release-desktop-candidate.yml

name: Build Rootline Desktop Candidate

"on":
  workflow_dispatch:
    inputs:
      channel:
        description: Keep artifacts internal or publish a GitHub prerelease
        required: true
        default: internal
        type: choice
        options:
          - internal
          - public-beta
      beta_tag:
        description: Public beta tag in the form v2.0.0-beta.N
        required: false
        default: v2.0.0-beta.1
        type: string
      confirmation:
        description: Type build-rootline-candidate
        required: true
        type: string

permissions:
  contents: read

concurrency:
  group: desktop-candidate-${{ github.ref }}
  cancel-in-progress: false

jobs:
  preflight:
    runs-on: ubuntu-24.04
    environment: desktop-production
    steps:
      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
      - uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4
      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
        with:
          node-version: 20
          cache: pnpm
      - run: pnpm install --frozen-lockfile
      - run: pnpm audit --prod --audit-level high
      - name: Install minisign for updater key-pair proof
        run: sudo apt-get update && sudo apt-get install --yes minisign
      - name: Require reviewed master, confirmation, signing credentials, and hosted endpoints
        env:
          CHANNEL: ${{ inputs.channel }}
          BETA_TAG: ${{ inputs.beta_tag }}
          CONFIRMATION: ${{ inputs.confirmation }}
          APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }}
          APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
          APPLE_SIGNING_IDENTITY: ${{ secrets.APPLE_SIGNING_IDENTITY }}
          APPLE_ID: ${{ secrets.APPLE_ID }}
          APPLE_PASSWORD: ${{ secrets.APPLE_PASSWORD }}
          APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
          APPLE_KEYCHAIN_PASSWORD: ${{ secrets.APPLE_KEYCHAIN_PASSWORD }}
          WINDOWS_CERTIFICATE: ${{ secrets.WINDOWS_CERTIFICATE }}
          WINDOWS_CERTIFICATE_PASSWORD: ${{ secrets.WINDOWS_CERTIFICATE_PASSWORD }}
          TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
          TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
          TAURI_UPDATER_PUBLIC_KEY: ${{ vars.TAURI_UPDATER_PUBLIC_KEY }}
          VITE_AUTHENTIK_ISSUER: ${{ vars.VITE_AUTHENTIK_ISSUER }}
          VITE_AUTHENTIK_CLIENT_ID: ${{ vars.VITE_AUTHENTIK_CLIENT_ID }}
          VITE_ROOTLINE_SYNC_API: ${{ vars.VITE_ROOTLINE_SYNC_API }}
        run: |
          set -eu
          if [ "${GITHUB_REF}" != "refs/heads/master" ]; then
            echo "::error::Signed candidates must be built from reviewed master."
            exit 1
          fi
          if [ "${CONFIRMATION}" != "build-rootline-candidate" ]; then
            echo "::error::Candidate build blocked. Use confirmation=build-rootline-candidate."
            exit 1
