefail
          python3 -m pip install --quiet --user --break-system-packages dmgbuild \
            || python3 -m pip install --quiet --user dmgbuild
          BUNDLE_DIR="src-tauri/target/${{ matrix.target }}/release/bundle"
          APP="$BUNDLE_DIR/macos/Markup.app"
          DEST="$BUNDLE_DIR/dmg/Markup_${GITHUB_REF_NAME#v}_${{ matrix.suffix }}.dmg"
          mkdir -p "$(dirname "$DEST")"
          rm -f "$DEST"
          # dmgbuild writes the .DS_Store layout directly (no Finder), so
          # the 128px centered icon layout from scripts/dmg-settings.py is
          # reproducible on the headless runner. Works for both the signed
          # (.app already codesigned above) and unsigned flows.
          DMG_APP="$APP" python3 -m dmgbuild -s scripts/dmg-settings.py "Markup" "$DEST"
          ls -lh "$DEST"

      - name: Notarize DMG with Apple notary
        if: ${{ env.HAS_APPLE_SIGNING == 'true' }}
        env:
          APPLE_ID: ${{ secrets.APPLE_ID }}
          APPLE_PASSWORD: ${{ secrets.APPLE_PASSWORD }}
          APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
        run: |
          set -euo pipefail
          BUNDLE_DIR="src-tauri/target/${{ matrix.target }}/release/bundle"
          DMG="$(ls "$BUNDLE_DIR/dmg/"Markup_*_${{ matrix.suffix }}.dmg | head -1)"
          # Apple's notary service occasionally times out or returns 5xx —
          # retry the submit a few times before failing the whole release.
          for attempt in 1 2 3; do
            if xcrun notarytool submit "$DMG" \
                --apple-id "$APPLE_ID" \
                --password "$APPLE_PASSWORD" \
                --team-id "$APPLE_TEAM_ID" \
                --wait; then
              break
            fi
            if [ "$attempt" = 3 ]; then
              echo "notarytool failed after 3 attempts" >&2
              exit 1
            fi
            echo "notarytool attempt $attempt failed; retrying in 30s…" >&2
            sleep 30
          done
          xcrun stapler staple "$DMG"
          xcrun stapler staple "$BUNDLE_DIR/macos/Markup.app"
          spctl --assess --type execute --verbose=2 "$BUNDLE_DIR/macos/Markup.app"

      # Auto-updater artifact: a gzipped tar of the *signed + stapled* .app
      # plus a minisign signature (verified client-side against the pubkey in
      # tauri.conf.json). Built from the post-notarization app so the update
      # the user receives is itself signed + notarized. Gated on the updater
      # key being present — falls through cleanly when it isn't.
      - name: Build + sign updater artifact (.app.tar.gz)
        if: ${{ env.HAS_UPDATER_SIGNING == 'true' }}
        env:
          TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
          TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
        run: |
          set -euo pipefail
          BUNDLE_DIR="src-tauri/target/${{ matrix.target }}/release/bundle"
          VERSION="${GITHUB_REF_NAME#v}"
          TARBALL="$BUNDLE_DIR/macos/Markup_${VERSION}_${{ matrix.suffix }}.app.tar.gz"
          tar -C "$BUNDLE_DIR/macos" -czf "$TARBALL" "Markup.app"
          # tauri signer reads the key + password from the env vars above;
          # writes "<tarball>.sig" next to it.
          pnpm tauri signer sign "$TARBALL"
          ls -lh "$TARBALL" "$TARBALL.sig"

      - name: Clean up signing keychain
        if: always() && env.MARKUP_KEYCHAIN_PATH != ''
        run: |
          security delete-keychain "$MARKUP_KEYCHAIN_PATH" || true
          rm -f "$MARKUP_KEYCHAIN_PATH" || true

      - name: Stage artifacts for release job
        run: |
          set -euo pipefail
          mkdir -p staged
          BUNDLE_DIR="src-tauri/target/${{ matrix.target }}/release/bundle"
          cp "$BUNDLE_DIR/dmg/"*.dmg staged/
          # Updater tarball + signature, when produced.
          cp "$BUNDLE_DIR/macos/"*.app.tar.gz staged/ 2>/dev/null || true
          cp "$BUNDLE_DIR/macos/"*.app.tar.gz.sig staged/ 2>/dev/null || true
          ls -lh staged/

