release.yml

# Desktop release pipeline — self-updating binaries for mac/linux/windows.
#
# Triggers:
#   - push of a tag matching `v*` (e.g. `v0.2.0`) → full release, publishes
#     artifacts + signed updater manifest (`latest.json`) to GH Releases.
#   - workflow_dispatch → on-demand build, uploads artifacts as workflow
#     artifacts only (no release, no updater manifest).
#
# Strategy: matrix builds per target. Each runner produces a PyInstaller
# frozen backend + Tauri bundle. `tauri-apps/tauri-action` signs the updater
# payloads with TAURI_SIGNING_PRIVATE_KEY and uploads to the GH Release for
# the tag. The built-in updater plugin polls the release's `latest.json` on
# client boot.
#
# Windows/Linux support: first-pass enabled. Expect the first few runs on
# each to surface PyInstaller/Tauri issues that never showed up locally on
# macOS — iterate on CI.

name: Desktop Release

on:
  push:
    tags: ['v*']
  workflow_dispatch:
    inputs:
      draft:
        description: "Create as draft release (tag push only)"
        required: false
        default: "true"

permissions:
  contents: write    # needed to attach artifacts + updater manifest to GH Release

env:
  # Run all JavaScript actions on Node 24 (GH deprecates Node 20 in Sep 2026).
  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true

jobs:
  # Fast gating job — runs backend pytest + frontend node:test + tsc on a
  # single Linux runner. The matrix build below waits on this via `needs:`
  # so we don't burn 4× platform-matrix minutes on a broken commit.
  test:
    name: Tests (backend + frontend)
    runs-on: ubuntu-22.04
    steps:
      - uses: actions/checkout@v4

      - name: Setup Python 3.11
        uses: actions/setup-python@v5
        with:
          python-version: "3.11"

      - name: Install uv
        uses: astral-sh/setup-uv@v3

      # Node 22 is needed for --experimental-strip-types so node:test can
      # import .ts files directly from frontend/src/api/*.
      - name: Setup Node 22
        uses: actions/setup-node@v4
        with:
          node-version: '22'

      - name: Setup Bun
        uses: oven-sh/setup-bun@v1

      # Backend tests need ffmpeg (subprocess calls in fixtures) + the minimal
      # apt deps pydub/imageio pull in. Model weights are mocked so no HF
      # downloads happen.
      - name: System deps (ffmpeg)
        run: |
          sudo apt-get update
          sudo apt-get install -y ffmpeg

      - name: Install Python deps
        run: uv sync

      - name: Run pytest
        run: uv run pytest tests/ -q --tb=short

      - name: Install frontend deps
        working-directory: frontend
        run: bun install

      - name: Frontend typecheck
        working-directory: frontend
        run: bunx tsc --noEmit

      # Invoke node directly (not `bun run test`) because `bun run` auto-aliases
      # `node` to `bun` in script bodies, and bun doesn't support
      # --experimental-strip-types.
      - name: Run frontend node:test
        working-directory: frontend
        run: node --experimental-strip-types --no-warnings --test ../tests/frontend/*.test.mjs

  build:
    needs: test
    strategy:
      fail-fast: false
      matrix:
        include:
          - os: macos-14
            arch: aarch64-apple-darwin
            label: "macOS Apple Silicon"
            rust_target: aarch64-apple-darwin
            bundles: "app,dmg,updater"

          - os: macos-13
            arch: x86_64-apple-darwin
            label: "macOS Intel"
            rust_target: x86_64-apple-darwin
            bundles: "app,dmg,updater"

          # Windows: force MSI bundling via --bundles. NSIS fails at makensis
          # because our PyInstaller payload approaches its ~2 GB stub limit.
          - os: windows-2022
            arch: x86_64-pc-windows-msvc
            label: "Windows x64"
            rust_target: x86_64-pc-windows-msvc
            bundles: "msi,updater"

          # Linux: ship .deb only. AppImage bundling (linuxdeploy) is
          # unreliable on GH Actions runners even with APPIMAGE_EXTRACT_AND_RUN.
          - os: ubuntu-22.04
            arch: x86_64-unknown-linux-gnu
            label: "Linux x64"
            rust_target: x86_64-unknown-linux-gnu
            bundles: "deb,updater"

    runs-on: ${{ matrix.os }}
    name: ${{ matrix.label }}

    steps:
      - uses: actions/checkout@v4

      # ── Language runtimes ──────────────────────────────────────────────
      - name: Setup Python 3.11
        uses: actions/setup-python@v5
        with:
          python-version: "3.11"

