release.yml

name: Native Release

on:
  workflow_dispatch:
    inputs:
      release_tag:
        description: Existing release tag to receive rebuilt packages (leave blank for a rehearsal)
        required: false
        type: string
  release:
    types: [published]

permissions:
  contents: read

jobs:
  browser-matrix:
    name: Browser matrix (Linux)
    runs-on: ubuntu-24.04
    steps:
      - uses: actions/checkout@v7
      - uses: actions/setup-node@v7
        with:
          node-version: 22
          cache: npm
      - name: Install Linux build tools
        run: |
          sudo apt-get update
          sudo apt-get install -y ninja-build libgl1-mesa-dev libxkbcommon-x11-0 libxcb-cursor0
      - name: Worker checks with all engines
        shell: bash
        env:
          CYBERSNAPPER_REQUIRED_BROWSERS: chromium,firefox,webkit
        run: |
          npm ci
          npx playwright install --with-deps chromium firefox webkit
          npm run typecheck:worker
          npm run build:worker
          npm run test:worker

  linux:
    name: Linux ${{ matrix.arch }}
    needs: [browser-matrix]
    strategy:
      fail-fast: false
      matrix:
        include:
          - runner: ubuntu-22.04
            arch: x64
            node_arch: x64
            qt_host: linux
            qt_arch: linux_gcc_64
            tool_arch: x86_64
            linuxdeploy_sha256: c20cd71e3a4e3b80c3483cef793cda3f4e990aca14014d23c544ca3ce1270b4d
            qt_plugin_sha256: 15106be885c1c48a021198e7e1e9a48ce9d02a86dd0a1848f00bdbf3c1c92724
            appimagetool_sha256: ed4ce84f0d9caff66f50bcca6ff6f35aae54ce8135408b3fa33abfc3cb384eb0
            runtime_sha256: 2fca8b443c92510f1483a883f60061ad09b46b978b2631c807cd873a47ec260d
          - runner: ubuntu-24.04-arm
            arch: arm64
            node_arch: arm64
            qt_host: linux_arm64
            qt_arch: linux_gcc_arm64
            tool_arch: aarch64
            linuxdeploy_sha256: 620095110d693282b8ebeb244a95b5e911cf8f65f76c88b4b47d16ae6346fcff
            qt_plugin_sha256: bf1c24aff6d749b5cf423afad6f15abd4440f81dec1aab95706b25f6667cdcf1
            appimagetool_sha256: f0837e7448a0c1e4e650a93bb3e85802546e60654ef287576f46c71c126a9158
            runtime_sha256: 00cbdfcf917cc6c0ff6d3347d59e0ca1f7f45a6df1a428a0d6d8a78664d87444
    runs-on: ${{ matrix.runner }}
    steps:
      - uses: actions/checkout@v7
        with:
          ref: ${{ github.event_name == 'release' && github.event.release.tag_name || inputs.release_tag || github.ref }}

      - uses: actions/setup-node@v7
        with:
          node-version: 22
          architecture: ${{ matrix.node_arch }}
          cache: npm

      - name: Verify release version
        shell: bash
        env:
          CYBERSNAPPER_RELEASE_TAG: ${{ github.event_name == 'release' && github.event.release.tag_name || inputs.release_tag }}
        run: node scripts/check-release-version.mjs "$CYBERSNAPPER_RELEASE_TAG"

      - uses: jurplel/install-qt-action@v4
        with:
          version: '6.8.3'
          host: ${{ matrix.qt_host }}
          arch: ${{ matrix.qt_arch }}
          cache: true

      - name: Install Linux build tools
        run: |
          sudo apt-get update
          sudo apt-get install -y ninja-build libgl1-mesa-dev libxkbcommon-x11-0 libxcb-cursor0 file desktop-file-utils

      - name: Worker checks
        shell: bash
        run: |
          npm ci
          npx playwright install chromium
          if [ "${{ runner.os }}" = "Linux" ]; then
            npx playwright install firefox webkit
          fi
          npm run typecheck:worker
          npm run build:worker
          npm run test:worker

