release-dexdex.yml

name: Release dexdex

on:
  push:
    tags:
      - "dexdex@v*"
  workflow_dispatch:
    inputs:
      version:
        description: "Semver without v prefix (for example: 0.2.0)"
        required: true
      dry_run:
        description: "If true, skip release publication and Homebrew tap push"
        required: false
        default: "true"
        type: choice
        options:
          - "true"
          - "false"

permissions:
  contents: write
  id-token: write

concurrency:
  group: release-dexdex-${{ github.ref }}
  cancel-in-progress: false

jobs:
  prepare:
    name: Prepare metadata
    runs-on: ubuntu-latest
    outputs:
      tag: ${{ steps.meta.outputs.tag }}
      version: ${{ steps.meta.outputs.version }}
      dry_run: ${{ steps.meta.outputs.dry_run }}
    steps:
      - name: Resolve release metadata
        id: meta
        shell: bash
        run: |
          set -euo pipefail

          if [ "${GITHUB_EVENT_NAME}" = "workflow_dispatch" ]; then
            tag="dexdex@v${{ github.event.inputs.version }}"
            dry_run="${{ github.event.inputs.dry_run }}"
          else
            tag="${GITHUB_REF_NAME}"
            dry_run="false"
          fi

          version="${tag#dexdex@v}"

          echo "tag=$tag" >> "$GITHUB_OUTPUT"
          echo "version=$version" >> "$GITHUB_OUTPUT"
          echo "dry_run=$dry_run" >> "$GITHUB_OUTPUT"

  build-desktop:
    name: Build desktop (${{ matrix.os }})
    runs-on: ${{ matrix.os }}
    needs: prepare
    strategy:
      fail-fast: false
      matrix:
        include:
          - os: ubuntu-latest
            artifact_name: dexdex-desktop-linux-amd64.AppImage
            finder_pattern: '*.AppImage'
          - os: macos-latest
            artifact_name: dexdex-desktop-darwin-universal.dmg
            finder_pattern: '*.dmg'
          - os: windows-latest
            artifact_name: dexdex-desktop-windows-amd64.msi
            finder_pattern: '*.msi'
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Setup pnpm
        uses: pnpm/action-setup@v4
        with:
          version: 10.26.2

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version-file: .nvmrc
          cache: pnpm
          cache-dependency-path: pnpm-lock.yaml

      - name: Setup Rust toolchain
        uses: dtolnay/rust-toolchain@master
        with:
          toolchain: stable

      - name: Cache Rust dependencies
        uses: Swatinem/rust-cache@v2

      - name: Install Linux system dependencies
        if: runner.os == 'Linux'
        shell: bash
        run: |
          set -euo pipefail
          sudo apt-get update
          sudo apt-get install -y \
            libwebkit2gtk-4.1-dev \
            libgtk-3-dev \
            libayatana-appindicator3-dev \
            librsvg2-dev \
            patchelf

      - name: Install dependencies
        shell: bash
        run: pnpm install --frozen-lockfile

      - name: Build DexDex desktop
        shell: bash
        env:
          APPLE_CERTIFICATE: ${{ secrets.DEXDEX_APPLE_CERTIFICATE_BASE64 }}
          APPLE_CERTIFICATE_PASSWORD: ${{ secrets.DEXDEX_APPLE_CERTIFICATE_PASSWORD }}
          APPLE_SIGNING_IDENTITY: ${{ secrets.DEXDEX_APPLE_SIGNING_IDENTITY }}
          APPLE_ID: ${{ secrets.DEXDEX_APPLE_ID }}
          APPLE_PASSWORD: ${{ secrets.DEXDEX_APPLE_PASSWORD }}
          APPLE_TEAM_ID: ${{ secrets.DEXDEX_APPLE_TEAM_ID }}
          TAURI_PRIVATE_KEY: ${{ secrets.DEXDEX_TAURI_PRIVATE_KEY }}
          TAURI_KEY_PASSWORD: ${{ secrets.DEXDEX_TAURI_KEY_PASSWORD }}
          WINDOWS_CERTIFICATE: ${{ secrets.DEXDEX_WINDOWS_CERTIFICATE_BASE64 }}
          WINDOWS_CERTIFICATE_PASSWORD: ${{ secrets.DEXDEX_WINDOWS_CERTIFICATE_PASSWORD }}
        run: pnpm --filter dexdex tauri:build