          fi
          if [ "${CHANNEL}" = "public-beta" ] && ! printf '%s' "${BETA_TAG}" | grep -Eq '^v2[.]0[.]0-beta[.][0-9]+$'; then
            echo "::error::Public beta tag must match v2.0.0-beta.N."
            exit 1
          fi
          missing=""
          for name in APPLE_CERTIFICATE APPLE_CERTIFICATE_PASSWORD APPLE_SIGNING_IDENTITY APPLE_ID APPLE_PASSWORD APPLE_TEAM_ID APPLE_KEYCHAIN_PASSWORD WINDOWS_CERTIFICATE WINDOWS_CERTIFICATE_PASSWORD TAURI_SIGNING_PRIVATE_KEY TAURI_SIGNING_PRIVATE_KEY_PASSWORD TAURI_UPDATER_PUBLIC_KEY VITE_AUTHENTIK_ISSUER VITE_AUTHENTIK_CLIENT_ID VITE_ROOTLINE_SYNC_API; do
            eval "value=\${$name:-}"
            [ -n "$value" ] || missing="$missing $name"
          done
          if [ -n "$missing" ]; then
            echo "::error::Signed candidate blocked. Configure desktop-production secrets/variables:$missing"
            exit 1
          fi
          case "${VITE_AUTHENTIK_ISSUER}" in https://*) ;; *) echo "::error::VITE_AUTHENTIK_ISSUER must use HTTPS."; exit 1 ;; esac
          case "${VITE_ROOTLINE_SYNC_API}" in https://*) ;; *) echo "::error::VITE_ROOTLINE_SYNC_API must use HTTPS."; exit 1 ;; esac
          node -e "const p=require('./apps/desktop/package.json'); if(p.version !== '2.0.0') throw new Error('apps/desktop/package.json must be version 2.0.0')"
      - name: Prove updater private key, password, and public key match
        env:
          TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
          TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
          TAURI_UPDATER_PUBLIC_KEY: ${{ vars.TAURI_UPDATER_PUBLIC_KEY }}
        run: |
          set -eu
          challenge="$RUNNER_TEMP/rootline-candidate-key-pair-challenge"
          signature="$challenge.sig"
          public_key="$RUNNER_TEMP/rootline-updater-public.key"
          minisign_signature="$RUNNER_TEMP/rootline-candidate.minisig"
          printf '%s\n' "rootline-candidate-${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}" > "$challenge"
          if ! pnpm --filter @rootline/desktop tauri signer sign "$challenge" >/dev/null; then
            echo "::error::Candidate blocked: TAURI_SIGNING_PRIVATE_KEY or its password is invalid."
            exit 1
          fi
          if ! printf '%s' "$TAURI_UPDATER_PUBLIC_KEY" | base64 --decode > "$public_key"; then
            echo "::error::Candidate blocked: TAURI_UPDATER_PUBLIC_KEY is not valid base64."
            exit 1
          fi
          if ! base64 --decode < "$signature" > "$minisign_signature"; then
            echo "::error::Candidate blocked: Tauri produced an invalid updater signature."
            exit 1
          fi
          if ! minisign -Vm "$challenge" -p "$public_key" -x "$minisign_signature" >/dev/null; then
            echo "::error::Candidate blocked: private key, password, and public key do not form one updater keypair."
            exit 1
          fi

