release.yml

name: Release

on:
  pull_request:
    types:
      - closed
    branches:
      - master

permissions:
  contents: write

concurrency:
  group: release-master
  cancel-in-progress: false

env:
  NODE_VERSION: '22'
  RELEASE_CHANNEL: stable

jobs:
  prepare:
    name: Prepare release version
    runs-on: ubuntu-latest
    if: >-
      github.event.pull_request.merged == true &&
      github.event.pull_request.base.ref == 'master' &&
      github.event.pull_request.head.ref == 'develop' &&
      github.event.pull_request.head.repo.full_name == github.repository
    outputs:
      version: ${{ steps.version.outputs.version }}
      tag: ${{ steps.version.outputs.tag }}
      release_name: ${{ steps.version.outputs.release_name }}
      previous_tag: ${{ steps.version.outputs.previous_tag }}
      existing_tag: ${{ steps.version.outputs.existing_tag }}
    steps:
      - name: Check out merge commit
        uses: actions/checkout@v4
        with:
          fetch-depth: 0
          ref: ${{ github.event.pull_request.merge_commit_sha }}

      - name: Set up Node.js
        uses: actions/setup-node@v4
        with:
          node-version: ${{ env.NODE_VERSION }}

      - name: Compute release version
        id: version
        run: node ./scripts/compute-ci-release-version.cjs

  build-macos:
    name: Build macOS
    runs-on: macos-latest
    timeout-minutes: 90
    needs:
      - prepare
    env:
      KUN_APP_VERSION: ${{ needs.prepare.outputs.version }}
      KUN_UPDATE_CHANNEL: stable
      DEEPSEEK_GUI_APP_VERSION: ${{ needs.prepare.outputs.version }}
      DEEPSEEK_GUI_UPDATE_CHANNEL: stable
      RELEASE_CHANNEL: stable
      CSC_KEY_PASSWORD: ${{ secrets.CSC_KEY_PASSWORD }}
      APPLE_API_KEY_ID: ${{ secrets.APPLE_API_KEY_ID }}
      APPLE_API_ISSUER: ${{ secrets.APPLE_API_ISSUER }}
      CSC_FOR_PULL_REQUEST: 'true'
      # The renderer bundle can exceed Node's default ~2 GiB heap on the
      # macOS ARM runner; signed release packaging needs the same allowance
      # that PR packaging uses.
      NODE_OPTIONS: '--max-old-space-size=4096'
    steps:
      - name: Check out merge commit
        uses: actions/checkout@v4
        with:
          fetch-depth: 0
          ref: ${{ github.event.pull_request.merge_commit_sha }}

      - name: Set up Node.js
        uses: actions/setup-node@v4
        with:
          node-version: ${{ env.NODE_VERSION }}
          cache: npm

      - name: Install Whisper build tooling
        run: |
          brew install cmake

      - name: Install dependencies
        run: npm ci

      - name: Decode Apple signing credentials
        env:
          MAC_CODESIGN_P12_BASE64: ${{ secrets.MAC_CODESIGN_P12_BASE64 }}
          APPLE_API_KEY_BASE64: ${{ secrets.APPLE_API_KEY_BASE64 }}
        run: |
          set -euo pipefail

          for name in MAC_CODESIGN_P12_BASE64 CSC_KEY_PASSWORD APPLE_API_KEY_BASE64 APPLE_API_KEY_ID APPLE_API_ISSUER; do
            if [[ -z "${!name:-}" ]]; then
              echo "::error::Missing required secret or environment value: ${name}"
              exit 1
            fi
          done

          cert_path="${RUNNER_TEMP}/developer-id.p12"
          key_path="${RUNNER_TEMP}/AuthKey_${APPLE_API_KEY_ID}.p8"
          export CERT_PATH="${cert_path}"
          export KEY_PATH="${key_path}"

          node <<'NODE'
          const fs = require('node:fs')
          fs.writeFileSync(process.env.CERT_PATH, Buffer.from(process.env.MAC_CODESIGN_P12_BASE64, 'base64'))
          fs.writeFileSync(process.env.KEY_PATH, Buffer.from(process.env.APPLE_API_KEY_BASE64, 'base64'))
          NODE