      - name: Collect desktop artifact
        shell: bash
        run: |
          set -euo pipefail

          mkdir -p dist
          bundle_root="apps/dexdex/src-tauri/target/release/bundle"
          found_artifact="$(find "$bundle_root" -type f -name "${{ matrix.finder_pattern }}" | head -n1)"

          if [ -z "$found_artifact" ]; then
            echo "failed to find desktop artifact matching pattern: ${{ matrix.finder_pattern }}" >&2
            exit 1
          fi

          cp "$found_artifact" "dist/${{ matrix.artifact_name }}"

      - name: Upload desktop artifact
        uses: actions/upload-artifact@v4
        with:
          name: dexdex-desktop-${{ runner.os }}
          path: dist/*

  build-servers:
    name: Build servers
    runs-on: ubuntu-latest
    needs: prepare
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Setup Go
        uses: actions/setup-go@v5
        with:
          go-version-file: go.mod
          cache-dependency-path: go.sum

      - name: Build server artifacts
        shell: bash
        run: |
          set -euo pipefail

          mkdir -p dist build

          while read -r goos goarch archive_ext; do
            main_output="dexdex-main-server"
            worker_output="dexdex-worker-server"

            if [ "$goos" = "windows" ]; then
              main_output="${main_output}.exe"
              worker_output="${worker_output}.exe"
            fi

            GOOS="$goos" GOARCH="$goarch" go build -trimpath -ldflags="-s -w" -o "build/$main_output" ./servers/dexdex-main-server
            GOOS="$goos" GOARCH="$goarch" go build -trimpath -ldflags="-s -w" -o "build/$worker_output" ./servers/dexdex-worker-server

            main_asset="dexdex-main-server-${goos}-${goarch}.${archive_ext}"
            worker_asset="dexdex-worker-server-${goos}-${goarch}.${archive_ext}"

            if [ "$archive_ext" = "zip" ]; then
              zip -j "dist/$main_asset" "build/$main_output"
              zip -j "dist/$worker_asset" "build/$worker_output"
            else
              tar -C build -czf "dist/$main_asset" "$main_output"
              tar -C build -czf "dist/$worker_asset" "$worker_output"
            fi
          done <<'TARGETS'
          linux amd64 tar.gz
          darwin amd64 tar.gz
          darwin arm64 tar.gz
          windows amd64 zip
          TARGETS

      - name: Upload server artifacts
        uses: actions/upload-artifact@v4
        with:
          name: dexdex-servers
          path: dist/*

  publish:
    name: Publish release
    runs-on: ubuntu-latest
    needs:
      - prepare
      - build-desktop
      - build-servers
    env:
      RELEASE_TAG: ${{ needs.prepare.outputs.tag }}
      RELEASE_VERSION: ${{ needs.prepare.outputs.version }}
      DRY_RUN: ${{ needs.prepare.outputs.dry_run }}
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Download artifacts
        uses: actions/download-artifact@v4
        with:
          path: dist

      - name: Flatten artifact directory
        shell: bash
        run: |
          set -euo pipefail

          mkdir -p release-dist
          find dist -maxdepth 3 -type f -exec cp {} release-dist/ \;
          rm -rf dist
          mv release-dist dist
          find dist -maxdepth 1 -type f | sed 's#^#artifact: #' >&2

      - name: Install cosign
        uses: sigstore/cosign-installer@v3.8.1

      - name: Generate checksums and signatures
        shell: bash
        run: |
          set -euo pipefail
          chmod +x ./scripts/release/generate-checksums.sh
          ./scripts/release/generate-checksums.sh --artifacts-dir dist

