release.yml

name: Release

# Triggered when release-please tags a new version.
# - `vX.Y.Z`            → stable release (Electrobun --env=stable, attached to public Release)
# - `vX.Y.Z-beta.N`     → beta release  (Electrobun --env=canary build, marked as pre-release)
# - `vX.Y.Z-rc.N`       → release candidate (same as beta)
#
# Also runs on workflow_dispatch with a manual tag input for emergency rebuilds.

on:
  push:
    tags:
      - "v*.*.*"
  workflow_dispatch:
    inputs:
      tag:
        description: "Existing tag to (re)build, e.g. v0.1.0"
        required: true

permissions:
  contents: write

env:
  BUN_VERSION: "1.3.13"

jobs:
  classify:
    name: Classify release
    runs-on: ubuntu-latest
    outputs:
      version: ${{ steps.parse.outputs.version }}
      channel: ${{ steps.parse.outputs.channel }}
      env: ${{ steps.parse.outputs.env }}
      prerelease: ${{ steps.parse.outputs.prerelease }}
    steps:
      - id: parse
        run: |
          TAG="${{ github.event.inputs.tag || github.ref_name }}"
          # Strip leading v
          VERSION="${TAG#v}"
          if [[ "$VERSION" =~ -beta\. ]]; then
            CHANNEL=beta
            ENV=canary
            PRE=true
          elif [[ "$VERSION" =~ -rc\. ]]; then
            CHANNEL=rc
            ENV=canary
            PRE=true
          elif [[ "$VERSION" =~ -alpha\. ]]; then
            CHANNEL=alpha
            ENV=canary
            PRE=true
          else
            CHANNEL=stable
            ENV=stable
            PRE=false
          fi
          echo "version=${VERSION}" >> $GITHUB_OUTPUT
          echo "channel=${CHANNEL}" >> $GITHUB_OUTPUT
          echo "env=${ENV}" >> $GITHUB_OUTPUT
          echo "prerelease=${PRE}" >> $GITHUB_OUTPUT
          echo "Tag: ${TAG} → version=${VERSION} channel=${CHANNEL} env=${ENV} prerelease=${PRE}"

  build:
    name: Build ${{ needs.classify.outputs.channel }}
    needs: classify
    # Single arm64 build. Intel Macs run via Rosetta 2 — standard for 2026
    # macOS apps. Universal binary would need a lipo merge step we're
    # skipping until / unless someone hits a real Intel-native need.
    runs-on: macos-14
    timeout-minutes: 30
    steps:
      - uses: actions/checkout@v4
        with:
          ref: ${{ github.event.inputs.tag || github.ref_name }}
          submodules: recursive
          fetch-depth: 0

      - uses: oven-sh/setup-bun@v2
        with:
          bun-version: ${{ env.BUN_VERSION }}

      - name: Install
        run: bun install --frozen-lockfile

      - name: Verify package.json version matches tag
        run: |
          PKG=$(node -p "require('./package.json').version")
          EXPECTED="${{ needs.classify.outputs.version }}"
          if [ "$PKG" != "$EXPECTED" ]; then
            echo "::warning::package.json version ($PKG) doesn't match tag ($EXPECTED). Stamping."
            node -e "
              const fs = require('node:fs');
              const path = 'package.json';
              const pkg = JSON.parse(fs.readFileSync(path, 'utf8'));
              pkg.version = '${EXPECTED}';
              fs.writeFileSync(path, JSON.stringify(pkg, null, '\t') + '\n');
            "
          fi

      - name: Build eliza submodule packages
        # Electrobun's bundler can't resolve `@elizaos/*` until the vendored
        # eliza packages have built dist/ + their proto-generated files.
        run: bun run build:eliza

      - name: Build (env=${{ needs.classify.outputs.env }})
        # See canary.yml comment — tolerate electrobun's patch-gen
        # JSON parse failure when no prior release exists at
        # release.baseUrl. The .app is built before patch-gen, so as
        # long as it's on disk we proceed.
        run: |
          set +e
          bun run build:${{ needs.classify.outputs.env }}
          BUILD_EXIT=$?
          set -e
          APP=$(find build -maxdepth 3 -name "*.app" -type d 2>/dev/null | head -1)
          if [ -n "$APP" ]; then
            echo "build exit=$BUILD_EXIT, but .app produced at $APP — continuing"
          else
            echo "::error::build exit=$BUILD_EXIT and no .app produced"
            exit $BUILD_EXIT
          fi