          {
            echo "CSC_LINK=${cert_path}"
            echo "APPLE_API_KEY=${key_path}"
            echo "MAC_SIGN=1"
          } >> "${GITHUB_ENV}"

      - name: Verify Apple signing credentials
        run: >
          npm run verify:apple -- --p12 "${CSC_LINK}"
          --p12-password "${CSC_KEY_PASSWORD}"
          --p8 "${APPLE_API_KEY}"
          --key-id "${APPLE_API_KEY_ID}"
          --issuer "${APPLE_API_ISSUER}"
          --check-notary

      - name: Build signed macOS packages
        run: npm run dist:mac:signed

      - name: Smoke packaged update handoff (host-native macOS)
        timeout-minutes: 20
        shell: bash
        run: |
          set -euo pipefail
          if [[ "$(node -p 'process.arch')" == "arm64" ]]; then
            resources="dist/mac-arm64/Kun.app/Contents/Resources"
          else
            resources="dist/mac/Kun.app/Contents/Resources"
          fi
          npm run smoke:packaged-update-handoff -- --resources "${resources}"

      - name: Upload macOS artifacts
        uses: actions/upload-artifact@v4
        with:
          name: release-mac
          if-no-files-found: error
          retention-days: 7
          path: |
            dist/Kun-*-mac-*.dmg
            dist/Kun-*-mac-*.zip
            dist/Kun-*-mac-*.blockmap
            dist/latest-mac.yml

  build-windows:
    name: Build Windows
    runs-on: windows-latest
    timeout-minutes: 90
    needs:
      - prepare
    env:
      KUN_APP_VERSION: ${{ needs.prepare.outputs.version }}
      KUN_UPDATE_CHANNEL: stable
      DEEPSEEK_GUI_APP_VERSION: ${{ needs.prepare.outputs.version }}
      DEEPSEEK_GUI_UPDATE_CHANNEL: stable
      RELEASE_CHANNEL: stable
      CSC_IDENTITY_AUTO_DISCOVERY: 'false'
    steps:
      - name: Check out merge commit
        uses: actions/checkout@v4
        with:
          fetch-depth: 0
          ref: ${{ github.event.pull_request.merge_commit_sha }}

      - name: Set up Node.js
        uses: actions/setup-node@v4
        with:
          node-version: ${{ env.NODE_VERSION }}
          cache: npm

      - name: Install dependencies
        run: npm ci

      - name: Test Windows update rollback failpoints
        env:
          KUN_INSTALLER_TEST_ARTIFACT_ROOT: ${{ github.workspace }}\artifacts\windows-installer-transaction
        run: npx vitest run src/main/windows-installer-migration.transaction.test.ts

      - name: Upload Windows transaction diagnostics
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: release-windows-installer-transaction-diagnostics
          if-no-files-found: warn
          retention-days: 7
          path: |
            artifacts/windows-installer-transaction/**/diagnostic.log
            artifacts/windows-installer-transaction/**/journal.json
            artifacts/windows-installer-transaction/**/transaction.json
            artifacts/windows-installer-transaction/**/result-*.txt
            artifacts/windows-installer-transaction/**/fixture-summary.json

      - name: Build Windows installer
        run: npm run dist:win

      - name: Smoke Windows installer migration
        timeout-minutes: 60
        run: npm run smoke:windows-installer-migration -- -InstallerPath (Get-ChildItem dist/Kun-*-win-x64.exe | Select-Object -First 1 -ExpandProperty FullName)

      - name: Smoke packaged update handoff (Windows)
        timeout-minutes: 20
        run: npm run smoke:packaged-update-handoff -- --resources dist/win-unpacked/resources

