desktop-release.yml

name: Desktop Release

# Required repository secrets for signed and notarized macOS packages:
# - MAC_CSC_LINK, MAC_CSC_KEY_PASSWORD, APPLE_ID,
#   APPLE_APP_SPECIFIC_PASSWORD, APPLE_TEAM_ID
# Optional Windows signing secrets:
# - WIN_CSC_LINK, WIN_CSC_KEY_PASSWORD

on:
  push:
    tags: ["v*.*.*"]
  workflow_dispatch:
    inputs:
      release_tag:
        description: "Existing version tag to rebuild and publish (leave blank to validate only)"
        required: false
        type: string

permissions:
  contents: read

jobs:
  verify-desktop:
    name: Verify release sources
    runs-on: ubuntu-latest

    steps:
      - name: Check out source
        uses: actions/checkout@v5
        with:
          ref: ${{ inputs.release_tag || github.ref }}

      - name: Set up Node.js
        uses: actions/setup-node@v5
        with:
          node-version: 22
          cache: npm

      - name: Install dependencies
        run: npm ci --prefer-offline --no-audit --no-fund

      - name: Verify release tag matches package version
        if: startsWith(github.ref, 'refs/tags/') || inputs.release_tag != ''
        env:
          RELEASE_TAG: ${{ inputs.release_tag || github.ref_name }}
        run: node -e "const version = require('./package.json').version; if (process.env.RELEASE_TAG !== 'v' + version) throw new Error('Tag ' + process.env.RELEASE_TAG + ' does not match package version ' + version)"

      - name: Type-check
        run: npm run typecheck

      - name: Test
        run: npm test

      - name: Build desktop sources
        run: npm run build:desktop

  package-desktop:
    name: Package ${{ matrix.name }}
    needs: verify-desktop
    strategy:
      fail-fast: false
      matrix:
        include:
          - name: macOS arm64
            os: macos-14
            platform: mac
            arch: arm64
            artifact: sqltunnel-macos-arm64
          - name: macOS x64
            os: macos-14
            platform: mac
            arch: x64
            artifact: sqltunnel-macos-x64
          - name: Windows x64
            os: windows-2022
            platform: win
            arch: x64
            artifact: sqltunnel-windows-x64
    runs-on: ${{ matrix.os }}
    env:
      ELECTRON_CACHE: ${{ github.workspace }}/../.cache/electron
      ELECTRON_BUILDER_CACHE: ${{ github.workspace }}/../.cache/electron-builder

    steps:
      - name: Check out source
        uses: actions/checkout@v5
        with:
          ref: ${{ inputs.release_tag || github.ref }}

      - name: Set up Node.js
        uses: actions/setup-node@v5
        with:
          node-version: 22
          cache: npm

      - name: Cache Electron build tools
        uses: actions/cache@v6
        with:
          path: |
            ${{ env.ELECTRON_CACHE }}
            ${{ env.ELECTRON_BUILDER_CACHE }}
          key: electron-${{ runner.os }}-${{ matrix.arch }}-${{ hashFiles('package-lock.json') }}
          restore-keys: |
            electron-${{ runner.os }}-${{ matrix.arch }}-

      - name: Install dependencies
        run: npm ci --prefer-offline --no-audit --no-fund

      - name: Build desktop sources
        run: npm run build:desktop

      - name: Package, sign, and notarize macOS ${{ matrix.arch }}
        if: matrix.platform == 'mac'
        env:
          CSC_LINK: ${{ secrets.MAC_CSC_LINK }}
          CSC_KEY_PASSWORD: ${{ secrets.MAC_CSC_KEY_PASSWORD }}
          SQLTUNNEL_APPLE_ID: ${{ secrets.APPLE_ID }}
          SQLTUNNEL_APPLE_APP_SPECIFIC_PASSWORD: ${{ secrets.APPLE_APP_SPECIFIC_PASSWORD }}
          SQLTUNNEL_APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
        run: |
          required_secrets=(
            CSC_LINK
            CSC_KEY_PASSWORD
            SQLTUNNEL_APPLE_ID
            SQLTUNNEL_APPLE_APP_SPECIFIC_PASSWORD
            SQLTUNNEL_APPLE_TEAM_ID
          )
          for secret_name in "${required_secrets[@]}"; do
            if [[ -z "${!secret_name}" ]]; then
              echo "::error::Required macOS signing secret is missing: $secret_name"
              exit 1
            fi
          done

