publish.yml

name: "publish"

# change this when ready to release if you want CI/CD
on:
  workflow_dispatch:
    inputs:
      interactionId:
        description: "Discord Interaction ID"
        required: false
        type: string

env:
  CN_APPLICATION: cap/cap
  APP_CARGO_TOML: apps/desktop/src-tauri/Cargo.toml
  SENTRY_ORG: cap-s2
  SENTRY_PROJECT: cap-desktop

jobs:
  draft:
    runs-on: ubuntu-latest
    outputs:
      version: ${{ steps.read_version.outputs.value }}
      needs_release: ${{ steps.create_tag.outputs.tag_existed != 'true' }}
      cn_release_stdout: ${{ steps.create_cn_release.outputs.stdout }}
      gh_release_url: ${{ steps.create_gh_release.outputs.url }}
    permissions:
      contents: write
      id-token: write
    steps:
      - uses: actions/checkout@v4

      - name: Read version number
        uses: SebRollen/toml-action@v1.0.2
        id: read_version
        with:
          file: ${{ env.APP_CARGO_TOML }}
          field: "package.version"

      - name: Create tag
        id: create_tag
        if: ${{ steps.create_tag.outputs.tag_existed != 'true' }}
        uses: actions/github-script@v7
        with:
          script: |
            const tag = "cap-v${{ steps.read_version.outputs.value }}";
            const tagRef = `tags/${tag}`;

            const TAG_EXISTED = "tag_existed";
            const TAG_NAME = "tag_name";

            core.setOutput(TAG_NAME, tag);

            async function main() {
              let tagExisted = true;

              try {
                await github.rest.git.getRef({
                  ref: tagRef,
                  owner: context.repo.owner,
                  repo: context.repo.repo,
                });

                tagExisted = true;
                core.notice(`Release skipped as tag '${tag}' already exists. Update the version in '${{ env.APP_CARGO_TOML }}' before starting another release.`);
              } catch (error) {
                if ("status" in error && error.status === 404) tagExisted = false;
                else throw error;
              }

             	core.setOutput(TAG_EXISTED, tagExisted);

              if (!tagExisted)
                await github.rest.git.createRef({
                  ref: `refs/${tagRef}`,
                  owner: context.repo.owner,
                  repo: context.repo.repo,
                  sha: context.sha,
                });
            }

            main();

      - name: Create draft CN release
        id: create_cn_release
        uses: crabnebula-dev/cloud-release@v0
        with:
          command: release draft ${{ env.CN_APPLICATION }} ${{ steps.read_version.outputs.value }} --framework tauri
          api-key: ${{ secrets.CN_API_KEY }}

      - name: Create draft GH release
        id: create_gh_release
        # TODO: Change to stable version when available
        uses: softprops/action-gh-release@v2
        with:
          name: ${{ steps.read_version.outputs.value }}
          tag_name: ${{ steps.create_tag.outputs.tag_name }}
          draft: true
          generate_release_notes: true

      - name: Update Discord interaction
        if: ${{ inputs.interactionId != '' }}
        uses: actions/github-script@v7
        with:
          script: |
            async function main() {
              const token = await core.getIDToken("cap-discord-bot");
              const cnReleaseId = JSON.parse(`${{ steps.create_cn_release.outputs.stdout }}`).id;

              const resp = await fetch("https://cap-discord-bot.brendonovich.workers.dev/github-workflow", {
                method: "POST",
                body: JSON.stringify({
                  type: "release-ready",
                  tag: "${{ steps.create_tag.outputs.tag_name }}",
                  version: "${{ steps.read_version.outputs.value }}",
                  releaseUrl: "${{ steps.create_gh_release.outputs.url }}",
                  interactionId: "${{ inputs.interactionId }}",
                  cnReleaseId
                }),
                headers: {
                	"Content-Type": "application/json",
                  Authorization: `Bearer ${token}`,
                }
              });

              if(resp.status !== 200) throw new Error(await resp.text());
            }

            main();

  build:
    needs: draft
    if: ${{ needs.draft.outputs.needs_release == 'true' }}
    permissions:
      contents: write
      actions: read
    strategy:
      fail-fast: false
      matrix:
        settings:
          - target: x86_64-apple-darwin
            runner: macos-latest-large
          - target: aarch64-apple-darwin
            runner: macos-latest-large
          - target: x86_64-pc-windows-msvc
            runner: windows-latest
    env:
      TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }}
      TURBO_TEAM: ${{ secrets.TURBO_TEAM }}
    runs-on: ${{ matrix.settings.runner }}
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Create API Key File
        run: echo "${{ secrets.APPLE_API_KEY_FILE }}" > api.p8

