release.yml

name: Release

# Pushing a tag vX.Y.Z (matching the workspace version) builds Botloft for
# Windows, Linux and macOS, each on its own runner, and opens one draft
# release with all of them; publishing it makes the in-app updater offer it
# (spec 15.5, 15.7). Run by hand on a branch, it builds the same files and
# keeps them as workflow artifacts, without attesting or releasing anything.
on:
  push:
    tags: ["v*"]
  workflow_dispatch:

permissions:
  contents: write
  # A build provenance attestation for each download (spec 15.5): anyone can
  # check with `gh attestation verify` that it came from this workflow.
  id-token: write
  attestations: write
  artifact-metadata: write

env:
  CARGO_TERM_COLOR: always
  # Code signing (spec 15.5). With the certificate's thumbprint in the
  # repository variable BOTLOFT_SIGN_THUMBPRINT, scripts/sign.mjs signs every
  # Windows binary; without it the release goes out unsigned, as today. The
  # step that puts the certificate in the runner's certificate store
  # (signing in to the cloud key's client) goes before "Build the signed
  # installer".
  BOTLOFT_SIGN_THUMBPRINT: ${{ vars.BOTLOFT_SIGN_THUMBPRINT }}
  BOTLOFT_SIGN_TIMESTAMP: ${{ vars.BOTLOFT_SIGN_TIMESTAMP }}
  # The updater's key signs every file the updater installs.
  TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
  TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}

jobs:
  build:
    name: Build (${{ matrix.system }})
    strategy:
      fail-fast: false
      matrix:
        include:
          - system: windows
            os: windows-latest
            files: target/release/bundle/release/*.exe
          # The oldest supported Ubuntu, so the AppImage runs on older
          # distributions too (it uses the glibc it was built with).
          - system: linux
            os: ubuntu-22.04
            files: |
              target/release/bundle/release/*.AppImage
              target/release/bundle/release/*.deb
          # Apple Silicon.
          - system: macos
            os: macos-latest
            files: |
              target/release/bundle/release/*.dmg
              target/release/bundle/release/*.app.tar.gz
    runs-on: ${{ matrix.os }}
    steps:
      - uses: actions/checkout@v5
      - if: github.ref_type == 'tag'
        run: node app/scripts/release.mjs check
      - uses: dtolnay/rust-toolchain@stable
      - uses: Swatinem/rust-cache@v2
      - uses: pnpm/action-setup@v4
        with:
          package_json_file: app/package.json
      - uses: actions/setup-node@v5
        with:
          node-version: 24
          cache: pnpm
          cache-dependency-path: app/pnpm-lock.yaml
      - name: Desktop libraries (Linux)
        if: matrix.system == 'linux'
        run: |
          sudo apt-get update
          sudo apt-get install -y --no-install-recommends libwebkit2gtk-4.1-dev \
            libayatana-appindicator3-dev librsvg2-dev libxdo-dev libssl-dev file
      - run: pnpm install --frozen-lockfile
        working-directory: app
      - name: Build the signed installer
        run: pnpm bundle
        working-directory: app
        env:
          # linuxdeploy, which makes the AppImage, is an AppImage too; the
          # runner has no FUSE to mount it.
          APPIMAGE_EXTRACT_AND_RUN: "1"
      - name: Build the setup window around it
        if: matrix.system == 'windows'
        run: pnpm bundle:setup
        working-directory: app
      - name: Stage the release files
        run: node app/scripts/release.mjs stage ${{ matrix.system }}
      - name: Attest where the downloads come from
        if: github.ref_type == 'tag'
        uses: actions/attest@v4
        with:
          subject-path: ${{ matrix.files }}
      - uses: actions/upload-artifact@v4
        with:
          name: release-${{ matrix.system }}
          path: target/release/bundle/release
          if-no-files-found: error

  publish:
    name: Draft release
    if: github.ref_type == 'tag'
    needs: build
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v5
      - uses: actions/download-artifact@v4
        with:
          pattern: release-*
          path: target/release/bundle/release
          merge-multiple: true
      - name: Open a draft release
        run: node app/scripts/release.mjs publish
        env:
          GH_TOKEN: ${{ github.token }}