      - name: Bundle Chromium
        shell: bash
        env:
          PLAYWRIGHT_BROWSERS_PATH: ${{ github.workspace }}/.playwright-browsers
        run: npx playwright install chromium

      - name: Install Chromium host dependencies
        env:
          PLAYWRIGHT_BROWSERS_PATH: ${{ github.workspace }}/.playwright-browsers
        run: npx playwright install-deps chromium

      - name: Stage Node runtime
        shell: bash
        run: mkdir -p .runtime && cp "$(command -v node)" .runtime/node && chmod +x .runtime/node

      - name: Configure, build, and test
        shell: bash
        run: |
          cmake -S . -B build/native -G Ninja -DCMAKE_BUILD_TYPE=Release -DCYBERSNAPPER_BUILD_TESTS=ON
          cmake --build build/native --parallel
          ctest --test-dir build/native --output-on-failure

      - name: Keep production worker dependencies
        run: npm prune --omit=dev

      # Every tool comes from a versioned upstream release and is verified
      # before execution. APPIMAGE_EXTRACT_AND_RUN avoids a FUSE dependency.
      - name: Install pinned packaging tools
        shell: bash
        env:
          APPIMAGE_EXTRACT_AND_RUN: '1'
        run: |
          set -euo pipefail
          mkdir -p tools
          curl --fail --location --retry 3 --output tools/linuxdeploy \
            "https://github.com/linuxdeploy/linuxdeploy/releases/download/1-alpha-20251107-1/linuxdeploy-${{ matrix.tool_arch }}.AppImage"
          curl --fail --location --retry 3 --output tools/linuxdeploy-plugin-qt \
            "https://github.com/linuxdeploy/linuxdeploy-plugin-qt/releases/download/1-alpha-20250213-1/linuxdeploy-plugin-qt-${{ matrix.tool_arch }}.AppImage"
          curl --fail --location --retry 3 --output tools/appimagetool \
            "https://github.com/AppImage/appimagetool/releases/download/1.9.1/appimagetool-${{ matrix.tool_arch }}.AppImage"
          curl --fail --location --retry 3 --output tools/AppImage-runtime \
            "https://github.com/AppImage/type2-runtime/releases/download/20251108/runtime-${{ matrix.tool_arch }}"
          printf '%s  %s\n' "${{ matrix.linuxdeploy_sha256 }}" tools/linuxdeploy | sha256sum --check --strict
          printf '%s  %s\n' "${{ matrix.qt_plugin_sha256 }}" tools/linuxdeploy-plugin-qt | sha256sum --check --strict
          printf '%s  %s\n' "${{ matrix.appimagetool_sha256 }}" tools/appimagetool | sha256sum --check --strict
          printf '%s  %s\n' "${{ matrix.runtime_sha256 }}" tools/AppImage-runtime | sha256sum --check --strict
          chmod +x tools/linuxdeploy tools/linuxdeploy-plugin-qt tools/appimagetool

      - name: Package AppImage and portable archive
        shell: bash
        env:
          LINUXDEPLOY: ${{ github.workspace }}/tools/linuxdeploy
          APPIMAGETOOL: ${{ github.workspace }}/tools/appimagetool
          APPIMAGE_RUNTIME: ${{ github.workspace }}/tools/AppImage-runtime
        run: |
          export PATH="${{ github.workspace }}/tools:$PATH"
          export QMAKE="${QT_ROOT_DIR}/bin/qmake"
          version=$(node -p "require('./package.json').version")
          scripts/package-linux.sh build/native release-assets "${{ matrix.arch }}" "$version"

      - name: Smoke-test packaged capture
        shell: bash
        timeout-minutes: 15
        run: |
          env -u QT_PLUGIN_PATH -u QML2_IMPORT_PATH node scripts/smoke-packaged-capture.mjs \
            build/native/AppDir/usr/bin/cybersnapper-cli \
            build/native/AppDir/usr/bin/cybersnapper-agent \
            build/native/AppDir/usr/share/cybersnapper/worker/main.cjs \
            build/native/AppDir/usr/lib/cybersnapper/runtime/node \
            build/native/AppDir/usr/share/cybersnapper/browsers \
            build/native/smoke-state