      - name: Upload artifacts
        uses: actions/upload-artifact@v7
        with:
          name: dmg-${{ matrix.suffix }}
          path: staged/*
          retention-days: 7
          if-no-files-found: error

  # Windows + Linux installers. Decoupled from the macOS build/release jobs (it
  # neither blocks nor is blocked by them), so a flaky AppImage/NSIS build can't
  # break a macOS release. UNSIGNED today:
  #   • Windows: SmartScreen warns until a code-signing cert is wired. To sign,
  #     add the cert to tauri.conf.json → bundle.windows (certificateThumbprint +
  #     timestampUrl, or a signCommand / Azure Trusted Signing) and pass its
  #     secrets here — mirror the HAS_*_SIGNING gate idiom used by the mac jobs.
  #   • Linux: .deb/.AppImage are conventionally unsigned; the repo is the trust
  #     anchor.
  # No auto-updater artifacts (createUpdaterArtifacts is unset) — Win/Linux
  # updates are manual re-downloads for now (docs/CROSS-PLATFORM-HARDENING.md P2).
  build-desktop:
    name: Build installers (${{ matrix.os }})
    runs-on: ${{ matrix.os }}
    timeout-minutes: 90
    strategy:
      fail-fast: false
      matrix:
        include:
          - os: ubuntu-latest
            bundles: deb,appimage
          - os: windows-latest
            bundles: nsis
    steps:
      - uses: actions/checkout@v6

      - uses: pnpm/action-setup@v6
        with:
          version: 10

      - uses: actions/setup-node@v6
        with:
          node-version: 22
          cache: pnpm

      # Linux: WebKitGTK toolchain + libfuse2 (AppImage runtime needs FUSE 2).
      - name: Install Linux system deps
        if: matrix.os == 'ubuntu-latest'
        run: |
          sudo apt-get update
          sudo apt-get install -y \
            libwebkit2gtk-4.1-dev \
            libappindicator3-dev \
            librsvg2-dev \
            patchelf \
            libxdo-dev \
            libssl-dev \
            libfuse2

      - uses: dtolnay/rust-toolchain@stable

      - uses: Swatinem/rust-cache@v2
        with:
          workspaces: src-tauri
          key: ${{ matrix.os }}

      - name: Install
        run: pnpm install --frozen-lockfile

      # `--bundles` overrides the macOS-only config targets; createUpdaterArtifacts
      # is unset so this needs no signing key.
      - name: Build installers (${{ matrix.bundles }})
        run: pnpm tauri build --bundles ${{ matrix.bundles }}

      - name: Stage installers
        shell: bash
        run: |
          set -euo pipefail
          mkdir -p staged
          find src-tauri/target/release/bundle -maxdepth 2 \
            \( -name '*.deb' -o -name '*.AppImage' -o -name '*.exe' \) \
            -exec cp {} staged/ \;
          ls -lh staged/

      - name: Upload artifacts
        uses: actions/upload-artifact@v7
        with:
          name: desktop-${{ matrix.os }}
          path: staged/*
          retention-days: 7
          if-no-files-found: error

  # Mac App Store flavor: a sandboxed, Apple-Distribution-signed .pkg built by
  # scripts/build-mas.sh. Independent of the DMG build/release jobs (it neither
  # blocks nor is blocked by them), so a misconfig here can't break direct
  # releases. Dormant until the MAS_* secrets exist — every step gates on
  # MAS_APP_IDENTITY, so with no secrets this job is a cheap no-op. The .pkg is
  # uploaded as a workflow artifact; submitting it to App Store Connect
  # (Transporter / altool) + hitting "Submit for Review" stays manual — MAS has
  # no auto-submit. See docs/app-store/MAS-publishing-plan.md.
  #
  # Required secrets (set once, after the certs/profile exist):
  #   MAS_CERT_P12_BASE64       base64 of a .p12 holding BOTH the
  #                             "Apple Distribution" and "3rd Party Mac Developer
  #                             Installer" identities (+ private keys)
  #   MAS_CERT_P12_PASSWORD     that .p12's export passphrase
  #   MAS_APP_IDENTITY          "Apple Distribution: NAME (TEAMID)"
  #   MAS_INSTALLER_IDENTITY    "3rd Party Mac Developer Installer: NAME (TEAMID)"
  #   MAS_PROVISION_PROFILE_BASE64  base64 of the Mac App Store .provisionprofile
  mas:
    runs-on: macos-latest
    timeout-minutes: 90
    env:
      # Job-level gate (secrets aren't allowed in step `if:`), same idiom as the
      # build job. "true" iff the MAS signing identity is wired.
      HAS_MAS_SIGNING: ${{ secrets.MAS_APP_IDENTITY != '' }}
    steps:
      - uses: actions/checkout@v6
        if: ${{ env.HAS_MAS_SIGNING == 'true' }}

