release.yml

name: Release

on:
  push:
    tags:
      # A digit after the v: the boundary packages publish tags such as
      # viewer-2.69.0-viewer.h5e7e..., which "v*" also matched, and every one
      # built and uploaded a whole desktop release onto its pre-release.
      - "v[0-9]*"
  # Rebuild one platform of a release that already has its tag. A re-run of the
  # tag's own run can only repeat every failed job with the workflow as it was
  # at the tag; this runs the workflow from the branch it is dispatched on,
  # against the tag's source, for the one platform that is missing.
  workflow_dispatch:
    inputs:
      tag:
        description: "Existing release tag to build, for example v2.52.0"
        required: true
        type: string
      platform:
        description: "Platform to build"
        required: true
        type: choice
        default: all
        options:
          - all
          - macOS
          - Windows
          - Windows arm64
          - Linux x64
          - Linux arm64
      keep:
        description: "Assets to leave as they are on the release (space separated globs, for example *.tar.gz)"
        required: false
        type: string
        default: ""

permissions:
  contents: write

concurrency:
  group: release-${{ inputs.tag || github.ref_name }}-${{ inputs.platform || 'all' }}
  cancel-in-progress: false

env:
  RELEASE_TAG: ${{ inputs.tag || github.ref_name }}

jobs:
  create-release:
    name: Create GitHub release
    runs-on: ubuntu-latest
    outputs:
      matrix: ${{ steps.plan.outputs.matrix }}
    steps:
      - name: Create release if missing
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          if gh release view "${RELEASE_TAG}" --repo "${GITHUB_REPOSITORY}" >/dev/null 2>&1; then
            echo "Release ${RELEASE_TAG} already exists."
          else
            gh release create "${RELEASE_TAG}" \
              --repo "${GITHUB_REPOSITORY}" \
              --title "ZenNotes ${RELEASE_TAG}" \
              --notes "Download the installer for your platform from the assets below."
          fi

      - name: Plan the platform jobs
        id: plan
        env:
          PLATFORM: ${{ inputs.platform || 'all' }}
        # "Linux arm64" is GitHub's free arm64 Linux runner for public repos:
        # native aarch64 artifacts with no cross-compilation. "Windows arm64"
        # is its Windows counterpart (#928). Its script names the architecture
        # (dist:win:arm64), so a toolchain that came up emulated as x64 cannot
        # build an x64 copy that lands on the x64 job's file names.
        run: |
          all='[
            {"name":"macOS","os":"macos-latest","command":"npm run dist:mac"},
            {"name":"Windows","os":"windows-latest","command":"npm run dist:win"},
            {"name":"Windows arm64","os":"windows-11-arm","command":"npm run dist:win:arm64 --workspace @zennotes/desktop"},
            {"name":"Linux x64","os":"ubuntu-latest","command":"npm run dist:linux"},
            {"name":"Linux arm64","os":"ubuntu-24.04-arm","command":"npm run dist:linux"}
          ]'
          if [ "${PLATFORM}" = "all" ]; then
            matrix=$(jq -c '.' <<<"${all}")
          else
            matrix=$(jq -c --arg name "${PLATFORM}" '[.[] | select(.name == $name)]' <<<"${all}")
          fi
          if [ "$(jq 'length' <<<"${matrix}")" -eq 0 ]; then
            echo "Unknown platform: ${PLATFORM}" >&2
            exit 1
          fi
          echo "matrix=${matrix}" >> "${GITHUB_OUTPUT}"