      - uses: apple-actions/import-codesign-certs@v2
        if: ${{ matrix.settings.runner == 'macos-latest-large' }}
        with:
          p12-file-base64: ${{ secrets.APPLE_CERTIFICATE }}
          p12-password: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}

      - name: Verify certificate
        if: ${{ matrix.settings.runner == 'macos-latest-large' }}
        run: security find-identity -v -p codesigning ${{ runner.temp }}/build.keychain

      - name: Rust setup
        uses: dtolnay/rust-toolchain@stable
        with:
          targets: ${{ matrix.settings.target }}

      - name: Rust cache
        uses: swatinem/rust-cache@v2
        with:
          shared-key: ${{ matrix.settings.target }}
          save-if: ${{ github.ref == 'refs/heads/main' }}

      - uses: ./.github/actions/setup-js

      - name: Create .env file in root
        run: |
          echo "appVersion=${{ needs.draft.outputs.version }}" >> .env
          echo "VITE_ENVIRONMENT=production" >> .env
          echo "CAP_DESKTOP_SENTRY_URL=https://6a3b6a09e6ae976c2ad6fff710e88748@o4506859771527168.ingest.us.sentry.io/4508330917101568" >> .env
          echo "NEXT_PUBLIC_WEB_URL=${{ secrets.NEXT_PUBLIC_WEB_URL }}" >> .env
          echo 'NEXTAUTH_URL=${{ secrets.NEXT_PUBLIC_WEB_URL }}' >> .env
          echo 'VITE_POSTHOG_KEY=${{ secrets.VITE_POSTHOG_KEY }}' >> .env
          echo 'VITE_POSTHOG_HOST=${{ secrets.VITE_POSTHOG_HOST }}' >> .env
          echo 'VITE_SERVER_URL=${{ secrets.NEXT_PUBLIC_WEB_URL }}' >> .env
          echo 'RUST_TARGET_TRIPLE=${{ matrix.settings.target }}' >> .env

      - name: Build app
        working-directory: apps/desktop
        run: |
          pnpm -w cap-setup
          pnpm build:tauri --target ${{ matrix.settings.target }} --config src-tauri/tauri.prod.conf.json
        env:
          # https://github.com/tauri-apps/tauri-action/issues/740
          CI: false
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          # codesigning
          APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }}
          APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
          APPLE_SIGNING_IDENTITY: ${{ secrets.APPLE_SIGNING_IDENTITY }}
          # notarization
          APPLE_API_ISSUER: ${{ secrets.APPLE_API_ISSUER }}
          APPLE_API_KEY: ${{ secrets.APPLE_API_KEY }}
          APPLE_API_KEY_PATH: ${{ github.workspace }}/api.p8
          APPLE_KEYCHAIN: ${{ runner.temp }}/build.keychain
          TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
          TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}

      # - name: Upload unsigned Windows installer
      #   if: ${{ runner.os == 'Windows' }}
      #   id: upload_unsigned_windows_installer
      #   uses: actions/upload-artifact@v4
      #   with:
      #     name: unsigned-windows-installer
      #     path: target/${{ matrix.settings.target }}/release/bundle/nsis/*.exe
      #     if-no-files-found: error