      - name: Install uv
        uses: astral-sh/setup-uv@v3

      - name: Setup Rust (stable)
        uses: dtolnay/rust-toolchain@stable
        with:
          targets: ${{ matrix.rust_target }}

      - name: Setup Bun
        uses: oven-sh/setup-bun@v1

      # ── Platform deps ──────────────────────────────────────────────────
      - name: macOS system deps
        if: runner.os == 'macOS'
        run: |
          brew install ffmpeg || true

      - name: Linux system deps
        if: runner.os == 'Linux'
        run: |
          sudo apt-get update
          sudo apt-get install -y \
            libwebkit2gtk-4.1-dev \
            build-essential curl wget file libxdo-dev libssl-dev \
            libayatana-appindicator3-dev librsvg2-dev \
            libasound2-dev ffmpeg

      # Windows: ffmpeg ships via imageio_ffmpeg inside the PyInstaller bundle,
      # no system-level install needed. PyInstaller picks it up automatically.

      # ── Python deps + PyInstaller ──────────────────────────────────────
      - name: Install Python deps
        run: uv sync

      # Windows + Linux default PyPI torch wheels bundle the full CUDA
      # runtime (~2 GB of libcuda*/libcublas*/libcudnn*). For a desktop
      # distribution we ship CPU-only inference and let the user opt into
      # GPU separately, so we re-install torch from PyTorch's CPU index to
      # strip the CUDA binaries. macOS wheels don't include CUDA so they
      # skip this step.
      - name: Re-install torch (CPU-only) on Linux/Windows
        if: runner.os != 'macOS'
        shell: bash
        run: |
          uv pip install --reinstall \
            torch==2.8.0 torchaudio==2.8.0 \
            --index-url https://download.pytorch.org/whl/cpu

      - name: Freeze backend via PyInstaller
        shell: bash
        run: |
          uv run pyinstaller backend.spec --noconfirm --clean
          echo "Backend frozen at dist/omnivoice-backend/"
          ls dist/omnivoice-backend/ | head
          # Report total bundle size so we can eyeball CI against GH's 2 GB
          # per-asset cap on Releases uploads.
          if [[ "$RUNNER_OS" == "Windows" ]]; then
            powershell -Command "(Get-ChildItem -Recurse dist/omnivoice-backend | Measure-Object -Property Length -Sum).Sum / 1MB"
          else
            du -sh dist/omnivoice-backend
          fi

      # ── Frontend build ─────────────────────────────────────────────────
      - name: Install frontend deps
        working-directory: frontend
        run: bun install

      # ── Tauri build + sign + publish ───────────────────────────────────
      # tauri-action handles: bundle, sign updater payload with the
      # TAURI_SIGNING_PRIVATE_KEY secret, attach to release, update
      # latest.json with per-platform download URLs & signatures.
      #
      # APPIMAGE_EXTRACT_AND_RUN=1: GH Actions runners disable FUSE, so the
      # linuxdeploy AppImage can't mount itself. Setting this env var tells
      # AppImages to extract-and-run instead, which works without FUSE.
      - name: Build + release (Tauri)
        uses: tauri-apps/tauri-action@v0
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
          TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
          APPIMAGE_EXTRACT_AND_RUN: 1
        with:
          projectPath: frontend
          args: --target ${{ matrix.rust_target }} --bundles ${{ matrix.bundles }}
          tagName: ${{ github.ref_name }}
          releaseName: "OmniVoice Studio ${{ github.ref_name }}"
          releaseBody: "Auto-generated release. See commit log for changes."
          releaseDraft: ${{ inputs.draft || 'true' }}
          prerelease: false
          updaterJsonPreferNsis: false
          includeUpdaterJson: true

      # The installer above ships WITHOUT the PyInstaller backend because a
      # single bundled asset (Linux .deb, Windows .msi) overshoots GH
      # Releases' 2 GB per-asset cap. Package the backend into its own tar.gz
      # and attach it to the same draft release; the Tauri app downloads and
      # extracts it from app_local_data_dir on first launch (see lib.rs →
      # ensure_backend_ready).
      - name: Package backend tarball
        shell: bash
        run: |
          VER="${GITHUB_REF_NAME#v}"
          OUT="omnivoice-backend_${VER}_${{ matrix.rust_target }}.tar.gz"
          tar -czf "$OUT" -C dist omnivoice-backend
          ls -lah "$OUT"
          echo "BACKEND_TARBALL=$OUT" >> "$GITHUB_ENV"

      - name: Upload backend tarball to draft release
        shell: bash
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          gh release upload "${{ github.ref_name }}" \
            "$BACKEND_TARBALL" \
            --repo "$GITHUB_REPOSITORY" \
            --clobber