release.yml

name: Release

on:
  push:
    tags:
      - "v*"
  # version-bump.yml pushes its `v*` tag using GITHUB_TOKEN, which GitHub
  # deliberately excludes from triggering the `push: tags:` rule above (to
  # prevent bot-authored pushes from cascading into unbounded workflow
  # runs) — so it dispatches this workflow directly instead. `--ref` on that
  # dispatch call points this run at the tag itself, so `github.ref_name`
  # below still resolves to the same `vX.Y.Z` a manually-pushed tag would.
  workflow_dispatch:

jobs:
  release:
    permissions:
      contents: write
    strategy:
      # One failing OS must not cancel the installers for the others.
      fail-fast: false
      matrix:
        include:
          - platform: windows-latest # NSIS setup + MSI
            args: ""
            targets: ""
          - platform: macos-latest # universal .dmg (Apple Silicon + Intel)
            args: "--target universal-apple-darwin"
            targets: "aarch64-apple-darwin,x86_64-apple-darwin"
          - platform: ubuntu-22.04 # .deb + .rpm + .AppImage
            args: ""
            targets: ""
    runs-on: ${{ matrix.platform }}
    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-node@v4
        with:
          node-version: 22

      - name: Install Linux build dependencies
        if: runner.os == 'Linux'
        run: |
          sudo apt-get update
          sudo apt-get install -y libwebkit2gtk-4.1-dev libgtk-3-dev \
            libayatana-appindicator3-dev librsvg2-dev libxdo-dev libssl-dev patchelf

      - uses: dtolnay/rust-toolchain@stable
        with:
          targets: ${{ matrix.targets }}

      - uses: swatinem/rust-cache@v2
        with:
          workspaces: src-tauri

      - run: npm ci

      # Apple's notarization API key is a file path, not an inline value —
      # decode it once here so the tauri-action step below can point
      # APPLE_API_KEY_PATH at it. No-op on Windows/Linux (the secret is only
      # consumed by the macOS codesign/notarize step in tauri-bundler).
      - name: Decode Apple notarization API key
        if: matrix.platform == 'macos-latest'
        run: |
          KEY_PATH="$RUNNER_TEMP/AppleAPIKey.p8"
          echo "${{ secrets.APPLE_API_KEY_P8_BASE64 }}" | base64 --decode -o "$KEY_PATH"
          echo "APPLE_API_KEY_PATH=$KEY_PATH" >> "$GITHUB_ENV"

      # tauri-action builds, signs the updater artifacts, and uploads every
      # matrix job's installers to the same tag release; latest.json is
      # merged across platforms. On macOS it also codesigns + notarizes the
      # .dmg/.app when the APPLE_* env vars below are present (tauri-bundler
      # imports the certificate into a temporary keychain and calls
      # notarytool itself — no manual codesign/notarytool steps needed here).
      - uses: tauri-apps/tauri-action@v0
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
          TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ""
          APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE_P12_BASE64 }}
          APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
          APPLE_SIGNING_IDENTITY: "Developer ID Application: Omar Jesus Hernandez Bastos (C34D3V8484)"
          APPLE_TEAM_ID: C34D3V8484
          APPLE_API_ISSUER: ${{ secrets.APPLE_API_ISSUER_ID }}
          APPLE_API_KEY: ${{ secrets.APPLE_API_KEY_ID }}
          APPLE_API_KEY_PATH: ${{ env.APPLE_API_KEY_PATH }}
        with:
          tagName: ${{ github.ref_name }}
          releaseName: "AFKode ${{ github.ref_name }}"
          releaseBody: "See the commit history for changes. Installers below; the updater feeds from latest.json."
          # Stays a draft until every matrix leg has actually finished — see
          # the `publish` job below. Without this, if e.g. only Windows and
          # Linux finish before macOS notarization fails, users could already
          # be downloading (and the updater already pointing at) a release
          # that's missing the macOS build entirely.
          releaseDraft: true
          prerelease: false
          args: ${{ matrix.args }}

  # Only flips the release public once every matrix leg above succeeded —
  # `needs.release.result` reflects the matrix job as a whole (success only
  # if every leg succeeded), not just the leg that happens to finish last.
  # If any leg failed, this job is skipped and the draft is left exactly as
  # it is — assets from whichever platforms did succeed, still private —
  # for a human to inspect rather than either quietly going out partial or
  # getting deleted.
  publish:
    needs: release
    if: needs.release.result == 'success'
    runs-on: ubuntu-latest
    permissions:
      contents: write
    steps:
      - name: Make the release public
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: gh release edit "${{ github.ref_name }}" --draft=false --repo ${{ github.repository }}

  winget:
    needs: publish
    runs-on: windows-latest
    # Requires the package to exist in winget-pkgs (initial PR merged);
    # a failure here must not affect the release itself.
    continue-on-error: true
    steps:
      - name: Submit manifest update to winget-pkgs
        shell: pwsh
        run: |
          $version = "${{ github.ref_name }}".TrimStart("v")
          $url = "https://github.com/ohernandezdev/afkode/releases/download/${{ github.ref_name }}/AFKode_${version}_x64-setup.exe"
          Invoke-WebRequest https://aka.ms/wingetcreate/latest -OutFile wingetcreate.exe
          .\wingetcreate.exe update OmarHernandez.AFKode --version $version --urls $url --submit --token "${{ secrets.WINGET_TOKEN }}"