      # - name: Submit SignPath signing request
      #   if: ${{ runner.os == 'Windows' }}
      #   id: submit_signpath_signing_request
      #   uses: signpath/github-action-submit-signing-request@v1
      #   with:
      #     api-token: ${{ secrets.SIGNPATH_API_TOKEN }}
      #     organization-id: ${{ secrets.SIGNPATH_ORGANIZATION_ID }}
      #     project-slug: ${{ secrets.SIGNPATH_PROJECT_SLUG }}
      #     signing-policy-slug: ${{ secrets.SIGNPATH_SIGNING_POLICY_SLUG }}
      #     github-artifact-id: ${{ steps.upload_unsigned_windows_installer.outputs.artifact-id }}
      #     wait-for-completion: true
      #     output-artifact-directory: signed-windows-installer

      # - name: Restore signed Windows installer
      #   if: ${{ runner.os == 'Windows' }}
      #   shell: pwsh
      #   run: |
      #     $signedDir = "signed-windows-installer"
      #     $bundleDir = "target/${{ matrix.settings.target }}/release/bundle/nsis"

      #     if (-not (Test-Path $signedDir)) {
      #       throw "Signed artifact directory '$signedDir' not found."
      #     }

      #     $executables = Get-ChildItem -Path $signedDir -Filter *.exe -Recurse
      #     if (-not $executables) {
      #       throw "No signed executables found in '$signedDir'."
      #     }

      #     # Copy signed executables back to the original bundle location for CrabNebula upload
      #     Write-Host "Copying signed executables to: $bundleDir"
      #     Copy-Item -Path (Join-Path $signedDir '*.exe') -Destination $bundleDir -Force

      #     # List the files to verify
      #     Write-Host "Files in bundle directory after signing:"
      #     Get-ChildItem -Path $bundleDir -Filter *.exe | ForEach-Object { Write-Host "  - $($_.Name)" }

      - name: Upload assets
        uses: crabnebula-dev/cloud-release@v0
        with:
          working-directory: apps/desktop
          command: release upload ${{ env.CN_APPLICATION }} "${{ needs.draft.outputs.version }}" --framework tauri
          api-key: ${{ secrets.CN_API_KEY }}
        env:
          TAURI_BUNDLE_PATH: ../..

      - uses: matbour/setup-sentry-cli@8ef22a4ff03bcd1ebbcaa3a36a81482ca8e3872e

      - name: Upload debug symbols to Sentry
        if: ${{ runner.os == 'macOS' }}
        shell: bash
        env:
          SENTRY_AUTH_TOKEN: ${{ secrets.SENTRY_AUTH_TOKEN }}
        run: |
          sentry-cli debug-files upload -o ${{ env.SENTRY_ORG }} -p ${{ env.SENTRY_PROJECT }} target/Cap.dSYM

      - name: Upload debug symbols to Sentry
        if: ${{ runner.os == 'Windows' }}
        shell: bash
        env:
          SENTRY_AUTH_TOKEN: ${{ secrets.SENTRY_AUTH_TOKEN }}
        run: |
          sentry-cli debug-files upload -o ${{ env.SENTRY_ORG }} -p ${{ env.SENTRY_PROJECT }} target/${{ matrix.settings.target }}/release/cap_desktop.pdb

  done:
    needs: [draft, build]
    runs-on: ubuntu-latest
    permissions:
      contents: write
      id-token: write
    steps:
      - name: Send Discord notification
        if: ${{ inputs.interactionId != '' }}
        uses: actions/github-script@v7
        with:
          script: |
            async function main() {
              const token = await core.getIDToken("cap-discord-bot");
              const cnReleaseId = JSON.parse(`${{ needs.draft.outputs.cn_release_stdout }}`).id;

              const resp = await fetch("https://cap-discord-bot.brendonovich.workers.dev/github-workflow", {
                method: "POST",
                body: JSON.stringify({
                  type: "release-done",
                  interactionId: "${{ inputs.interactionId }}",
                  version: "${{ needs.draft.outputs.version }}",
                  releaseUrl: "${{ needs.draft.outputs.gh_release_url }}",
                  cnReleaseId
                }),
                headers: {
                	"Content-Type": "application/json",
                  Authorization: `Bearer ${token}`,
                }
              });

              if(resp.status !== 200) throw new Error(await resp.text());
            }

            main();