      - uses: pnpm/action-setup@v6
        if: ${{ env.HAS_MAS_SIGNING == 'true' }}
        with:
          version: 10

      - uses: actions/setup-node@v6
        if: ${{ env.HAS_MAS_SIGNING == 'true' }}
        with:
          node-version: 22
          cache: pnpm

      - uses: dtolnay/rust-toolchain@stable
        if: ${{ env.HAS_MAS_SIGNING == 'true' }}

      - uses: Swatinem/rust-cache@v2
        if: ${{ env.HAS_MAS_SIGNING == 'true' }}
        with:
          workspaces: src-tauri
          key: mas

      - name: Install
        if: ${{ env.HAS_MAS_SIGNING == 'true' }}
        run: pnpm install --frozen-lockfile

      - name: Import MAS certificates + provisioning profile
        if: ${{ env.HAS_MAS_SIGNING == 'true' }}
        env:
          MAS_CERT_P12_BASE64: ${{ secrets.MAS_CERT_P12_BASE64 }}
          MAS_CERT_P12_PASSWORD: ${{ secrets.MAS_CERT_P12_PASSWORD }}
          MAS_PROVISION_PROFILE_BASE64: ${{ secrets.MAS_PROVISION_PROFILE_BASE64 }}
        run: |
          set -euo pipefail
          KEYCHAIN_PATH="$RUNNER_TEMP/markup-mas.keychain-db"
          KEYCHAIN_PASSWORD="$(openssl rand -hex 24)"
          echo "$MAS_CERT_P12_BASE64" | base64 --decode > "$RUNNER_TEMP/mas-cert.p12"
          security create-keychain -p "$KEYCHAIN_PASSWORD" "$KEYCHAIN_PATH"
          security set-keychain-settings -lut 21600 "$KEYCHAIN_PATH"
          security unlock-keychain -p "$KEYCHAIN_PASSWORD" "$KEYCHAIN_PATH"
          security import "$RUNNER_TEMP/mas-cert.p12" \
            -P "$MAS_CERT_P12_PASSWORD" \
            -A -t cert -f pkcs12 \
            -k "$KEYCHAIN_PATH"
          security set-key-partition-list -S apple-tool:,apple: \
            -k "$KEYCHAIN_PASSWORD" "$KEYCHAIN_PATH" >/dev/null
          security list-keychains -d user -s "$KEYCHAIN_PATH" $(security list-keychains -d user | tr -d '"')
          security default-keychain -s "$KEYCHAIN_PATH"
          rm -f "$RUNNER_TEMP/mas-cert.p12"
          echo "MARKUP_KEYCHAIN_PATH=$KEYCHAIN_PATH" >> "$GITHUB_ENV"
          PROFILE="$RUNNER_TEMP/markup_mas.provisionprofile"
          echo "$MAS_PROVISION_PROFILE_BASE64" | base64 --decode > "$PROFILE"
          echo "MAS_PROFILE=$PROFILE" >> "$GITHUB_ENV"
          security find-identity -v -p codesigning "$KEYCHAIN_PATH"

      - name: Build signed MAS .pkg
        if: ${{ env.HAS_MAS_SIGNING == 'true' }}
        env:
          MAS_APP_IDENTITY: ${{ secrets.MAS_APP_IDENTITY }}
          MAS_INSTALLER_IDENTITY: ${{ secrets.MAS_INSTALLER_IDENTITY }}
        run: ./scripts/build-mas.sh

      - name: Upload MAS package artifact
        if: ${{ env.HAS_MAS_SIGNING == 'true' }}
        uses: actions/upload-artifact@v7
        with:
          name: mas-pkg
          path: src-tauri/target/release/bundle/macos/Markup.pkg
          retention-days: 7
          if-no-files-found: error