      - name: Upload Windows artifacts
        uses: actions/upload-artifact@v4
        with:
          name: release-win
          if-no-files-found: error
          retention-days: 7
          path: |
            dist/Kun-*-win-x64.exe
            dist/Kun-*-win-x64.exe.blockmap
            dist/latest.yml

  build-linux:
    name: Build Linux (x64)
    runs-on: ubuntu-latest
    timeout-minutes: 90
    needs:
      - prepare
    env:
      KUN_APP_VERSION: ${{ needs.prepare.outputs.version }}
      KUN_UPDATE_CHANNEL: stable
      DEEPSEEK_GUI_APP_VERSION: ${{ needs.prepare.outputs.version }}
      DEEPSEEK_GUI_UPDATE_CHANNEL: stable
      RELEASE_CHANNEL: stable
      CSC_IDENTITY_AUTO_DISCOVERY: 'false'
    steps:
      - name: Check out merge commit
        uses: actions/checkout@v4
        with:
          fetch-depth: 0
          ref: ${{ github.event.pull_request.merge_commit_sha }}

      - name: Set up Node.js
        uses: actions/setup-node@v4
        with:
          node-version: ${{ env.NODE_VERSION }}
          cache: npm

      - name: Install Linux packaging dependencies
        run: |
          sudo apt-get update
          # build-essential + python3: node-pty ships no Linux prebuild, so it
          # must be compiled from source against Electron's ABI during dist.
          sudo apt-get install -y --no-install-recommends libarchive-tools rpm fakeroot dpkg build-essential python3 xvfb xauth

      - name: Install dependencies
        run: npm ci

      - name: Build Linux AppImage
        run: npm run dist:linux

      - name: Smoke packaged update handoff (Linux x64)
        timeout-minutes: 20
        env:
          KUN_CI_ALLOW_NO_SANDBOX: '1'
        run: |
          # Keep Chromium's sandbox under test. GitHub-hosted Ubuntu restricts
          # unprivileged user namespaces through AppArmor by default.
          sudo sysctl -w kernel.apparmor_restrict_unprivileged_userns=0
          node ./scripts/configure-linux-chrome-sandbox.cjs --resources dist/linux-unpacked/resources
          npm run smoke:packaged-update-handoff -- --resources dist/linux-unpacked/resources

      - name: Upload Linux artifacts
        uses: actions/upload-artifact@v4
        with:
          name: release-linux
          if-no-files-found: error
          retention-days: 7
          path: |
            dist/Kun-*-linux-x86_64.AppImage
            dist/Kun-*-linux-x86_64.AppImage.blockmap
            dist/Kun-*-linux-amd64.deb
            dist/latest-linux.yml

  build-linux-arm64:
    name: Build Linux (ARM64)
    runs-on: ubuntu-24.04-arm
    timeout-minutes: 90
    needs:
      - prepare
    env:
      KUN_APP_VERSION: ${{ needs.prepare.outputs.version }}
      KUN_UPDATE_CHANNEL: stable
      DEEPSEEK_GUI_APP_VERSION: ${{ needs.prepare.outputs.version }}
      DEEPSEEK_GUI_UPDATE_CHANNEL: stable
      RELEASE_CHANNEL: stable
      CSC_IDENTITY_AUTO_DISCOVERY: 'false'
    steps:
      - name: Check out merge commit
        uses: actions/checkout@v4
        with:
          fetch-depth: 0
          ref: ${{ github.event.pull_request.merge_commit_sha }}

      - name: Set up Node.js
        uses: actions/setup-node@v4
        with:
          node-version: ${{ env.NODE_VERSION }}
          cache: npm

      - name: Install Linux packaging dependencies
        run: |
          sudo apt-get update
          sudo apt-get install -y --no-install-recommends libarchive-tools rpm fakeroot dpkg build-essential python3 cmake file xvfb xauth

      - name: Install dependencies
        run: npm ci

      - name: Build Linux ARM64 AppImage and deb
        run: npm run dist:linux:arm64

      - name: Verify Linux ARM64 package architecture
        run: >-
          node ./scripts/verify-linux-package-architecture.mjs
          --version "${{ needs.prepare.outputs.version }}"
          --arch arm64
          --dist dist