  build-and-upload:
    name: Release ${{ matrix.name }}
    needs: create-release
    runs-on: ${{ matrix.os }}
    strategy:
      fail-fast: false
      matrix:
        include: ${{ fromJSON(needs.create-release.outputs.matrix) }}
    env:
      NODE_OPTIONS: "--max-old-space-size=12288"
      CSC_IDENTITY_AUTO_DISCOVERY: "false"
      CSC_LINK: ${{ secrets.MACOS_CERTIFICATE_P12 }}
      CSC_KEY_PASSWORD: ${{ secrets.MACOS_CERTIFICATE_PASSWORD }}
      CSC_NAME: "Lumary Labs LLC (WYY7PK57DM)"
      APPLE_ID: ${{ secrets.APPLE_ID }}
      APPLE_APP_SPECIFIC_PASSWORD: ${{ secrets.APPLE_APP_SPECIFIC_PASSWORD }}
      APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
      WIN_CSC_LINK: ${{ secrets.WINDOWS_CERTIFICATE_P12 }}
      WIN_CSC_KEY_PASSWORD: ${{ secrets.WINDOWS_CERTIFICATE_PASSWORD }}
      REQUIRE_MAC_SIGNING: "true"
    steps:
      - name: Check out repository
        uses: actions/checkout@v6
        with:
          ref: ${{ inputs.tag || github.ref }}

      - name: Set up Node.js
        uses: actions/setup-node@v6
        with:
          node-version: 22
          cache: npm

      - name: Install dependencies
        run: npm ci

      - name: Carry the electron-builder keychain fix
        if: matrix.name == 'macOS'
        # electron-builder 26.15 and 26.16 hand `security set-key-partition-list`
        # the certificate's import password instead of the temporary keychain's
        # own password; the macOS 26.6 runner image verifies it and signing
        # dies with "SecKeychainUnlock: The user name or passphrase you entered
        # is not correct". The fix is merged upstream (electron-builder #10101)
        # but no v26 release carries it yet, so apply it to the installed copy.
        # The script is a no-op once the installed version has the fix.
        run: node tooling/scripts/patch-electron-builder-keychain.mjs

      - name: Verify mac signing secrets
        if: matrix.name == 'macOS'
        shell: bash
        run: |
          required=(CSC_LINK CSC_KEY_PASSWORD APPLE_ID APPLE_APP_SPECIFIC_PASSWORD APPLE_TEAM_ID)
          for var in "${required[@]}"; do
            if [ -z "${!var}" ]; then
              echo "Missing required macOS release secret: ${var}" >&2
              exit 1
            fi
          done

      - name: Install Linux packaging tools
        if: startsWith(matrix.name, 'Linux')
        # `bsdtar` (libarchive-tools) is required by electron-builder's pacman
        # target to generate the package .MTREE; `rpmbuild` (rpm) backs the rpm
        # target. Neither is on the GitHub Ubuntu runners (x64 or arm64).
        #
        # electron-builder's *bundled* fpm is an ancient x86 build (1.9.3, 2015):
        # it can't run on the arm64 runner at all ("Exec format error"), and it
        # is too old to emit an rpm that modern rpmbuild accepts on either arch
        # (verified on macOS: bundled fpm -> rpmbuild exit 1; system fpm -> ok).
        # So install a current fpm from RubyGems on BOTH runners and switch
        # electron-builder to it via USE_SYSTEM_FPM (it also builds deb/pacman).
        run: |
          # The GitHub Ubuntu runners ship pre-configured Microsoft/azure-cli apt
          # repos (packages.microsoft.com) that intermittently serve a broken,
          # unsigned InRelease, which makes `apt-get update` exit 100 and fails
          # the Linux build for reasons unrelated to us. We only need the Ubuntu
          # archives here, so drop those third-party lists first.
          sudo rm -f /etc/apt/sources.list.d/microsoft-prod.list \
                     /etc/apt/sources.list.d/azure-cli.list \
                     /etc/apt/sources.list.d/*microsoft* \
                     /etc/apt/sources.list.d/*azure* 2>/dev/null || true
          sudo apt-get update
          # libarchive-tools -> bsdtar (pacman .MTREE); rpm -> rpmbuild (rpm
          # target); ruby toolchain -> a current fpm from RubyGems.
          sudo apt-get install -y libarchive-tools rpm ruby ruby-dev build-essential
          sudo gem install fpm --no-document
          echo "USE_SYSTEM_FPM=true" >> "$GITHUB_ENV"