      - uses: actions/upload-artifact@v4
        with:
          name: CyberSnapper-linux-${{ matrix.arch }}
          path: release-assets/*
          if-no-files-found: error

  windows:
    name: Windows ${{ matrix.arch }}
    strategy:
      fail-fast: false
      matrix:
        include:
          - runner: windows-2022
            arch: x64
            node_arch: x64
            qt_arch: win64_msvc2022_64
            msvc_arch: x64
          - runner: windows-11-arm
            arch: arm64
            node_arch: arm64
            qt_arch: win64_msvc2022_arm64
            msvc_arch: amd64_arm64
    runs-on: ${{ matrix.runner }}
    steps:
      - uses: actions/checkout@v7
        with:
          ref: ${{ github.event_name == 'release' && github.event.release.tag_name || inputs.release_tag || github.ref }}

      - uses: actions/setup-node@v7
        with:
          node-version: 22
          architecture: ${{ matrix.node_arch }}
          cache: npm

      - name: Verify release version
        shell: bash
        env:
          CYBERSNAPPER_RELEASE_TAG: ${{ github.event_name == 'release' && github.event.release.tag_name || inputs.release_tag }}
        run: node scripts/check-release-version.mjs "$CYBERSNAPPER_RELEASE_TAG"

      - uses: ilammy/msvc-dev-cmd@v1
        with:
          arch: ${{ matrix.msvc_arch }}

      - uses: jurplel/install-qt-action@v4
        with:
          version: '6.8.3'
          arch: ${{ matrix.qt_arch }}
          cache: true

      - name: Worker checks
        shell: bash
        run: |
          npm ci
          npx playwright install chromium
          npm run typecheck:worker
          npm run build:worker
          npm run test:worker

      - name: Bundle Chromium
        shell: bash
        env:
          PLAYWRIGHT_BROWSERS_PATH: ${{ github.workspace }}/.playwright-browsers
        run: npx playwright install chromium

      - name: Stage Node runtime
        shell: pwsh
        run: |
          New-Item -ItemType Directory -Force .runtime
          Copy-Item (Get-Command node).Source .runtime/node.exe

      - name: Configure, build, and test
        shell: pwsh
        run: |
          cmake -S . -B build/native -G Ninja -DCMAKE_BUILD_TYPE=Release -DCYBERSNAPPER_BUILD_TESTS=ON
          cmake --build build/native --parallel
          ctest --test-dir build/native --output-on-failure

      - name: Keep production worker dependencies
        run: npm prune --omit=dev

      - name: Install application
        shell: pwsh
        run: cmake --install build/native --prefix stage --config Release

      - name: Deploy Qt
        shell: pwsh
        run: |
          windeployqt --release --no-translations stage/bin/CyberSnapper.exe
          windeployqt --release --no-translations stage/bin/cybersnapper-agent.exe
          Remove-Item stage/bin/sqldrivers/qsqlmimer.dll, stage/bin/sqldrivers/qsqlodbc.dll, stage/bin/sqldrivers/qsqlpsql.dll -ErrorAction SilentlyContinue

      - name: Create portable ZIP
        shell: pwsh
        run: |
          New-Item -ItemType Directory -Force release-assets | Out-Null
          Compress-Archive -Path stage/* -DestinationPath release-assets/CyberSnapper-windows-${{ matrix.arch }}-portable.zip

      - name: Build setup executable
        shell: pwsh
        run: |
          $version = (node -p "require('./package.json').version")
          $makensis = & "$PWD/scripts/install-nsis.ps1"
          & $makensis `
            "/DAPP_SOURCE=$PWD\stage" `
            "/DAPP_ICON=$PWD\native\resources\cybersnapper.ico" `
            "/DVERSION=$version" `
            "/DOUTPUT_FILE=$PWD\release-assets\CyberSnapper-windows-${{ matrix.arch }}-setup.exe" `
            native/packaging/windows/installer.nsi

