release.yml

name: Release

# A tag publishes; a manual run builds the same artifacts without publishing,
# which is how a release is rehearsed before its version number is spent.
on:
  push:
    tags:
      - 'v*'
  workflow_dispatch:

permissions:
  contents: write

# Two runs for the same tag would race to create one release. Queue instead of
# cancelling, so a rehearsal already in flight still finishes.
concurrency:
  group: release-${{ github.ref }}
  cancel-in-progress: false

jobs:
  macos:
    runs-on: macos-latest
    steps:
      # The only target is arm64, and nothing else in the job would notice if
      # GitHub's default runner ever moved back to Intel.
      - name: Confirm the runner is arm64
        run: |
          if [ "$(uname -m)" != "arm64" ]; then
            echo "This build targets arm64 only; the runner reports $(uname -m)." >&2
            exit 1
          fi

      - uses: actions/checkout@v4

      # Reads the pinned version from package.json's packageManager field.
      - uses: pnpm/action-setup@v4

      # Deliberately uncached. Restoring the pnpm store replays Electron's
      # postinstall from cached output instead of extracting the download, and
      # that copy flattens the symlinks inside Electron Framework.framework.
      # codesign then calls the bundle ambiguous and refuses to verify it, so
      # the minute this saves costs the release its signature.
      - uses: actions/setup-node@v4
        with:
          node-version: 22

      - run: pnpm install --frozen-lockfile

      - run: pnpm typecheck

      - run: pnpm test

      # A tag naming a version the app does not carry would ship an artifact
      # whose filename disagrees with its own release page.
      - name: Confirm the tag matches the package version
        if: startsWith(github.ref, 'refs/tags/v')
        run: |
          tagged="${GITHUB_REF_NAME#v}"
          packaged="$(node -p "require('./package.json').version")"
          if [ "$tagged" != "$packaged" ]; then
            echo "Tag $GITHUB_REF_NAME does not match package.json version $packaged." >&2
            exit 1
          fi

      - name: Build the app
        # Without this, electron-builder searches the keychain for a Developer
        # ID this build deliberately does not have. Signing is ad-hoc and
        # happens in the afterPack hook.
        env:
          CSC_IDENTITY_AUTO_DISCOVERY: 'false'
        run: pnpm dist

      # An arm64 bundle with no signature at all installs fine and then fails to
      # launch with no error, so the signature is confirmed before publishing.
      - name: Confirm the bundle is signed
        run: codesign --verify --strict "release/mac-arm64/Codex Quota.app"

      - uses: actions/upload-artifact@v4
        with:
          name: codex-quota-macos-arm64
          path: |
            release/*.dmg
            release/*.zip
          if-no-files-found: error

  windows:
    runs-on: windows-latest
    steps:
      - uses: actions/checkout@v4

      - uses: pnpm/action-setup@v4

      - uses: actions/setup-node@v4
        with:
          node-version: 22

      - run: pnpm install --frozen-lockfile

      - run: pnpm typecheck

      - run: pnpm test

      - name: Confirm the tag matches the package version
        if: startsWith(github.ref, 'refs/tags/v')
        shell: pwsh
        run: |
          $tagged = $env:GITHUB_REF_NAME.Substring(1)
          $packaged = node -p "require('./package.json').version"
          if ($tagged -ne $packaged) {
            Write-Error "Tag $env:GITHUB_REF_NAME does not match package.json version $packaged."
            exit 1
          }

      - name: Build the Windows installer
        env:
          CSC_IDENTITY_AUTO_DISCOVERY: 'false'
        run: pnpm dist:win

      - uses: actions/upload-artifact@v4
        with:
          name: codex-quota-windows-x64
          path: |
            release/CodexQuota-*-win-*.exe
          if-no-files-found: error

  publish:
    if: startsWith(github.ref, 'refs/tags/v')
    needs: [macos, windows]
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - uses: actions/download-artifact@v4
        with:
          path: dist

      - name: Publish the release
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          cat > release-notes.md <<'NOTES'
          ## Install

          ### macOS

          Download the DMG, open it, and drag **Codex Quota** to Applications.

          The build is signed ad-hoc and is not notarized, so the first launch
          needs the quarantine flag cleared:

          ```bash
          xattr -dr com.apple.quarantine "/Applications/Codex Quota.app"
          ```

          Apple silicon only.

          ### Windows

          Download the NSIS installer (`CodexQuota-*-win-x64.exe`) and run it.
          Closing the window leaves the app in the notification area; quit from
          the tray icon.

          The installer is unsigned. Windows may show a SmartScreen warning on
          first launch — choose **More info** and **Run anyway** if you trust
          the build.

          The app runs whatever `codex` is already installed on the machine and
          does not bundle a copy.
          NOTES

          gh release create "$GITHUB_REF_NAME" \
            --title "Codex Quota $GITHUB_REF_NAME" \
            --notes-file release-notes.md \
            dist/codex-quota-macos-arm64/*.dmg \
            dist/codex-quota-macos-arm64/*.zip \
            dist/codex-quota-windows-x64/*.exe