      - name: "Optional code-sign + notarize (stable only, when secrets present)"
        if: needs.classify.outputs.channel == 'stable' && env.APPLE_CERT_BASE64 != ''
        env:
          APPLE_CERT_BASE64: ${{ secrets.APPLE_CERT_BASE64 }}
          APPLE_CERT_PASSWORD: ${{ secrets.APPLE_CERT_PASSWORD }}
          APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
          APPLE_NOTARIZE_USER: ${{ secrets.APPLE_NOTARIZE_USER }}
          APPLE_NOTARIZE_PASSWORD: ${{ secrets.APPLE_NOTARIZE_PASSWORD }}
        run: |
          # Import certificate
          KEYCHAIN_PWD=$(openssl rand -base64 32)
          security create-keychain -p "$KEYCHAIN_PWD" build.keychain
          security default-keychain -s build.keychain
          security unlock-keychain -p "$KEYCHAIN_PWD" build.keychain
          security set-keychain-settings -t 3600 -u build.keychain
          echo "$APPLE_CERT_BASE64" | base64 --decode > /tmp/cert.p12
          security import /tmp/cert.p12 -k build.keychain -P "$APPLE_CERT_PASSWORD" -T /usr/bin/codesign
          security set-key-partition-list -S apple-tool:,apple:,codesign: -s -k "$KEYCHAIN_PWD" build.keychain
          rm /tmp/cert.p12
          # Sign + notarize the .app
          ENV=${{ needs.classify.outputs.env }}
          APP=$(find build/${ENV}-macos-arm64 -maxdepth 2 -name "*.app" -type d | head -1)
          if [ -z "$APP" ]; then
            echo "::error::No .app to sign"
            exit 1
          fi
          codesign --deep --force --options=runtime \
            --sign "Developer ID Application: ($APPLE_TEAM_ID)" \
            "$APP"
          ZIP=/tmp/notarize.zip
          ditto -c -k --keepParent "$APP" "$ZIP"
          xcrun notarytool submit "$ZIP" \
            --apple-id "$APPLE_NOTARIZE_USER" \
            --password "$APPLE_NOTARIZE_PASSWORD" \
            --team-id "$APPLE_TEAM_ID" \
            --wait
          xcrun stapler staple "$APP"

      - name: Ad-hoc sign (skip if Apple Developer signing already happened above)
        if: needs.classify.outputs.channel != 'stable' || env.APPLE_CERT_BASE64 == ''
        env:
          APPLE_CERT_BASE64: ${{ secrets.APPLE_CERT_BASE64 }}
        run: |
          ENV=${{ needs.classify.outputs.env }}
          APP=$(find build/${ENV}-macos-arm64 -maxdepth 2 -name "*.app" -type d | head -1)
          # Ad-hoc sign so the bundle is internally consistent. Doesn't bypass
          # Gatekeeper — users still need to de-quarantine — but prevents
          # App-Translocation oddness on macOS 14+.
          codesign --force --deep --sign - "$APP"

      - name: Package artifacts
        run: |
          ENV=${{ needs.classify.outputs.env }}
          CHANNEL=${{ needs.classify.outputs.channel }}
          VERSION=${{ needs.classify.outputs.version }}
          BUILD_DIR="build/${ENV}-macos-arm64"
          APP=$(find "$BUILD_DIR" -maxdepth 2 -name "*.app" -type d | head -1)
          DMG=$(find "$BUILD_DIR" -maxdepth 2 -name "*.dmg" -type f | head -1)
          ditto -c -k --keepParent "$APP" "Detour-${VERSION}-${CHANNEL}.zip"
          if [ -n "$DMG" ]; then
            cp "$DMG" "Detour-${VERSION}-${CHANNEL}.dmg"
          fi

      - name: Upload as workflow artifact
        uses: actions/upload-artifact@v4
        with:
          name: detour-${{ needs.classify.outputs.channel }}-${{ needs.classify.outputs.version }}
          path: |
            Detour-*-${{ needs.classify.outputs.channel }}.zip
            Detour-*-${{ needs.classify.outputs.channel }}.dmg
          retention-days: 90

      - name: Compose release body
        id: body
        env:
          VERSION: ${{ needs.classify.outputs.version }}
        run: |
          cat > release-body.md <<EOF
          ## Install

          One-liner (handles download + de-quarantine + install to /Applications):

          \`\`\`sh
          curl -fsSL https://raw.githubusercontent.com/Dexploarer/detour/main/scripts/install.sh | bash -s -- ${VERSION}
          \`\`\`

          Or manually:

          1. Download \`Detour-${VERSION}-${{ needs.classify.outputs.channel }}.zip\`, unzip, drag \`Detour.app\` into \`/Applications/\`.
          2. Strip the macOS quarantine flag (the build is unsigned by Apple Developer ID — free OSS):
             \`\`\`sh
             xattr -dr com.apple.quarantine /Applications/Detour.app
             \`\`\`
          3. Open. macOS won't ask again after the first launch.

          ---
          EOF

      - name: Attach to GitHub Release
        uses: softprops/action-gh-release@v2
        with:
          tag_name: ${{ github.event.inputs.tag || github.ref_name }}
          name: ${{ needs.classify.outputs.channel == 'stable' && format('Detour {0}', needs.classify.outputs.version) || format('Detour {0} ({1})', needs.classify.outputs.version, needs.classify.outputs.channel) }}
          prerelease: ${{ needs.classify.outputs.prerelease == 'true' }}
          make_latest: ${{ needs.classify.outputs.channel == 'stable' }}
          body_path: release-body.md
          append_body: true
          generate_release_notes: true
          files: |
            Detour-*-${{ needs.classify.outputs.channel }}.zip
            Detour-*-${{ needs.classify.outputs.channel }}.dmg
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}