      - name: Smoke-test packaged capture
        shell: pwsh
        timeout-minutes: 15
        run: |
          Remove-Item Env:QT_PLUGIN_PATH -ErrorAction SilentlyContinue
          Remove-Item Env:QML2_IMPORT_PATH -ErrorAction SilentlyContinue
          node scripts/smoke-packaged-capture.mjs `
            stage\bin\cybersnapper-cli.exe `
            stage\bin\cybersnapper-agent.exe `
            stage\bin\worker\main.cjs `
            stage\bin\runtime\node.exe `
            stage\bin\browsers `
            build\native\smoke-state

      - uses: actions/upload-artifact@v4
        with:
          name: CyberSnapper-windows-${{ matrix.arch }}
          path: release-assets/*
          if-no-files-found: error

  macos:
    name: macOS ${{ matrix.arch }}
    strategy:
      fail-fast: false
      matrix:
        include:
          - runner: macos-15-intel
            arch: x64
            node_arch: x64
            cmake_arch: x86_64
          - runner: macos-15
            arch: arm64
            node_arch: arm64
            cmake_arch: arm64
    runs-on: ${{ matrix.runner }}
    steps:
      - uses: actions/checkout@v7
        with:
          ref: ${{ github.event_name == 'release' && github.event.release.tag_name || inputs.release_tag || github.ref }}

      - uses: actions/setup-node@v7
        with:
          node-version: 22
          architecture: ${{ matrix.node_arch }}
          cache: npm

      - name: Verify release version
        shell: bash
        env:
          CYBERSNAPPER_RELEASE_TAG: ${{ github.event_name == 'release' && github.event.release.tag_name || inputs.release_tag }}
        run: node scripts/check-release-version.mjs "$CYBERSNAPPER_RELEASE_TAG"

      - uses: jurplel/install-qt-action@v4
        with:
          version: '6.8.3'
          cache: true

      - name: Worker checks
        shell: bash
        run: |
          npm ci
          npx playwright install chromium
          if [ "${{ runner.os }}" = "Linux" ]; then
            npx playwright install firefox webkit
          fi
          npm run typecheck:worker
          npm run build:worker
          npm run test:worker

      - name: Bundle Chromium
        shell: bash
        env:
          PLAYWRIGHT_BROWSERS_PATH: ${{ github.workspace }}/.playwright-browsers
        run: npx playwright install chromium

      - name: Stage Node runtime
        shell: bash
        run: mkdir -p .runtime && cp "$(command -v node)" .runtime/node && chmod +x .runtime/node

      - name: Generate macOS icon
        shell: bash
        run: |
          set -euo pipefail
          iconset="$RUNNER_TEMP/CyberSnapper.iconset"
          mkdir -p "$iconset"
          sips -z 16 16 assets/logo.png --out "$iconset/icon_16x16.png" >/dev/null
          sips -z 32 32 assets/logo.png --out "$iconset/icon_16x16@2x.png" >/dev/null
          sips -z 32 32 assets/logo.png --out "$iconset/icon_32x32.png" >/dev/null
          sips -z 64 64 assets/logo.png --out "$iconset/icon_32x32@2x.png" >/dev/null
          sips -z 128 128 assets/logo.png --out "$iconset/icon_128x128.png" >/dev/null
          sips -z 256 256 assets/logo.png --out "$iconset/icon_128x128@2x.png" >/dev/null
          sips -z 256 256 assets/logo.png --out "$iconset/icon_256x256.png" >/dev/null
          sips -z 512 512 assets/logo.png --out "$iconset/icon_256x256@2x.png" >/dev/null
          sips -z 512 512 assets/logo.png --out "$iconset/icon_512x512.png" >/dev/null
          sips -z 1024 1024 assets/logo.png --out "$iconset/icon_512x512@2x.png" >/dev/null
          iconutil -c icns "$iconset" -o "$RUNNER_TEMP/CyberSnapper.icns"

