release.yml

name: release

on:
  push:
    tags:
      - "v*.*.*"

permissions:
  contents: write

jobs:
  build-desktop-windows:
    runs-on: windows-latest
    steps:
      - uses: actions/checkout@v5

      - uses: pnpm/action-setup@v4
        with:
          version: 11.9.0
          run_install: false

      - uses: actions/setup-node@v5
        with:
          node-version: "24"
          cache: pnpm
          cache-dependency-path: pnpm-lock.yaml

      - uses: dtolnay/rust-toolchain@stable

      - uses: Swatinem/rust-cache@v2
        with:
          workspaces: apps/desktop/src-tauri -> target

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      - name: Verify updater signing secret
        shell: pwsh
        env:
          TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
        run: |
          if ([string]::IsNullOrWhiteSpace($env:TAURI_SIGNING_PRIVATE_KEY)) {
            throw "Missing repository secret TAURI_SIGNING_PRIVATE_KEY. See docs/24-desktop-release-and-updates.md."
          }

      - name: Sync release version from tag
        shell: pwsh
        run: |
          $version = "${{ github.ref_name }}" -replace '^v', ''
          if ($version -notmatch '^\d+\.\d+\.\d+([+-][0-9A-Za-z.-]+)?$') {
            throw "Tag must be a semantic version such as v0.2.0; received ${{ github.ref_name }}"
          }

          $configPath = "apps/desktop/src-tauri/tauri.conf.json"
          $config = Get-Content -Raw $configPath | ConvertFrom-Json
          $config.version = $version
          $config | ConvertTo-Json -Depth 100 | Set-Content -Encoding utf8 $configPath

          $cargoPath = "apps/desktop/src-tauri/Cargo.toml"
          $cargo = Get-Content -Raw $cargoPath
          $versionPattern = [regex]::new('(?m)^(version\s*=\s*)"[^"]+"')
          $cargo = $versionPattern.Replace($cargo, "`$1`"$version`"", 1)
          Set-Content -Encoding utf8 $cargoPath $cargo

      - uses: tauri-apps/tauri-action@v1
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
          TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ""
        with:
          projectPath: apps/desktop
          tauriScript: corepack pnpm tauri
          tagName: ${{ github.ref_name }}
          releaseName: "MicroRead ${{ github.ref_name }}"
          generateReleaseNotes: true
          releaseDraft: false
          prerelease: false
          uploadUpdaterJson: true
          uploadUpdaterSignatures: true
          updaterJsonPreferNsis: true
          releaseAssetNamePattern: "MicroRead-v[version]-windows-[arch][setup].[ext]"