release-desktop.yml

name: Release desktop

on:
  push:
    tags: ["v*"]
  workflow_dispatch:

permissions:
  contents: write

jobs:
  bundle:
    name: ${{ matrix.target }}
    runs-on: ${{ matrix.os }}
    strategy:
      fail-fast: false
      matrix:
        include:
          - os: macos-15
            target: macos-arm64
            args: --target aarch64-apple-darwin
          - os: macos-15
            target: macos-x64
            args: --target x86_64-apple-darwin
          - os: ubuntu-latest
            target: linux-x64
            args: ""
          - os: windows-latest
            target: windows-x64
            args: ""
    steps:
      - name: Checkout
        uses: actions/checkout@v4
      - name: Install Linux webkit dependencies
        if: matrix.os == 'ubuntu-latest'
        run: |
          sudo apt-get update
          # libayatana-appindicator, not the deprecated libappindicator:
          # `libappindicator-sys` dlopens `libayatana-appindicator3.so.1`
          # first and only falls back to the old name, and on Ubuntu 24.04
          # `libappindicator3-dev` is a transitional package for it anyway.
          # Without one of the two present at *runtime*, that dlopen panics and
          # the tray never appears — hence `bundle.linux.deb.depends`.
          sudo apt-get install -y libwebkit2gtk-4.1-dev libayatana-appindicator3-dev librsvg2-dev patchelf
      - name: Set up bun
        uses: oven-sh/setup-bun@v2
      - name: Add the Rust target
        if: matrix.os == 'macos-15'
        run: rustup target add aarch64-apple-darwin x86_64-apple-darwin
      - name: Cache cargo
        uses: Swatinem/rust-cache@v2
      - name: Install frontend dependencies
        working-directory: apps/desktop
        run: bun install --frozen-lockfile
      - name: Build and bundle
        uses: tauri-apps/tauri-action@v0
        env:
          # Used by tauri-action to create the draft release and upload every
          # platform's bundle. `contents: write` above grants this token that scope.
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          # All three are absent until the keypair is generated
          # (scripts/generate-updater-key.sh) and added to this repository's
          # secrets. Without them the bundle is unsigned, `latest.json` is not
          # produced, and `updater_enabled()` compiles to `false` — the
          # updater plugin is left out of the binary entirely rather than
          # registered with a fake key. This is the current state.
          TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
          TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
          # The public half of the same keypair (`sajilo.key.pub`'s contents),
          # baked into the binary at compile time so it never needs to live in
          # tauri.conf.json. Compiling it in, rather than reading it from a
          # runtime file, is what lets Rust build without it at all in dev.
          SAJILO_UPDATER_PUBKEY: ${{ secrets.SAJILO_UPDATER_PUBKEY }}
        with:
          projectPath: apps/desktop
          tagName: ${{ github.ref_name }}
          releaseName: Sajilo ${{ github.ref_name }}
          releaseDraft: true
          # GitHub excludes anything flagged pre-release from
          # /releases/latest/, which is the URL the updater polls — a
          # pre-release beta would be invisible to it. The `beta.N` in the
          # tag/version already says what it is; the release itself stays a
          # normal (non-pre-release) GitHub release so updates keep working.
          args: ${{ matrix.args }}
      # Tauri 2.11's AppImage bundler includes libwayland from the Ubuntu build
      # host. On rolling-release Wayland systems (including current Arch), that
      # library can conflict with the host Mesa EGL driver and prevent WebKitGTK
      # from creating a window. It also points GStreamer at a bundled plugin
      # directory that does not exist, which disables WebKitGTK audio codecs.
      # Keep Wayland and GStreamer plugin discovery system-provided.
      # See https://github.com/tauri-apps/tauri/issues/15665.
      - name: Repair AppImage Wayland compatibility
        if: matrix.target == 'linux-x64'
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          set -euo pipefail

          APPIMAGE=$(find "$GITHUB_WORKSPACE/target" -type f -name '*.AppImage' -print -quit)
          test -n "$APPIMAGE"
          chmod +x "$APPIMAGE"

          WORK=$(mktemp -d)
          trap 'rm -rf "$WORK"' EXIT
          (cd "$WORK" && "$APPIMAGE" --appimage-extract >/dev/null)

          if ! compgen -G "$WORK/squashfs-root/usr/lib/libwayland-*" > /dev/null; then
            echo "No bundled Wayland libraries found; leaving AppImage unchanged."
            exit 0
          fi

          rm -f "$WORK/squashfs-root/usr/lib/"libwayland-*
          sed -i '/GST_PLUGIN_SYSTEM_PATH/d' "$WORK/squashfs-root/AppRun"
          curl -fsSL -o "$WORK/appimagetool" \
            https://github.com/AppImage/appimagetool/releases/download/continuous/appimagetool-x86_64.AppImage
          echo "a6d71e2b6cd66f8e8d16c37ad164658985e0cf5fcaa950c90a482890cb9d13e0  $WORK/appimagetool" | sha256sum -c -
          chmod +x "$WORK/appimagetool"
          "$WORK/appimagetool" --appimage-extract-and-run "$WORK/squashfs-root" "$APPIMAGE.repaired"
          mv "$APPIMAGE.repaired" "$APPIMAGE"

          # tauri-action has already attached the original bundle. Replace that
          # asset so the draft release contains only the repaired AppImage.
          gh release upload "$GITHUB_REF_NAME" "$APPIMAGE" --clobber
      # tauri-action names every asset after the version
      # (Sajilo_0.1.3_x64.dmg), so a fixed download link in the README would
      # break on the next release. Uploading a second, version-free copy of
      # each installer gives the README a stable URL that never needs
      # editing. Runs after the AppImage repair above, so Linux's copy is
      # made from the repaired file, not the original.
      - name: Upload a stable-named copy for the README's direct download link
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        shell: bash
        run: |
          set -euo pipefail

          upload() {
            local stable="$1" pattern="$2"
            local src
            src=$(find "$GITHUB_WORKSPACE/target" -type f -iname "$pattern" -print -quit)
            if [ -z "$src" ]; then
              echo "No match for $pattern, skipping $stable" >&2
              return
            fi
            local dest="$RUNNER_TEMP/$stable"
            cp "$src" "$dest"
            gh release upload "$GITHUB_REF_NAME" "$dest" --clobber
          }

          case "${{ matrix.target }}" in
            macos-arm64)  upload Sajilo-macos-arm64.dmg      '*aarch64.dmg' ;;
            macos-x64)    upload Sajilo-macos-x64.dmg        '*x64.dmg' ;;
            windows-x64)  upload Sajilo-windows-x64.exe      '*setup.exe' ;;
            linux-x64)
              upload Sajilo-linux-amd64.deb        '*amd64.deb'
              upload Sajilo-linux-x86_64.AppImage  '*amd64.AppImage'
              ;;
          esac