          # electron-builder signs both the app and DMG. Apple credentials use
          # prefixed names so it does not notarize the app before the DMG exists.
          npx electron-builder --mac --${{ matrix.arch }} --publish never

          app_path="$(find release -type d -name '*.app' -print -quit)"
          dmg_path="$(find release -maxdepth 1 -type f -name '*.dmg' -print -quit)"
          if [[ -z "$app_path" || -z "$dmg_path" ]]; then
            echo "::error::Could not find the packaged app or DMG"
            exit 1
          fi

          codesign --verify --deep --strict --verbose=2 "$app_path"
          codesign --verify --strict --verbose=2 "$dmg_path"
          xcrun notarytool submit "$dmg_path" \
            --apple-id "$SQLTUNNEL_APPLE_ID" \
            --password "$SQLTUNNEL_APPLE_APP_SPECIFIC_PASSWORD" \
            --team-id "$SQLTUNNEL_APPLE_TEAM_ID" \
            --wait
          xcrun stapler staple "$dmg_path"
          xcrun stapler validate "$dmg_path"
          spctl --assess --type open \
            --context context:primary-signature --verbose=4 "$dmg_path"

      - name: Package Windows ${{ matrix.arch }}
        if: matrix.platform == 'win'
        env:
          SQLTUNNEL_WIN_CSC_LINK: ${{ secrets.WIN_CSC_LINK }}
          SQLTUNNEL_WIN_CSC_KEY_PASSWORD: ${{ secrets.WIN_CSC_KEY_PASSWORD }}
        run: |
          if ($env:SQLTUNNEL_WIN_CSC_LINK) {
            $env:CSC_LINK = $env:SQLTUNNEL_WIN_CSC_LINK
            $env:CSC_KEY_PASSWORD = $env:SQLTUNNEL_WIN_CSC_KEY_PASSWORD
          } else {
            $env:CSC_IDENTITY_AUTO_DISCOVERY = "false"
          }
          npx electron-builder --win --${{ matrix.arch }} --publish never

      - name: Upload desktop artifacts
        uses: actions/upload-artifact@v7
        with:
          name: ${{ matrix.artifact }}
          if-no-files-found: error
          retention-days: 14
          path: |
            release/*.dmg
            release/*-Setup.exe

  publish-release:
    name: Publish GitHub Release
    needs: package-desktop
    runs-on: ubuntu-latest
    permissions:
      contents: write

    steps:
      - name: Skip release for non-tag builds
        if: startsWith(github.ref, 'refs/tags/') == false && inputs.release_tag == ''
        run: echo "Desktop artifacts were validated; a GitHub Release is created only for version tags."

      - name: Download desktop artifacts
        if: startsWith(github.ref, 'refs/tags/') || inputs.release_tag != ''
        uses: actions/download-artifact@v8
        with:
          path: artifacts
          merge-multiple: true

      - name: Create or update GitHub Release
        if: startsWith(github.ref, 'refs/tags/') || inputs.release_tag != ''
        env:
          GH_TOKEN: ${{ github.token }}
          RELEASE_TAG: ${{ inputs.release_tag || github.ref_name }}
        run: |
          if gh release view "$RELEASE_TAG" --repo "$GITHUB_REPOSITORY" >/dev/null 2>&1; then
            gh release upload "$RELEASE_TAG" artifacts/* --clobber --repo "$GITHUB_REPOSITORY"
          else
            gh release create "$RELEASE_TAG" artifacts/* --verify-tag --generate-notes --title "SQLTunnel ${RELEASE_TAG#v}" --repo "$GITHUB_REPOSITORY"
          fi