publish-desktop.yml

name: Publish Desktop App
run-name: "${{ format('publish desktop {0}', github.event_name == 'workflow_dispatch' && inputs.tag || github.ref_name) }}"

# Triggered manually or by publish-executor-package.yml after a CLI release
# lands. Builds Electron distributables for mac/win/linux with the Bun-compiled
# sidecar bundled in `resources/sidecar/`, then attaches them to the GitHub
# release matching the tag so electron-updater can pick them up.

on:
  workflow_dispatch:
    inputs:
      tag:
        description: Git tag to publish (e.g. v1.4.1)
        required: true
        type: string

permissions:
  contents: read

concurrency:
  group: publish-desktop-${{ github.ref }}
  cancel-in-progress: false

jobs:
  build:
    permissions:
      contents: read
    strategy:
      fail-fast: false
      matrix:
        include:
          - os: macos-latest
            arch: arm64
            platform: mac
            bun-target: bun-darwin-arm64
          - os: macos-latest
            arch: x64
            platform: mac
            bun-target: bun-darwin-x64
          - os: ubuntu-latest
            arch: x64
            platform: linux
            bun-target: bun-linux-x64
          - os: windows-latest
            arch: x64
            platform: win
            bun-target: bun-windows-x64

    runs-on: ${{ matrix.os }}

    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          persist-credentials: false

      - name: Setup Bun
        uses: oven-sh/setup-bun@v2
        with:
          bun-version: 1.3.11

      - name: Validate release tag
        env:
          RAW_RELEASE_TAG: ${{ inputs.tag }}
        run: bun run scripts/validate-release-ref.ts --tag-env RAW_RELEASE_TAG --write-env RELEASE_TAG

      - name: Checkout release tag
        env:
          GH_TOKEN: ${{ secrets.RELEASE_PAT || github.token }}
        shell: bash
        run: |
          auth_remote="https://x-access-token:${GH_TOKEN}@github.com/${GITHUB_REPOSITORY}.git"
          git fetch --force --tags "$auth_remote" "refs/tags/$RELEASE_TAG:refs/tags/$RELEASE_TAG"
          git checkout --detach "$RELEASE_TAG"

      - name: Setup Node
        uses: actions/setup-node@v4
        with:
          node-version: 24

      - name: Install dependencies
        run: bun install --frozen-lockfile

      - name: Build web app
        run: bun run --filter @executor-js/local build

      - name: Build sidecar binary + stage web UI
        env:
          BUN_TARGET: ${{ matrix.bun-target }}
        run: bun ./scripts/build-sidecar.ts
        working-directory: apps/desktop

      - name: Build Electron main/preload/renderer
        run: bunx --bun electron-vite build
        working-directory: apps/desktop

      - name: Stage Apple API key (mac signing + notarization)
        if: matrix.platform == 'mac' && env.APPLE_API_KEY != ''
        env:
          APPLE_API_KEY: ${{ secrets.APPLE_API_KEY }}
        run: |
          mkdir -p "${RUNNER_TEMP}/private_keys"
          printf '%s' "$APPLE_API_KEY" > "${RUNNER_TEMP}/private_keys/AuthKey.p8"
          echo "APPLE_API_KEY_PATH=${RUNNER_TEMP}/private_keys/AuthKey.p8" >> "$GITHUB_ENV"

      - name: Build desktop distributables
        env:
          # electron-builder reads GH_TOKEN for the publish step. We use
          # --publish never here and attach assets explicitly in the release
          # job so we don't fight electron-updater's metadata expectations.
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          # Apple signing + notarization. electron-builder picks these up:
          #   CSC_LINK / CSC_KEY_PASSWORD → import the Developer ID Application
          #     cert (.p12, base64) into a temp keychain for codesign
          #   APPLE_API_KEY (file path) / APPLE_API_KEY_ID / APPLE_API_ISSUER
          #     → notarytool authentication for the notarization upload
          # When the secrets aren't set (forks, local), electron-builder
          # silently produces an unsigned build.
          CSC_LINK: ${{ secrets.CSC_LINK }}
          CSC_KEY_PASSWORD: ${{ secrets.CSC_KEY_PASSWORD }}
          APPLE_API_KEY: ${{ env.APPLE_API_KEY_PATH }}
          APPLE_API_KEY_ID: ${{ secrets.APPLE_API_KEY_ID }}
          APPLE_API_ISSUER: ${{ secrets.APPLE_API_ISSUER }}
        run: bunx --bun electron-builder --${{ matrix.platform }} --${{ matrix.arch }} --publish never --config electron-builder.config.ts
        working-directory: apps/desktop

      - name: Upload artifacts
        uses: actions/upload-artifact@v4
        with:
          name: desktop-${{ matrix.platform }}-${{ matrix.arch }}
          path: |
            apps/desktop/dist/*.dmg
            apps/desktop/dist/*.zip
            apps/desktop/dist/*.exe
            apps/desktop/dist/*.AppImage
            apps/desktop/dist/*.deb
            apps/desktop/dist/*.rpm
            apps/desktop/dist/latest*.yml
          if-no-files-found: warn

  release:
    needs: build
    runs-on: ubuntu-latest
    permissions:
      contents: write

    steps:
      - name: Checkout validation script
        uses: actions/checkout@v4
        with:
          persist-credentials: false

      - name: Setup Bun
        uses: oven-sh/setup-bun@v2
        with:
          bun-version: 1.3.11

      - name: Validate release tag
        env:
          RAW_RELEASE_TAG: ${{ inputs.tag }}
        run: bun run scripts/validate-release-ref.ts --tag-env RAW_RELEASE_TAG --write-env RELEASE_TAG

      - name: Download all artifacts
        uses: actions/download-artifact@v4
        with:
          path: artifacts
          merge-multiple: true

      - name: Upload to GitHub Release
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          set -euo pipefail
          while IFS= read -r file; do
            echo "Uploading: $file"
            gh release upload "$RELEASE_TAG" "$file" --repo "$GITHUB_REPOSITORY" --clobber
          done < <(find artifacts -type f \
            \( -name "*.dmg" -o -name "*.zip" -o -name "*.exe" \
            -o -name "*.AppImage" -o -name "*.deb" -o -name "*.rpm" \
            -o -name "latest*.yml" \))

      # Flip draft → published only after every desktop asset is uploaded —
      # this is the atomic point where the new tag becomes "latest".
      - name: Promote release (draft → published)
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: gh release edit "$RELEASE_TAG" --draft=false --repo "$GITHUB_REPOSITORY"