release.yml

name: Release

on:
    push:
        # release-please watches main and opens a release PR; merging it creates
        # the tag + release, which then runs the build below.
        branches: [main]
        # Manual tags still work, for a release cut by hand.
        tags:
            - v*
    workflow_dispatch:

permissions:
    contents: write
    pull-requests: write

jobs:
    # Keeps a release PR up to date from conventional commits (feat/fix/...).
    # Merging that PR bumps package.json, writes the changelog, and publishes
    # the tag + GitHub release.
    release-please:
        if: github.event_name == 'push' && github.ref == 'refs/heads/main'
        runs-on: ubuntu-latest
        outputs:
            release_created: ${{ steps.release.outputs.release_created }}
            tag_name: ${{ steps.release.outputs.tag_name }}
        steps:
            - uses: googleapis/release-please-action@45996ed1f6d02564a971a2fa1b5860e934307cf7 # v5.0.0
              id: release
              with:
                  release-type: node

    release:
        needs: [release-please]
        # Build when release-please just published a release, or for the manual
        # paths (tag push / dispatch), where release-please is skipped.
        # release-please's own tag is pushed with GITHUB_TOKEN, which does NOT
        # trigger workflows — hence chaining on its output instead of the tag.
        if: >-
            always() && (
              needs.release-please.outputs.release_created == 'true' ||
              startsWith(github.ref, 'refs/tags/') ||
              github.event_name == 'workflow_dispatch'
            )
        runs-on: ${{ matrix.os }}
        # macOS needs Apple signing secrets that aren't configured yet — let it fail
        # without cancelling or failing the Windows/Linux builds.
        continue-on-error: ${{ matrix.platform == 'mac' }}

        strategy:
            fail-fast: false
            matrix:
                os: [macos-latest, ubuntu-latest, windows-latest]
                include:
                    - os: macos-latest
                      platform: mac
                    - os: ubuntu-latest
                      platform: linux
                    - os: windows-latest
                      platform: windows

        steps:
            - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
            - uses: oven-sh/setup-bun@v2

            - name: Install system dependencies
              if: ${{ matrix.platform == 'linux' }}
              # libarchive-tools (bsdtar) + zstd: needed by fpm to assemble the pacman target
              run: sudo apt-get update && sudo apt-get install -y libglib2.0-dev libarchive-tools zstd

            - name: Install dependencies
              run: bun install

            - name: Build
              run: bun run build

            - name: Run Electron Builder
              if: ${{ matrix.platform != 'mac' }}
              run: |
                  bun run electron-builder --${{ matrix.platform }} --publish always
              env:
                  GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

            - name: Run Electron Builder
              if: ${{ matrix.platform == 'mac' }}
              run: |
                  echo "$API_KEY" > apple.p8
                  bun run electron-builder --${{ matrix.platform }} --publish always
              env:
                  GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
                  CSC_LINK: ${{ secrets.APPLE_SIGNING_CERT }}
                  CSC_KEY_PASSWORD: ${{ secrets.APPLE_SIGNING_CERT_PASSWORD }}
                  API_KEY: ${{ secrets.APPLE_API_KEY }}
                  APPLE_API_KEY: apple.p8
                  APPLE_API_KEY_ID: ${{ secrets.APPLE_API_KEY_ID }}
                  APPLE_API_ISSUER: ${{ secrets.APPLE_API_ISSUER }}

    # Sign every release asset with the Project-Colony org key (ed25519).
    # Colony >= 0.8.0 verifies these signatures on install and REFUSES a
    # tampered asset. Runs for both release paths — release-please and a manual
    # tag — but not for a bare dispatch, which has no release to sign.
    sign:
        name: Sign release assets
        needs: [release-please, release]
        if: >-
            always() && needs.release.result == 'success' && (
              needs.release-please.outputs.release_created == 'true' ||
              startsWith(github.ref, 'refs/tags/')
            )
        runs-on: ubuntu-latest
        steps:
            - name: Download release binaries
              env:
                  GH_TOKEN: ${{ github.token }}
                  TAG: ${{ needs.release-please.outputs.tag_name || github.ref_name }}
              run: |
                  mkdir dist
                  gh release download "$TAG" -R "${{ github.repository }}" --dir dist
                  # Metadata companions are not signable assets.
                  rm -f dist/*.sig dist/*.sha256 dist/*.txt dist/*.yml dist/*.json dist/*.asc dist/*.blockmap

            - name: Sign
              env:
                  KEY: ${{ secrets.COLONY_SIGNING_KEY_PEM }}
              run: |
                  if [ -z "$KEY" ]; then
                    echo "::error::COLONY_SIGNING_KEY_PEM is not available - the release would ship unsigned."
                    exit 1
                  fi
                  printf '%s' "$KEY" > /tmp/key.pem
                  chmod 600 /tmp/key.pem
                  pub=$(mktemp)
                  openssl pkey -in /tmp/key.pem -pubout -out "$pub"
                  for f in dist/*; do
                    openssl pkeyutl -sign -inkey /tmp/key.pem -rawin -in "$f" -out "$f.sig"
                    openssl pkeyutl -verify -pubin -inkey "$pub" -rawin -in "$f" -sigfile "$f.sig" >/dev/null
                    echo "signed $(basename "$f")"
                  done
                  rm -f /tmp/key.pem

            # -R is required: this job never checks out the repo, so gh has no git
            # context to infer it from (without it: "fatal: not a git repository").
            - name: Upload signatures
              env:
                  GH_TOKEN: ${{ github.token }}
                  TAG: ${{ needs.release-please.outputs.tag_name || github.ref_name }}
              run: gh release upload "$TAG" dist/*.sig --clobber -R "${{ github.repository }}"