      - name: Configure, build, and test
        shell: bash
        run: |
          cmake -S . -B build/native -G Ninja -DCMAKE_BUILD_TYPE=Release \
            -DCYBERSNAPPER_BUILD_TESTS=ON \
            -DCMAKE_OSX_ARCHITECTURES=${{ matrix.cmake_arch }} \
            -DCYBERSNAPPER_MACOS_ICON="$RUNNER_TEMP/CyberSnapper.icns"
          cmake --build build/native --parallel
          ctest --test-dir build/native --output-on-failure

      - name: Keep production worker dependencies
        run: npm prune --omit=dev

      - name: Install application
        shell: bash
        run: cmake --install build/native --prefix stage --config Release

      - name: Deploy Qt and sign
        shell: bash
        run: |
          set -euo pipefail
          macdeployqt stage/CyberSnapper.app \
            -executable=stage/CyberSnapper.app/Contents/MacOS/cybersnapper-agent \
            -executable=stage/CyberSnapper.app/Contents/MacOS/cybersnapper-cli \
            -always-overwrite
          frameworks=stage/CyberSnapper.app/Contents/Frameworks
          brew list brotli >/dev/null 2>&1 || brew install brotli
          brotli_prefix="$(brew --prefix brotli)"
          cp -L "$brotli_prefix/lib/libbrotlicommon.1.dylib" "$frameworks/libbrotlicommon.1.dylib"
          for library in "$frameworks/libbrotlidec.1.dylib" "$frameworks/libbrotlienc.1.dylib"; do
            install_name_tool -change @rpath/libbrotlicommon.1.dylib \
              @loader_path/libbrotlicommon.1.dylib "$library"
          done
          rm -f stage/CyberSnapper.app/Contents/PlugIns/sqldrivers/libqsql{mimer,odbc,psql}.dylib
          codesign --force --deep --sign - stage/CyberSnapper.app

      - name: Build DMG and ZIP
        shell: bash
        run: |
          mkdir -p release-assets
          hdiutil create -volname CyberSnapper -srcfolder stage/CyberSnapper.app -ov -format UDZO \
            "release-assets/CyberSnapper-macos-${{ matrix.arch }}.dmg"
          ditto -c -k --sequesterRsrc --keepParent stage/CyberSnapper.app \
            "release-assets/CyberSnapper-macos-${{ matrix.arch }}.zip"

      - name: Smoke-test packaged capture
        shell: bash
        timeout-minutes: 15
        run: |
          env -u QT_PLUGIN_PATH -u QML2_IMPORT_PATH node scripts/smoke-packaged-capture.mjs \
            stage/CyberSnapper.app/Contents/MacOS/cybersnapper-cli \
            stage/CyberSnapper.app/Contents/MacOS/cybersnapper-agent \
            stage/CyberSnapper.app/Contents/Resources/worker/main.cjs \
            stage/CyberSnapper.app/Contents/Resources/runtime/node \
            stage/CyberSnapper.app/Contents/Resources/browsers \
            build/native/smoke-state

      - uses: actions/upload-artifact@v4
        with:
          name: CyberSnapper-macos-${{ matrix.arch }}
          path: release-assets/*
          if-no-files-found: error

  publish:
    name: Assemble and publish
    needs: [linux, windows, macos]
    if: github.event_name == 'release' || inputs.release_tag != ''
    runs-on: ubuntu-latest
    permissions:
      contents: write
      id-token: write
      attestations: write
    steps:
      - uses: actions/download-artifact@v4
        with:
          path: artifacts
          merge-multiple: true

      - name: Create SHA-256 checksums
        shell: bash
        run: (cd artifacts && sha256sum -- * > SHA256SUMS.txt)

      - name: Attest package provenance
        uses: actions/attest-build-provenance@v2
        with:
          subject-path: artifacts/*

      - name: Publish packages to release
        shell: bash
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          GH_REPO: ${{ github.repository }}
        run: |
          set -euo pipefail
          tag="${{ github.event_name == 'release' && github.event.release.tag_name || inputs.release_tag }}"
          gh release upload "$tag" artifacts/* --clobber