release.yml

name: Release

# Release is triggered by pushing a vX.Y.Z tag.
#
# PREREQUISITE: Before tagging, merge develop → main via PR.
# The tag must point to a commit on main, NOT develop.
# GitFlow: develop (default) → PR → main → tag → release.
#
# Auto-update manifest: tauri-action@v1 has a regression where it fails to
# collect the `.sig` artifacts ("Signature not found for the updater JSON"),
# so `latest.json` never gets uploaded. We work around this by uploading each
# platform's `.sig` as a workflow artifact and assembling `latest.json`
# ourselves in a final job (scripts/build-updater-manifest.ts).

on:
  push:
    tags:
      - "v*"

env:
  CARGO_TERM_COLOR: always
  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true

permissions:
  contents: write

jobs:
  # ── Verify tag is on main ──
  verify-main:
    name: Verify tag is on main
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
        with:
          fetch-depth: 0
      - name: Check tag is on main
        run: |
          git fetch origin main
          TAG_SHA=$(git rev-parse "${{ github.ref }}^{commit}")
          MAIN_SHA=$(git rev-parse origin/main)
          echo "Tag: $TAG_SHA"
          echo "main: $MAIN_SHA"
          if [ "$TAG_SHA" = "$MAIN_SHA" ]; then
            echo "✅ Tag is main HEAD"
          elif git merge-base --is-ancestor "$TAG_SHA" origin/main 2>/dev/null; then
            echo "✅ Tag commit $TAG_SHA is in main history"
          else
            echo "::error::Tag commit $TAG_SHA is NOT on main."
            echo "Merge develop → main via PR before tagging."
            exit 1
          fi

  # ── Build + publish per platform ──
  publish-tauri:
    name: Build ${{ matrix.settings.platform }}
    needs: [verify-main]
    permissions:
      contents: write
    strategy:
      fail-fast: false
      matrix:
        include:
          # updater_key = the Tauri updater platform key (os-arch) this build
          # provides an auto-update bundle for. Empty = no auto-update bundle
          # (e.g. Linux deb/rpm, which aren't self-updatable).
          - settings:
              platform: macos-latest
              args: "--target aarch64-apple-darwin"
              updater_key: "darwin-aarch64"
          - settings:
              platform: macos-latest
              args: "--target x86_64-apple-darwin"
              updater_key: "darwin-x86_64"
          - settings:
              platform: ubuntu-24.04
              args: ""
              updater_key: ""
          - settings:
              platform: windows-latest
              args: ""
              updater_key: "windows-x86_64"

    runs-on: ${{ matrix.settings.platform }}
    steps:
      - uses: actions/checkout@v7

      # bun is the project's JS toolchain (not npm/pnpm).
      - name: Setup bun
        uses: oven-sh/setup-bun@v2

      - name: Install dependencies
        run: bun install --frozen-lockfile

      - name: Setup Rust
        uses: dtolnay/rust-toolchain@stable
        with:
          targets: ${{ matrix.settings.platform == 'macos-latest' && 'aarch64-apple-darwin,x86_64-apple-darwin' || '' }}

      - name: Rust cache
        uses: Swatinem/rust-cache@v2
        with:
          workspaces: src-tauri

      - name: Install Linux dependencies
        if: matrix.settings.platform == 'ubuntu-24.04'
        run: |
          sudo apt-get update
          sudo apt-get install -y libwebkit2gtk-4.1-dev libappindicator3-dev librsvg2-dev patchelf libglib2.0-dev libgtk-3-dev libsoup-3.0-dev libjavascriptcoregtk-4.1-dev

      # tauri signer generate -w ~/.tauri/corin.key
      # Secrets needed: TAURI_SIGNING_PRIVATE_KEY, TAURI_SIGNING_PRIVATE_KEY_PASSWORD
      - name: Build and release
        uses: tauri-apps/tauri-action@v1
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
          TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
        with:
          tagName: ${{ github.ref_name }}
          releaseName: "CorIn ${{ github.ref_name }}"
          releaseBody: |
            See the assets below to download this version.
          releaseDraft: false
          prerelease: ${{ contains(github.ref_name, '-') }}
          updaterJsonPreferNsis: true
          # Invoke tauri via bun (project toolchain).
          tauriScript: "bunx tauri"
          args: ${{ matrix.settings.args }}

      # tauri-action@v1 fails to collect the .sig for the updater manifest
      # (tauri-apps/tauri-action#1098), so latest.json is never uploaded.
      # Upload the signed updater bundle + .sig as a workflow artifact for the
      # manifest job to assemble latest.json from.
      - name: Upload updater signature (for manifest)
        if: matrix.settings.updater_key != ''
        uses: actions/upload-artifact@v7
        with:
          name: updater-${{ matrix.settings.updater_key }}
          if-no-files-found: warn
          path: |
            src-tauri/target/**/bundle/macos/*.app.tar.gz.sig
            src-tauri/target/**/bundle/nsis/*-setup.exe.sig

  # ── Assemble + upload the auto-update manifest ──
  publish-updater-json:
    name: Publish latest.json
    needs: [publish-tauri]
    runs-on: ubuntu-latest
    permissions:
      contents: write
    steps:
      - uses: actions/checkout@v7

      - name: Setup bun
        uses: oven-sh/setup-bun@v2

      - name: Download signed artifacts
        uses: actions/download-artifact@v8
        with:
          pattern: updater-*
          path: artifacts

      - name: Build latest.json
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: bun run scripts/build-updater-manifest.ts "${{ github.ref_name }}" artifacts

      - name: Upload latest.json to release
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: gh release upload "${{ github.ref_name }}" latest.json --clobber