      - name: Build release artifacts
        run: ${{ matrix.command }}

      - name: Collect release artifacts
        id: collect
        shell: bash
        env:
          PLATFORM_NAME: ${{ matrix.name }}
        run: |
          mkdir -p release-assets
          find dist -maxdepth 1 -type f \
            \( -name '*.dmg' -o -name '*.zip' -o -name '*.exe' -o -name '*.AppImage' -o -name '*.deb' -o -name '*.pacman' -o -name '*.rpm' -o -name '*.tar.gz' -o -name '*.blockmap' -o -name 'latest*.yml' -o -name 'latest*.yaml' \) \
            -exec mv {} release-assets/ \;
          if [ -z "$(ls -A release-assets)" ]; then
            echo "No release artifacts found in dist/" >&2
            exit 1
          fi
          # The two Windows jobs upload to the same release. Each must hold
          # only its own architecture, or one overwrites the other's files.
          case "${PLATFORM_NAME}" in
            Windows) foreign='-win-arm64' ;;
            "Windows arm64") foreign='-win-x64' ;;
            *) foreign='' ;;
          esac
          if [ -n "${foreign}" ] && ls release-assets | grep -q -- "${foreign}"; then
            echo "The ${PLATFORM_NAME} build produced ${foreign} files:" >&2
            ls release-assets >&2
            exit 1
          fi
          if [ "${PLATFORM_NAME}" = "Windows arm64" ]; then
            # electron-builder names every Windows feed latest.yml whatever the
            # architecture; that name is the x64 job's. The ARM64 feed goes out
            # as latest-arm64.yml, which the ARM64 app reads (updater.ts).
            if [ ! -f release-assets/latest.yml ]; then
              echo "The Windows arm64 build wrote no latest.yml." >&2
              exit 1
            fi
            mv release-assets/latest.yml release-assets/latest-arm64.yml
          fi
          ls -l release-assets

      - name: Keep the build as a workflow artifact
        # The release upload below is the step that fails when GitHub's upload
        # endpoint has a bad day, and a platform build takes up to 40 minutes.
        # With the build kept here, a failed upload is finished by hand from
        # this artifact instead of being built again.
        uses: actions/upload-artifact@v4
        with:
          name: release-${{ matrix.name }}
          path: release-assets/
          if-no-files-found: error
          retention-days: 3
          compression-level: 0

      - name: Upload assets to GitHub Release
        shell: bash
        env:
          GH_TOKEN: ${{ github.token }}
          KEEP: ${{ inputs.keep }}
        run: |
          # Installers first, one at a time, each with its own retries: a
          # single call for everything loses the whole job to one bad request.
          # The update manifests (latest*.yml) go LAST, because the moment one
          # is on the release every installed app is told an update exists, and
          # the files it names have to be there already.
          installers=()
          manifests=()
          # Split KEEP into its globs without letting the shell expand them
          # against the working directory.
          set -f
          keep=(${KEEP})
          set +f
          for file in release-assets/*; do
            name=$(basename "${file}")
            kept=false
            for glob in "${keep[@]}"; do
              # shellcheck disable=SC2254
              case "${name}" in ${glob}) kept=true ;; esac
            done
            if [ "${kept}" = true ]; then
              echo "Leaving ${name} as it is on the release."
              continue
            fi
            case "${name}" in
              latest*.yml | latest*.yaml) manifests+=("${file}") ;;
              *) installers+=("${file}") ;;
            esac
          done

          upload() {
            local file=$1 attempt
            for attempt in 1 2 3 4 5; do
              if gh release upload "${RELEASE_TAG}" --repo "${GITHUB_REPOSITORY}" --clobber "${file}"; then
                echo "Uploaded $(basename "${file}") on attempt ${attempt}."
                return 0
              fi
              echo "Upload of $(basename "${file}") failed (attempt ${attempt} of 5)." >&2
              sleep $((attempt * 20))
            done
            return 1
          }

          for file in "${installers[@]}" "${manifests[@]}"; do
            upload "${file}"
          done