release.yml

# Builds NotePane for macOS and Windows when a version tag is pushed, and
# uploads the installers to a draft GitHub release. Publishing the draft is a
# manual step: until then neither visitors nor the in-app update check see it.
# See docs/release.md for the release steps and the signing secrets.
name: Release

on:
  push:
    tags:
      - "v*"

permissions:
  contents: write

jobs:
  verify:
    runs-on: macos-latest
    steps:
      - uses: actions/checkout@v5
      - uses: actions/setup-node@v5
        with:
          node-version: 22
          cache: npm
      - name: Check the tag matches package.json
        run: |
          expected="v$(node -p 'require("./package.json").version')"
          if [ "$GITHUB_REF_NAME" != "$expected" ]; then
            echo "Tag $GITHUB_REF_NAME does not match package.json version $expected" >&2
            exit 1
          fi
      - run: npm ci
      - run: npm run verify:quick
      # Created once here so both build jobs upload to the same draft.
      - name: Create the draft release
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          gh release view "$GITHUB_REF_NAME" > /dev/null 2>&1 ||
            gh release create "$GITHUB_REF_NAME" --draft --generate-notes --title "NotePane $GITHUB_REF_NAME"

  package:
    needs: verify
    strategy:
      fail-fast: false
      matrix:
        os: [macos-latest, windows-latest]
    runs-on: ${{ matrix.os }}
    steps:
      - uses: actions/checkout@v5
      - uses: actions/setup-node@v5
        with:
          node-version: 22
          cache: npm
      - run: npm ci
      - name: Build and upload to the draft release
        shell: bash
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          # Signing is skipped while these secrets are unset; see docs/release.md.
          MAC_CERTIFICATE: ${{ secrets.MAC_CERTIFICATE }}
          MAC_CERTIFICATE_PASSWORD: ${{ secrets.MAC_CERTIFICATE_PASSWORD }}
          NOTARIZE_APPLE_ID: ${{ secrets.APPLE_ID }}
          NOTARIZE_APP_SPECIFIC_PASSWORD: ${{ secrets.APPLE_APP_SPECIFIC_PASSWORD }}
          NOTARIZE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
          WIN_CERTIFICATE: ${{ secrets.WIN_CERTIFICATE }}
          WIN_CERTIFICATE_PASSWORD: ${{ secrets.WIN_CERTIFICATE_PASSWORD }}
        # electron-builder reads an empty CSC_LINK as a path, so each signing
        # variable is exported only when its secret holds a value.
        run: |
          if [ "$RUNNER_OS" = "macOS" ] && [ -n "$MAC_CERTIFICATE" ]; then
            export CSC_LINK="$MAC_CERTIFICATE" CSC_KEY_PASSWORD="$MAC_CERTIFICATE_PASSWORD"
            if [ -n "$NOTARIZE_APPLE_ID" ]; then
              export APPLE_ID="$NOTARIZE_APPLE_ID"
              export APPLE_APP_SPECIFIC_PASSWORD="$NOTARIZE_APP_SPECIFIC_PASSWORD"
              export APPLE_TEAM_ID="$NOTARIZE_TEAM_ID"
            fi
          fi
          if [ "$RUNNER_OS" = "Windows" ] && [ -n "$WIN_CERTIFICATE" ]; then
            export WIN_CSC_LINK="$WIN_CERTIFICATE" WIN_CSC_KEY_PASSWORD="$WIN_CERTIFICATE_PASSWORD"
          fi
          npm run release:publish