      - name: Create GitHub release
        if: env.DRY_RUN != 'true'
        uses: softprops/action-gh-release@v2
        with:
          tag_name: ${{ env.RELEASE_TAG }}
          files: dist/*
          generate_release_notes: true

      - name: Render Homebrew updates
        if: env.DRY_RUN == 'true'
        shell: bash
        run: |
          set -euo pipefail

          chmod +x ./scripts/release/update-homebrew.sh

          main_darwin_amd64_asset="dexdex-main-server-darwin-amd64.tar.gz"
          main_darwin_amd64_sha="$(grep " ${main_darwin_amd64_asset}$" dist/SHA256SUMS | awk '{print $1}')"
          main_darwin_amd64_url="https://github.com/delinoio/oss/releases/download/${RELEASE_TAG}/${main_darwin_amd64_asset}"

          main_darwin_arm64_asset="dexdex-main-server-darwin-arm64.tar.gz"
          main_darwin_arm64_sha="$(grep " ${main_darwin_arm64_asset}$" dist/SHA256SUMS | awk '{print $1}')"
          main_darwin_arm64_url="https://github.com/delinoio/oss/releases/download/${RELEASE_TAG}/${main_darwin_arm64_asset}"

          main_linux_amd64_asset="dexdex-main-server-linux-amd64.tar.gz"
          main_linux_amd64_sha="$(grep " ${main_linux_amd64_asset}$" dist/SHA256SUMS | awk '{print $1}')"
          main_linux_amd64_url="https://github.com/delinoio/oss/releases/download/${RELEASE_TAG}/${main_linux_amd64_asset}"

          worker_darwin_amd64_asset="dexdex-worker-server-darwin-amd64.tar.gz"
          worker_darwin_amd64_sha="$(grep " ${worker_darwin_amd64_asset}$" dist/SHA256SUMS | awk '{print $1}')"
          worker_darwin_amd64_url="https://github.com/delinoio/oss/releases/download/${RELEASE_TAG}/${worker_darwin_amd64_asset}"

          worker_darwin_arm64_asset="dexdex-worker-server-darwin-arm64.tar.gz"
          worker_darwin_arm64_sha="$(grep " ${worker_darwin_arm64_asset}$" dist/SHA256SUMS | awk '{print $1}')"
          worker_darwin_arm64_url="https://github.com/delinoio/oss/releases/download/${RELEASE_TAG}/${worker_darwin_arm64_asset}"

          worker_linux_amd64_asset="dexdex-worker-server-linux-amd64.tar.gz"
          worker_linux_amd64_sha="$(grep " ${worker_linux_amd64_asset}$" dist/SHA256SUMS | awk '{print $1}')"
          worker_linux_amd64_url="https://github.com/delinoio/oss/releases/download/${RELEASE_TAG}/${worker_linux_amd64_asset}"

          desktop_asset="dexdex-desktop-darwin-universal.dmg"
          desktop_sha="$(grep " ${desktop_asset}$" dist/SHA256SUMS | awk '{print $1}')"
          desktop_url="https://github.com/delinoio/oss/releases/download/${RELEASE_TAG}/${desktop_asset}"

          ./scripts/release/update-homebrew.sh \
            --project dexdex-main-server \
            --version "$RELEASE_VERSION" \
            --darwin-amd64-url "$main_darwin_amd64_url" \
            --darwin-amd64-sha256 "$main_darwin_amd64_sha" \
            --darwin-arm64-url "$main_darwin_arm64_url" \
            --darwin-arm64-sha256 "$main_darwin_arm64_sha" \
            --linux-amd64-url "$main_linux_amd64_url" \
            --linux-amd64-sha256 "$main_linux_amd64_sha" \
            --dry-run >/dev/null

          ./scripts/release/update-homebrew.sh \
            --project dexdex-worker-server \
            --version "$RELEASE_VERSION" \
            --darwin-amd64-url "$worker_darwin_amd64_url" \
            --darwin-amd64-sha256 "$worker_darwin_amd64_sha" \
            --darwin-arm64-url "$worker_darwin_arm64_url" \
            --darwin-arm64-sha256 "$worker_darwin_arm64_sha" \
            --linux-amd64-url "$worker_linux_amd64_url" \
            --linux-amd64-sha256 "$worker_linux_amd64_sha" \
            --dry-run >/dev/null