      - name: Clean up signing keychain
        if: ${{ always() && env.MARKUP_KEYCHAIN_PATH != '' }}
        run: |
          security delete-keychain "$MARKUP_KEYCHAIN_PATH" || true
          rm -f "$MARKUP_KEYCHAIN_PATH" || true

  release:
    needs: build
    runs-on: macos-latest
    timeout-minutes: 15
    steps:
      - uses: actions/checkout@v6

      - name: Download both DMG artifacts
        uses: actions/download-artifact@v8
        with:
          pattern: dmg-*
          path: dmg-staging
          merge-multiple: true

      - name: Compute SHA256SUMS
        run: |
          set -euo pipefail
          cd dmg-staging
          shopt -s nullglob
          ls -lh
          shasum -a 256 *.dmg *.app.tar.gz > SHA256SUMS
          cat SHA256SUMS

      # Build the updater manifest the app polls (tauri.conf.json →
      # plugins.updater.endpoints). No-op for unsigned builds with no
      # tarballs, so the release still publishes its DMGs.
      - name: Generate updater latest.json
        run: |
          set -euo pipefail
          cd dmg-staging
          shopt -s nullglob
          tarballs=( *.app.tar.gz )
          if [ ${#tarballs[@]} -eq 0 ]; then
            echo "No updater tarballs (unsigned build) — skipping latest.json."
            exit 0
          fi
          VERSION="${GITHUB_REF_NAME#v}"
          BASE="https://github.com/oratis/Markup/releases/download/${GITHUB_REF_NAME}"
          ARM_SIG="$(cat "Markup_${VERSION}_apple-silicon.app.tar.gz.sig")"
          X64_SIG="$(cat "Markup_${VERSION}_intel.app.tar.gz.sig")"
          PUB_DATE="$(date -u +%Y-%m-%dT%H:%M:%SZ)"
          printf '{\n  "version": "%s",\n  "notes": "See %s/releases/tag/%s",\n  "pub_date": "%s",\n  "platforms": {\n    "darwin-aarch64": { "signature": "%s", "url": "%s/Markup_%s_apple-silicon.app.tar.gz" },\n    "darwin-x86_64": { "signature": "%s", "url": "%s/Markup_%s_intel.app.tar.gz" }\n  }\n}\n' \
            "$VERSION" "https://github.com/oratis/Markup" "$GITHUB_REF_NAME" "$PUB_DATE" \
            "$ARM_SIG" "$BASE" "$VERSION" \
            "$X64_SIG" "$BASE" "$VERSION" > latest.json
          echo "--- latest.json ---"; cat latest.json
          python3 -c "import json;json.load(open('latest.json'))" && echo "latest.json is valid JSON"

      - name: Create / update GitHub Release
        uses: softprops/action-gh-release@v3
        with:
          name: ${{ github.ref_name }}
          tag_name: ${{ github.ref_name }}
          generate_release_notes: true
          fail_on_unmatched_files: false
          files: |
            dmg-staging/*.dmg
            dmg-staging/*.app.tar.gz
            dmg-staging/latest.json
            dmg-staging/SHA256SUMS

  # Attach the Windows/Linux installers to the same GitHub Release. Separate from
  # the macOS `release` job (which owns release-notes generation) so the two
  # platforms can't block each other; action-gh-release upserts by tag, so this
  # just adds files to the release the macOS job creates (or creates it if this
  # wins the race — both are idempotent on the tag).
  release-desktop:
    needs: build-desktop
    runs-on: ubuntu-latest
    timeout-minutes: 15
    steps:
      - name: Download desktop installer artifacts
        uses: actions/download-artifact@v8
        with:
          pattern: desktop-*
          path: desktop-staging
          merge-multiple: true

      - name: Compute SHA256SUMS (desktop)
        run: |
          set -euo pipefail
          cd desktop-staging
          shopt -s nullglob
          ls -lh
          shasum -a 256 *.deb *.AppImage *.exe > SHA256SUMS-desktop
          cat SHA256SUMS-desktop

      - name: Add installers to the GitHub Release
        uses: softprops/action-gh-release@v3
        with:
          name: ${{ github.ref_name }}
          tag_name: ${{ github.ref_name }}
          fail_on_unmatched_files: false
          files: |
            desktop-staging/*.deb
            desktop-staging/*.AppImage
            desktop-staging/*.exe
            desktop-staging/SHA256SUMS-desktop