release.yml

name: Update Version

on:
  workflow_dispatch:
    inputs:
      tag:
        description: Existing release tag to publish (vX.Y.Z)
        required: true
        type: string
  push:
    tags:
      - "v*"

permissions:
  contents: write

jobs:
  prepare-release:
    runs-on: ubuntu-latest
    outputs:
      release_tag: ${{ steps.release-tag.outputs.release_tag }}
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          fetch-depth: 0
          persist-credentials: false

      - name: Resolve release tag
        id: release-tag
        shell: bash
        run: |
          set -euo pipefail

          if [[ "${{ github.event_name }}" == "workflow_dispatch" ]]; then
            release_tag="${{ inputs.tag }}"
          else
            release_tag="${{ github.ref_name }}"
          fi

          if [[ ! "$release_tag" =~ ^v[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
            echo "Release tag must match vX.Y.Z, got: $release_tag" >&2
            exit 1
          fi

          echo "release_tag=$release_tag" >> "$GITHUB_OUTPUT"

      - name: Verify tag exists
        shell: bash
        run: |
          set -euo pipefail
          release_tag="${{ steps.release-tag.outputs.release_tag }}"
          git fetch --force --tags origin
          git rev-parse --verify "refs/tags/$release_tag" >/dev/null

      - name: Create or update GitHub release
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          GH_REPO: ${{ github.repository }}
          RELEASE_TAG: ${{ steps.release-tag.outputs.release_tag }}
        shell: bash
        run: |
          set -euo pipefail

          if gh release view "$RELEASE_TAG" >/dev/null 2>&1; then
            gh release edit "$RELEASE_TAG" --title "$RELEASE_TAG"
          else
            gh release create "$RELEASE_TAG" \
              --title "$RELEASE_TAG" \
              --generate-notes \
              --verify-tag
          fi

  release-linux:
    needs: prepare-release
    runs-on: ubuntu-latest
    env:
      RELEASE_TAG: ${{ needs.prepare-release.outputs.release_tag }}
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          ref: ${{ env.RELEASE_TAG }}
          submodules: recursive
          persist-credentials: false

      - name: Install Linux packaging dependencies
        run: |
          sudo apt-get update
          sudo apt-get install -y strip-nondeterminism libarchive-tools

      - name: Install Node.js
        uses: actions/setup-node@v4
        with:
          node-version: 24

      - name: Setup bun
        uses: oven-sh/setup-bun@v2

      - name: Install dependencies
        run: bun install --loglevel=info

      - name: Fetch
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: bun run fetch

      - name: Compile
        run: bun run webpack:prod

      - name: Package
        run: |
          node release-automation/build.js --debian --tarball --appimage --x64 --armv7l --arm64 --production
          node release-automation/build.js --pacman --x64 --arm64 --production

      - name: Print file tree
        run: node scripts/print-file-tree.js dist

      - name: Upload artifacts to GitHub Actions
        uses: actions/upload-artifact@v4
        with:
          name: linux
          path: |
            dist/*.deb
            dist/*.tar.gz
            dist/*.AppImage
            dist/*.pkg.tar.zst

      - name: Upload artifacts to release
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          GH_REPO: ${{ github.repository }}
        shell: bash
        run: |
          set -euo pipefail
          gh release upload "$RELEASE_TAG" \
            dist/*.deb \
            dist/*.tar.gz \
            dist/*.AppImage \
            dist/*.pkg.tar.zst \
            --clobber

  release-mac:
    needs: prepare-release
    runs-on: macos-latest
    env:
      RELEASE_TAG: ${{ needs.prepare-release.outputs.release_tag }}
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          ref: ${{ env.RELEASE_TAG }}
          submodules: recursive
          persist-credentials: false

      - name: Install Node.js
        uses: actions/setup-node@v4
        with:
          node-version: 24

      - name: Setup bun
        uses: oven-sh/setup-bun@v2

      - name: Install dependencies
        run: bun install --loglevel=info

      - name: Fetch
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: bun run fetch

      - name: Compile
        run: bun run webpack:prod

      - name: Package
        run: |
          node release-automation/build.js --mac --universal
          node release-automation/build.js --mac-legacy-10.13-10.14 --mac-legacy-10.15 --x64

      - name: Print file tree
        run: node scripts/print-file-tree.js dist

      - name: Upload artifacts to GitHub Actions
        uses: actions/upload-artifact@v4
        with:
          name: mac
          path: dist/*.dmg

      - name: Upload artifacts to release
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          GH_REPO: ${{ github.repository }}
        shell: bash
        run: |
          set -euo pipefail
          gh release upload "$RELEASE_TAG" dist/*.dmg --clobber

  release-windows:
    needs: prepare-release
    runs-on: windows-latest
    env:
      RELEASE_TAG: ${{ needs.prepare-release.outputs.release_tag }}
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          ref: ${{ env.RELEASE_TAG }}
          submodules: recursive
          persist-credentials: false
          path: repo

      - name: "Move repository to D: drive"
        run: |
          Copy-Item -Path repo -Destination D:\repo -Recurse
          Remove-Item -Path repo -Recurse -Force

      - name: Install Node.js
        uses: actions/setup-node@v4
        with:
          node-version: 24

      - name: Setup bun
        uses: oven-sh/setup-bun@v2

      - name: "Configure Bun cache and prefix to D: drive"
        run: |
          echo "BUN_INSTALL_CACHE_DIR=D:\bun-cache" >> $GITHUB_ENV
          echo "BUN_INSTALL_GLOBAL_DIR=D:\bun-global" >> $GITHUB_ENV

      - name: Install dependencies
        working-directory: D:\repo
        run: bun install --loglevel=info

      - name: Fetch
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        working-directory: D:\repo
        run: bun run fetch

      - name: Compile
        working-directory: D:\repo
        run: bun run webpack:prod

      - name: Package
        working-directory: D:\repo
        run: |
          node release-automation/build.js --windows --microsoft-store --x64 --ia32 --arm64 --production
          node release-automation/build.js --windows-portable --x64 --production
          node release-automation/build.js --windows-legacy --ia32 --x64 --production

      - name: Print file tree
        working-directory: D:\repo
        run: node scripts/print-file-tree.js dist

      - name: Sign Windows application
        working-directory: D:\repo
        run: deepsigntool\sign_windows.cmd

      - name: Upload signed artifacts to GitHub Actions
        uses: actions/upload-artifact@v4
        with:
          name: windows-signed
          path: |
            D:\repo\windows_signed\*.exe
            D:\repo\dist\*.appx

      - name: Upload artifacts to release
        working-directory: D:\repo
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          GH_REPO: ${{ github.repository }}
        shell: pwsh
        run: |
          $files = @(
            Get-ChildItem -Path 'D:\repo\windows_signed\*.exe' -File | Select-Object -ExpandProperty FullName
            Get-ChildItem -Path 'D:\repo\dist\*.appx' -File | Select-Object -ExpandProperty FullName
          ) | Where-Object { $_ }

          if (-not $files) {
            throw 'No Windows release assets were found to upload.'
          }

          gh release upload $env:RELEASE_TAG @files --clobber