      - name: Smoke packaged update handoff (Linux ARM64)
        timeout-minutes: 20
        env:
          KUN_CI_ALLOW_NO_SANDBOX: '1'
        run: |
          sudo sysctl -w kernel.apparmor_restrict_unprivileged_userns=0
          node ./scripts/configure-linux-chrome-sandbox.cjs --resources dist/linux-arm64-unpacked/resources
          npm run smoke:packaged-update-handoff -- --resources dist/linux-arm64-unpacked/resources

      - name: Upload Linux ARM64 artifacts
        uses: actions/upload-artifact@v4
        with:
          name: release-linux-arm64
          if-no-files-found: error
          retention-days: 7
          path: |
            dist/Kun-*-linux-arm64.AppImage
            dist/Kun-*-linux-arm64.AppImage.blockmap
            dist/Kun-*-linux-arm64.deb
            dist/latest-linux-arm64.yml

  build-tui:
    name: Build standalone TUI (${{ matrix.target }})
    runs-on: ${{ matrix.runner }}
    timeout-minutes: 60
    needs:
      - prepare
    strategy:
      fail-fast: false
      matrix:
        include:
          - runner: macos-15
            target: darwin-arm64
          - runner: macos-15-intel
            target: darwin-x64
          - runner: windows-2025
            target: win32-x64
          - runner: ubuntu-22.04
            target: linux-x64
          - runner: ubuntu-24.04-arm
            target: linux-arm64
    env:
      KUN_APP_VERSION: ${{ needs.prepare.outputs.version }}
      KUN_ARTIFACT_VERSION: ${{ needs.prepare.outputs.version }}
      KUN_UPDATE_CHANNEL: stable
      RELEASE_CHANNEL: stable
      TAG_NAME: ${{ needs.prepare.outputs.tag }}
      R2_PUBLIC_BASE_URL: ${{ secrets.R2_PUBLIC_BASE_URL }}
      R2_RELEASE_PREFIX: ${{ secrets.R2_RELEASE_PREFIX }}
    steps:
      - name: Check out merge commit
        uses: actions/checkout@v4
        with:
          fetch-depth: 0
          ref: ${{ github.event.pull_request.merge_commit_sha }}

      - name: Set up packaged Node.js
        uses: actions/setup-node@v4
        with:
          node-version: '22.23.1'
          cache: npm
          cache-dependency-path: |
            package-lock.json
            kun/package-lock.json

      - name: Install dependencies
        run: |
          npm ci
          npm --prefix kun ci

      - name: Build shared Kun runtime
        run: npm run build:kun

      - name: Package standalone TUI
        run: >-
          npm run package:tui --
          --version "${{ needs.prepare.outputs.version }}"
          --artifact-version "${{ needs.prepare.outputs.version }}"
          --tag "${{ needs.prepare.outputs.tag }}"
          --channel stable
          --commit "${{ github.event.pull_request.merge_commit_sha }}"
          --target "${{ matrix.target }}"
          --output dist

      - name: Upload standalone TUI artifact
        uses: actions/upload-artifact@v4
        with:
          name: release-tui-${{ matrix.target }}
          if-no-files-found: error
          retention-days: 7
          path: |
            dist/Kun-TUI-*.tar.gz
            dist/Kun-TUI-*.zip
            dist/Kun-TUI-*.sha256
            dist/Kun-TUI-*.json