  macos-universal:
    needs: preflight
    runs-on: macos-15
    environment: desktop-production
    steps:
      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
      - uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4
      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
        with:
          node-version: 20
          cache: pnpm
      - uses: dtolnay/rust-toolchain@4360b52568e2003a75bf9bc1d59f33a8e3fc893c # stable
        with:
          targets: aarch64-apple-darwin,x86_64-apple-darwin
      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2
        with:
          workspaces: apps/desktop/src-tauri
      - run: pnpm install --frozen-lockfile
      - name: Import Developer ID certificate into an isolated keychain
        env:
          APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }}
          APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
          APPLE_SIGNING_IDENTITY: ${{ secrets.APPLE_SIGNING_IDENTITY }}
          KEYCHAIN_PASSWORD: ${{ secrets.APPLE_KEYCHAIN_PASSWORD }}
        run: |
          printf '%s' "$APPLE_CERTIFICATE" | base64 --decode > "$RUNNER_TEMP/rootline.p12"
          security create-keychain -p "$KEYCHAIN_PASSWORD" "$RUNNER_TEMP/rootline.keychain-db"
          security default-keychain -s "$RUNNER_TEMP/rootline.keychain-db"
          security unlock-keychain -p "$KEYCHAIN_PASSWORD" "$RUNNER_TEMP/rootline.keychain-db"
          security set-keychain-settings -t 3600 -u "$RUNNER_TEMP/rootline.keychain-db"
          security import "$RUNNER_TEMP/rootline.p12" -k "$RUNNER_TEMP/rootline.keychain-db" -P "$APPLE_CERTIFICATE_PASSWORD" -T /usr/bin/codesign
          security set-key-partition-list -S apple-tool:,apple:,codesign: -s -k "$KEYCHAIN_PASSWORD" "$RUNNER_TEMP/rootline.keychain-db"
          security find-identity -v -p codesigning "$RUNNER_TEMP/rootline.keychain-db" | grep -F "$APPLE_SIGNING_IDENTITY"
      - name: Build, sign, notarize, and staple macOS Universal candidate
        env:
          APPLE_SIGNING_IDENTITY: ${{ secrets.APPLE_SIGNING_IDENTITY }}
          APPLE_ID: ${{ secrets.APPLE_ID }}
          APPLE_PASSWORD: ${{ secrets.APPLE_PASSWORD }}
          APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
          TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
          TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
          TAURI_UPDATER_PUBLIC_KEY: ${{ vars.TAURI_UPDATER_PUBLIC_KEY }}
          VITE_AUTHENTIK_ISSUER: ${{ vars.VITE_AUTHENTIK_ISSUER }}
          VITE_AUTHENTIK_CLIENT_ID: ${{ vars.VITE_AUTHENTIK_CLIENT_ID }}
          VITE_ROOTLINE_SYNC_API: ${{ vars.VITE_ROOTLINE_SYNC_API }}
          CHANNEL: ${{ inputs.channel }}
          BETA_TAG: ${{ inputs.beta_tag }}
        run: |
          CANDIDATE_VERSION="2.0.0"
          if [ "$CHANNEL" = "public-beta" ]; then CANDIDATE_VERSION="${BETA_TAG#v}"; fi
          export CANDIDATE_VERSION
          node -e 'require("node:fs").writeFileSync(process.env.RUNNER_TEMP + "/updater-config.json", JSON.stringify({version:process.env.CANDIDATE_VERSION,plugins:{updater:{pubkey:process.env.TAURI_UPDATER_PUBLIC_KEY}}}))'
          pnpm --filter @rootline/desktop tauri build --target universal-apple-darwin --bundles app,dmg --config "$RUNNER_TEMP/updater-config.json"
      - name: Verify and stage signed candidate
        run: |
          set -eu
          bundle=apps/desktop/src-tauri/target/universal-apple-darwin/release/bundle
          app=$(find "$bundle/macos" -maxdepth 1 -type d -name '*.app' -print -quit)
          dmg=$(find "$bundle/dmg" -type f -name '*.dmg' -print -quit)
          updater=$(find "$bundle" -type f -name '*.app.tar.gz' -print -quit)
          [ -n "$app" ] && [ -n "$dmg" ] && [ -n "$updater" ] && [ -s "$updater.sig" ]
          codesign --verify --deep --strict --verbose=2 "$app"
          xcrun stapler validate "$dmg"
          mkdir release-assets
          cp "$dmg" release-assets/rootline-2.0.0-candidate-darwin-universal.dmg
          cp "$updater" release-assets/rootline-2.0.0-candidate-darwin-universal.app.tar.gz
          cp "$updater.sig" release-assets/rootline-2.0.0-candidate-darwin-universal.app.tar.gz.sig
      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
        with:
          name: rootline-candidate-darwin-universal
          path: release-assets
          if-no-files-found: error

