release.yml

name: release

on:
  push:
    tags: ['v*']

jobs:
  release:
    name: draft release
    runs-on: macos-15
    permissions:
      contents: write
    steps:
      # git-cliff writes the notes from the commit history, so it needs one.
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - uses: oven-sh/setup-bun@v2
        with:
          bun-version: latest
      - uses: dtolnay/rust-toolchain@stable
      - uses: Swatinem/rust-cache@v2
        with:
          workspaces: app/src-tauri
      - run: bun install --frozen-lockfile
        working-directory: app
      - name: Stamp the version from the tag
        run: bun run scripts/set-version.ts "${GITHUB_REF_NAME}"
      # Not git-cliff-action: its runner script uses GNU stat and silently
      # produces nothing on macOS.
      - name: Write the notes from the commits
        id: notes
        run: |
          brew install git-cliff
          {
            echo 'content<<CLIFF_NOTES_EOF'
            git cliff --config cliff.toml --latest --strip header
            echo CLIFF_NOTES_EOF
          } >> "$GITHUB_OUTPUT"
      - uses: tauri-apps/tauri-action@v0
        with:
          projectPath: app
          tagName: ${{ github.ref_name }}
          releaseName: IconState ${{ github.ref_name }}
          releaseBody: ${{ steps.notes.outputs.content }}
          releaseDraft: true
          prerelease: false
          includeUpdaterJson: true
          args: --bundles app,dmg
        # To sign and notarise, add the Apple secrets to this step's env:
        # APPLE_CERTIFICATE, APPLE_CERTIFICATE_PASSWORD, APPLE_SIGNING_IDENTITY,
        # APPLE_ID, APPLE_PASSWORD, APPLE_TEAM_ID. They cannot sit here empty
        # waiting for the day — Tauri reads an empty APPLE_CERTIFICATE as a real
        # one and fails the build trying to import it.
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          # Signs the update package with the project's own key, which is what
          # lets the app install an update in place. Nothing to do with Apple.
          TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
          TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
      - name: Check the bundle
        run: ./scripts/verify-bundle.sh