  publish:
    name: Publish GitHub Release and R2
    runs-on: ubuntu-latest
    needs:
      - prepare
      - build-macos
      - build-windows
      - build-linux
      - build-linux-arm64
      - build-tui
    env:
      GH_TOKEN: ${{ github.token }}
      TAG_NAME: ${{ needs.prepare.outputs.tag }}
      RELEASE_VERSION: ${{ needs.prepare.outputs.version }}
      RELEASE_NAME: ${{ needs.prepare.outputs.release_name }}
      PREVIOUS_TAG: ${{ needs.prepare.outputs.previous_tag }}
      RELEASE_CHANNEL: stable
      KUN_UPDATE_CHANNEL: stable
      DEEPSEEK_GUI_UPDATE_CHANNEL: stable
      R2_BUCKET: ${{ secrets.R2_BUCKET }}
      R2_ACCOUNT_ID: ${{ secrets.R2_ACCOUNT_ID }}
      R2_ENDPOINT: ${{ secrets.R2_ENDPOINT }}
      R2_ACCESS_KEY_ID: ${{ secrets.R2_ACCESS_KEY_ID }}
      R2_SECRET_ACCESS_KEY: ${{ secrets.R2_SECRET_ACCESS_KEY }}
      R2_PUBLIC_BASE_URL: ${{ secrets.R2_PUBLIC_BASE_URL }}
      R2_RELEASE_PREFIX: ${{ secrets.R2_RELEASE_PREFIX }}
    steps:
      - name: Check out merge commit
        uses: actions/checkout@v4
        with:
          fetch-depth: 0
          ref: ${{ github.event.pull_request.merge_commit_sha }}

      - name: Set up Node.js
        uses: actions/setup-node@v4
        with:
          node-version: ${{ env.NODE_VERSION }}
          cache: npm

      - name: Install dependencies
        run: npm ci

      - name: Download release artifacts
        uses: actions/download-artifact@v4
        with:
          pattern: release-*
          path: release-artifacts
          merge-multiple: true

      - name: Rebuild shared GUI/TUI runtime identity
        env:
          KUN_APP_VERSION: ${{ needs.prepare.outputs.version }}
          KUN_ARTIFACT_VERSION: ${{ needs.prepare.outputs.version }}
          KUN_UPDATE_CHANNEL: stable
        run: npm run build:kun

      - name: Verify release artifacts
        run: |
          set -euo pipefail
          required=(
            "Kun-*-mac-arm64.dmg"
            "Kun-*-mac-x64.dmg"
            "Kun-*-mac-arm64.zip"
            "Kun-*-mac-x64.zip"
            "Kun-*-win-x64.exe"
            "Kun-*-linux-x86_64.AppImage"
            "Kun-*-linux-amd64.deb"
            "Kun-*-linux-arm64.AppImage"
            "Kun-*-linux-arm64.deb"
            "latest-mac.yml"
            "latest.yml"
            "latest-linux.yml"
            "latest-linux-arm64.yml"
            "Kun-TUI-${RELEASE_VERSION}-mac-arm64.tar.gz"
            "Kun-TUI-${RELEASE_VERSION}-mac-x64.tar.gz"
            "Kun-TUI-${RELEASE_VERSION}-win-x64.zip"
            "Kun-TUI-${RELEASE_VERSION}-linux-x64.tar.gz"
            "Kun-TUI-${RELEASE_VERSION}-linux-arm64.tar.gz"
          )

          for pattern in "${required[@]}"; do
            if ! compgen -G "release-artifacts/${pattern}" > /dev/null; then
              echo "::error::Missing release artifact matching ${pattern}"
              find release-artifacts -maxdepth 2 -type f -print | sort
              exit 1
            fi
          done

          find release-artifacts -maxdepth 2 -type f -print | sort

      - name: Assemble standalone TUI release contract
        run: >-
          npm run assemble:tui-release --
          --directory release-artifacts
          --version "${RELEASE_VERSION}"
          --artifact-version "${RELEASE_VERSION}"
          --tag "${TAG_NAME}"
          --channel "${RELEASE_CHANNEL}"
          --commit "$(git rev-parse HEAD)"
          --expected-build-id "$(node -p "require('./kun/dist/runtime-build.json').buildId")"
          --public-base-url "${R2_PUBLIC_BASE_URL}"
          --release-prefix "${R2_RELEASE_PREFIX:-deepseek-gui}"

