ci-linux.yml

name: Build and Release (Linux + macOS)

on:
  workflow_dispatch:
    inputs:
      ref:
        description: Branch, tag, or SHA to build
        required: true
        default: linux

permissions:
  contents: write

env:
  BUILD_VERSION_SUFFIX: build.${{ github.run_number }}

jobs:
  amd64:
    name: Linux x64 (.deb)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          ref: ${{ inputs.ref || github.ref }}
          submodules: recursive
      - name: Set release build version
        run: |
          node -e "const fs = require('fs'); const path = 'app/package.json'; const pkg = require('./' + path); pkg.version = pkg.version.replace(/-.*/, '') + '-' + process.env.BUILD_VERSION_SUFFIX; fs.writeFileSync(path, JSON.stringify(pkg, null, 2) + '\n');"
          node -p "require('./app/package.json').version"
      - name: Package and test application in container
        uses: tommyqhoang/desktop-ubuntu-amd64-packaging@348deca5ad19d6bd7dd47a224227a466e9061a52
        env:
          DESKTOP_OAUTH_CLIENT_ID: ${{ secrets.DESKTOP_OAUTH_CLIENT_ID }}
          DESKTOP_OAUTH_CLIENT_SECRET:
            ${{ secrets.DESKTOP_OAUTH_CLIENT_SECRET }}
      - name: Upload Linux package
        uses: actions/upload-artifact@v4
        with:
          name: linux-x64-deb
          path: |
            dist/*.deb
            dist/*.deb.sha256
          retention-days: 30
          if-no-files-found: error

  macos-arm64:
    name: macOS arm64 (Apple Silicon, .zip)
    runs-on: macos-14
    env:
      # Without an Apple Developer ID, a 'production' channel build would try to
      # set up a keychain and notarize. 'development' ad-hoc signs instead.
      RELEASE_CHANNEL: development
      DESKTOP_OAUTH_CLIENT_ID: ${{ secrets.DESKTOP_OAUTH_CLIENT_ID }}
      DESKTOP_OAUTH_CLIENT_SECRET: ${{ secrets.DESKTOP_OAUTH_CLIENT_SECRET }}
    steps:
      - uses: actions/checkout@v4
        with:
          ref: ${{ inputs.ref || github.ref }}
          submodules: recursive
      - uses: actions/setup-node@v4
        with:
          node-version-file: .node-version
          cache: yarn
      - name: Set release build version
        run: |
          node -e "const fs = require('fs'); const path = 'app/package.json'; const pkg = require('./' + path); pkg.version = pkg.version.replace(/-.*/, '') + '-' + process.env.BUILD_VERSION_SUFFIX; fs.writeFileSync(path, JSON.stringify(pkg, null, 2) + '\n');"
          node -p "require('./app/package.json').version"
      - name: Install dependencies
        run: yarn install --frozen-lockfile
      - name: Build
        run: yarn build:prod
      - name: Package
        run: yarn package
      - name: Name and checksum zip
        run: |
          VERSION="$(node -p "require('./app/package.json').version")"
          mkdir -p out
          ZIP="$(ls dist/*-arm64.zip | head -n1)"
          cp "$ZIP" "out/GitHubDesktop-macos-arm64-${VERSION}.zip"
          (cd out && shasum -a 256 *.zip | awk '{print $1}' > "GitHubDesktop-macos-arm64-${VERSION}.zip.sha256")
          ls -l out
      - name: Upload macOS package
        uses: actions/upload-artifact@v4
        with:
          name: macos-arm64
          path: out/*
          retention-days: 30
          if-no-files-found: error

  release:
    name: Publish GitHub release
    needs: [amd64, macos-arm64]
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          ref: ${{ inputs.ref || github.ref }}
      - name: Set release metadata
        run: |
          BASE_VERSION="$(node -p "require('./app/package.json').version.replace(/-.*/, '')")"
          RELEASE_VERSION="${BASE_VERSION}-${BUILD_VERSION_SUFFIX}"
          echo "RELEASE_VERSION=${RELEASE_VERSION}" >> "$GITHUB_ENV"
          echo "RELEASE_TAG=release-${RELEASE_VERSION}" >> "$GITHUB_ENV"
      - name: Download packages
        uses: actions/download-artifact@v4
        with:
          path: artifacts
      - name: Show release assets
        run: find artifacts -maxdepth 3 -type f | sort
      - name: Create GitHub release
        uses: softprops/action-gh-release@v2
        with:
          name: GitHub Desktop ${{ env.RELEASE_VERSION }} (Linux + macOS)
          tag_name: ${{ env.RELEASE_TAG }}
          target_commitish: ${{ github.sha }}
          body: |
            Automated build of `${{ github.sha }}` from the `linux` branch.

            | Platform | Download | Install |
            | --- | --- | --- |
            | **Linux** (Debian/Ubuntu, x64) | `GitHubDesktop-linux-*.deb` | `sudo apt install ./GitHubDesktop-linux-*.deb` |
            | **macOS** (Apple Silicon / M1 and newer only) | `GitHubDesktop-macos-arm64-*.zip` | Unzip, drag **GitHub Desktop.app** to Applications |

            Each file has a matching `.sha256` checksum.

            **macOS note:** the app is ad-hoc signed, not notarized. On first
            launch right-click the app and choose **Open**, or run
            `xattr -cr "/Applications/GitHub Desktop.app"`. Intel Macs are not
            supported.
          files: |
            artifacts/**/*.deb
            artifacts/**/*.deb.sha256
            artifacts/**/*.zip
            artifacts/**/*.zip.sha256
          draft: false
          prerelease: false
          make_latest: true
          fail_on_unmatched_files: true
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}