  windows:
    needs: preflight
    environment: desktop-production
    strategy:
      fail-fast: false
      matrix:
        include:
          - platform: windows-x86_64
            runner: windows-2025
            target: x86_64-pc-windows-msvc
          - platform: windows-aarch64
            runner: windows-11-arm
            target: aarch64-pc-windows-msvc
    runs-on: ${{ matrix.runner }}
    steps:
      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
      - uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4
      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
        with:
          node-version: 20
          cache: pnpm
      - uses: dtolnay/rust-toolchain@4360b52568e2003a75bf9bc1d59f33a8e3fc893c # stable
        with:
          targets: ${{ matrix.target }}
      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2
        with:
          workspaces: apps/desktop/src-tauri
      - run: pnpm install --frozen-lockfile
      - name: Import Windows Authenticode certificate
        shell: pwsh
        env:
          WINDOWS_CERTIFICATE: ${{ secrets.WINDOWS_CERTIFICATE }}
          WINDOWS_CERTIFICATE_PASSWORD: ${{ secrets.WINDOWS_CERTIFICATE_PASSWORD }}
        run: |
          $certificatePath = Join-Path $env:RUNNER_TEMP "rootline.pfx"
          [IO.File]::WriteAllBytes($certificatePath, [Convert]::FromBase64String($env:WINDOWS_CERTIFICATE))
          $password = ConvertTo-SecureString $env:WINDOWS_CERTIFICATE_PASSWORD -AsPlainText -Force
          $certificate = Import-PfxCertificate -FilePath $certificatePath -CertStoreLocation Cert:\CurrentUser\My -Password $password
          if (-not $certificate.Thumbprint) { throw "Imported Windows certificate has no thumbprint." }
          "WINDOWS_CERTIFICATE_THUMBPRINT=$($certificate.Thumbprint)" >> $env:GITHUB_ENV
      - name: Build and Authenticode-sign Windows candidate
        shell: pwsh
        env:
          TAURI_TARGET: ${{ matrix.target }}
          TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
          TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
          TAURI_UPDATER_PUBLIC_KEY: ${{ vars.TAURI_UPDATER_PUBLIC_KEY }}
          VITE_AUTHENTIK_ISSUER: ${{ vars.VITE_AUTHENTIK_ISSUER }}
          VITE_AUTHENTIK_CLIENT_ID: ${{ vars.VITE_AUTHENTIK_CLIENT_ID }}
          VITE_ROOTLINE_SYNC_API: ${{ vars.VITE_ROOTLINE_SYNC_API }}
          CHANNEL: ${{ inputs.channel }}
          BETA_TAG: ${{ inputs.beta_tag }}
        run: |
          $version = "2.0.0"
          if ($env:CHANNEL -eq "public-beta") { $version = $env:BETA_TAG.Substring(1) }
          $config = @{ version = $version; bundle = @{ windows = @{ certificateThumbprint = $env:WINDOWS_CERTIFICATE_THUMBPRINT; digestAlgorithm = "sha256"; timestampUrl = "http://timestamp.digicert.com" } }; plugins = @{ updater = @{ pubkey = $env:TAURI_UPDATER_PUBLIC_KEY } } } | ConvertTo-Json -Compress -Depth 5
          pnpm --filter @rootline/desktop tauri build --target $env:TAURI_TARGET --bundles nsis --config $config
          if ($LASTEXITCODE -ne 0) { throw "Tauri Windows candidate build failed." }
      - name: Verify and stage signed candidate
        shell: pwsh
        env:
          PLATFORM: ${{ matrix.platform }}
          TAURI_TARGET: ${{ matrix.target }}
        run: |
          $bundle = "apps/desktop/src-tauri/target/$env:TAURI_TARGET/release/bundle"
          $installer = Get-ChildItem -Path $bundle -Recurse -File -Filter "*.exe" | Select-Object -First 1
          if (-not $installer -or -not (Test-Path "$($installer.FullName).sig")) { throw "Signed candidate artifacts are incomplete." }
          $authenticode = Get-AuthenticodeSignature $installer.FullName
          if ($authenticode.Status -ne "Valid") { throw "Installer Authenticode status is $($authenticode.Status)." }
          New-Item -ItemType Directory -Path release-assets | Out-Null
          Copy-Item $installer.FullName "release-assets/rootline-2.0.0-candidate-$env:PLATFORM-setup.exe"
          Copy-Item "$($installer.FullName).sig" "release-assets/rootline-2.0.0-candidate-$env:PLATFORM-setup.exe.sig"
      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
        with:
          name: rootline-candidate-${{ matrix.platform }}
          path: release-assets
          if-no-files-found: error

  publish-beta:
    if: inputs.channel == 'public-beta'
    needs: [preflight, macos-universal, windows]
    runs-on: ubuntu-24.04
    environment: desktop-production
    permissions:
      contents: write
    steps:
      - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
        with:
          pattern: rootline-candidate-*
          path: release-assets
          merge-multiple: true
      - name: Publish signed direct-download beta without touching the stable updater channel
        env:
          BETA_TAG: ${{ inputs.beta_tag }}
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          set -eu
          printf '%s\n' 'Rootline by baole.space signed beta. This prerelease does not publish latest.json; the installed beta can upgrade through the stable channel after v2.0.0 is released.' > release-notes.md
          gh release create "$BETA_TAG" release-assets/* --prerelease --target "$GITHUB_SHA" --title "Rootline by baole.space ${BETA_TAG}" --notes-file release-notes.md