      - name: Generate release notes
        run: |
          set -euo pipefail
          curated_notes="release/release-v${RELEASE_VERSION}.md"
          if [[ -f "${curated_notes}" ]]; then
            cp "${curated_notes}" release-notes.md
          elif [[ -n "${PREVIOUS_TAG}" ]]; then
            node ./scripts/generate-release-notes.cjs "${PREVIOUS_TAG}" > release-notes.md
          else
            node ./scripts/generate-release-notes.cjs > release-notes.md
          fi

          {
            echo
            echo "---"
            echo
            echo "### 构建信息"
            echo
            echo "- Release version: \`${RELEASE_VERSION}\`"
            echo "- Release channel: \`${RELEASE_CHANNEL}\`"
            echo "- Branch: \`master\`"
            echo "- Commit: \`${GITHUB_SHA::7}\`"
            echo "- macOS: Developer ID signed and notarized"
            echo "- Platforms: macOS arm64/x64, Windows x64, Linux arm64/x64 AppImage/deb"
            echo "- Standalone TUI: macOS arm64/x64, Windows x64, Linux arm64/x64"
          } >> release-notes.md

      - name: Ensure release tag
        run: |
          set -euo pipefail
          git config user.name "github-actions[bot]"
          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"

          head_sha="$(git rev-parse HEAD)"
          if git rev-parse -q --verify "refs/tags/${TAG_NAME}" > /dev/null; then
            tag_sha="$(git rev-list -n 1 "${TAG_NAME}")"
            if [[ "${tag_sha}" != "${head_sha}" ]]; then
              echo "::error::Tag ${TAG_NAME} points at ${tag_sha}, expected ${head_sha}"
              exit 1
            fi
            echo "Reusing existing tag ${TAG_NAME}"
          else
            git tag -a "${TAG_NAME}" -m "${RELEASE_NAME}" "${head_sha}"
            git push origin "refs/tags/${TAG_NAME}"
          fi

      - name: Create or update draft GitHub Release
        run: |
          set -euo pipefail
          if gh release view "${TAG_NAME}" > /dev/null 2>&1; then
            gh release edit "${TAG_NAME}" \
              --title "${RELEASE_NAME}" \
              --notes-file release-notes.md
          else
            gh release create "${TAG_NAME}" \
              --draft \
              --title "${RELEASE_NAME}" \
              --notes-file release-notes.md \
              --verify-tag
          fi

      - name: Upload GitHub Release assets
        run: |
          set -euo pipefail
          mapfile -d '' assets < <(
            find release-artifacts -type f \
              \( -name 'Kun-*' -o -name 'latest*.yml' -o -name 'release-tui.json' -o -name 'SHA256SUMS-tui.txt' \) \
              -print0
          )

          if [[ "${#assets[@]}" -eq 0 ]]; then
            echo "::error::No release assets found"
            exit 1
          fi

          gh release upload "${TAG_NAME}" "${assets[@]}" --clobber

      - name: Upload release archive to R2
        run: |
          set -euo pipefail
          node ./scripts/publish-r2.mjs upload --platform mac --dist release-artifacts --tag "${TAG_NAME}" --channel "${RELEASE_CHANNEL}"
          node ./scripts/publish-r2.mjs upload --platform win --dist release-artifacts --tag "${TAG_NAME}" --channel "${RELEASE_CHANNEL}"
          node ./scripts/publish-r2.mjs upload --platform linux --dist release-artifacts --tag "${TAG_NAME}" --channel "${RELEASE_CHANNEL}"
          node ./scripts/publish-r2.mjs upload-tui --dist release-artifacts --tag "${TAG_NAME}" --channel "${RELEASE_CHANNEL}"

      - name: Promote R2 latest
        run: >
          node ./scripts/publish-r2.mjs promote
          --tag "${TAG_NAME}"
          --channel "${RELEASE_CHANNEL}"
          --platforms mac,win,linux
          --require-tui

      - name: Publish GitHub Release
        run: gh release edit "${TAG_NAME}" --draft=false --prerelease=false --latest