          ./scripts/release/update-homebrew.sh \
            --project dexdex \
            --version "$RELEASE_VERSION" \
            --desktop-url "$desktop_url" \
            --desktop-sha256 "$desktop_sha" \
            --dry-run >/dev/null

      - name: Submit Homebrew updates
        if: env.DRY_RUN != 'true'
        env:
          GH_TOKEN: ${{ secrets.HOMEBREW_TAP_GH_TOKEN }}
        shell: bash
        run: |
          set -euo pipefail

          chmod +x ./scripts/release/update-homebrew.sh

          main_darwin_amd64_asset="dexdex-main-server-darwin-amd64.tar.gz"
          main_darwin_amd64_sha="$(grep " ${main_darwin_amd64_asset}$" dist/SHA256SUMS | awk '{print $1}')"
          main_darwin_amd64_url="https://github.com/delinoio/oss/releases/download/${RELEASE_TAG}/${main_darwin_amd64_asset}"

          main_darwin_arm64_asset="dexdex-main-server-darwin-arm64.tar.gz"
          main_darwin_arm64_sha="$(grep " ${main_darwin_arm64_asset}$" dist/SHA256SUMS | awk '{print $1}')"
          main_darwin_arm64_url="https://github.com/delinoio/oss/releases/download/${RELEASE_TAG}/${main_darwin_arm64_asset}"

          main_linux_amd64_asset="dexdex-main-server-linux-amd64.tar.gz"
          main_linux_amd64_sha="$(grep " ${main_linux_amd64_asset}$" dist/SHA256SUMS | awk '{print $1}')"
          main_linux_amd64_url="https://github.com/delinoio/oss/releases/download/${RELEASE_TAG}/${main_linux_amd64_asset}"

          worker_darwin_amd64_asset="dexdex-worker-server-darwin-amd64.tar.gz"
          worker_darwin_amd64_sha="$(grep " ${worker_darwin_amd64_asset}$" dist/SHA256SUMS | awk '{print $1}')"
          worker_darwin_amd64_url="https://github.com/delinoio/oss/releases/download/${RELEASE_TAG}/${worker_darwin_amd64_asset}"

          worker_darwin_arm64_asset="dexdex-worker-server-darwin-arm64.tar.gz"
          worker_darwin_arm64_sha="$(grep " ${worker_darwin_arm64_asset}$" dist/SHA256SUMS | awk '{print $1}')"
          worker_darwin_arm64_url="https://github.com/delinoio/oss/releases/download/${RELEASE_TAG}/${worker_darwin_arm64_asset}"

          worker_linux_amd64_asset="dexdex-worker-server-linux-amd64.tar.gz"
          worker_linux_amd64_sha="$(grep " ${worker_linux_amd64_asset}$" dist/SHA256SUMS | awk '{print $1}')"
          worker_linux_amd64_url="https://github.com/delinoio/oss/releases/download/${RELEASE_TAG}/${worker_linux_amd64_asset}"

          desktop_asset="dexdex-desktop-darwin-universal.dmg"
          desktop_sha="$(grep " ${desktop_asset}$" dist/SHA256SUMS | awk '{print $1}')"
          desktop_url="https://github.com/delinoio/oss/releases/download/${RELEASE_TAG}/${desktop_asset}"

          ./scripts/release/update-homebrew.sh \
            --project dexdex-main-server \
            --version "$RELEASE_VERSION" \
            --darwin-amd64-url "$main_darwin_amd64_url" \
            --darwin-amd64-sha256 "$main_darwin_amd64_sha" \
            --darwin-arm64-url "$main_darwin_arm64_url" \
            --darwin-arm64-sha256 "$main_darwin_arm64_sha" \
            --linux-amd64-url "$main_linux_amd64_url" \
            --linux-amd64-sha256 "$main_linux_amd64_sha"

          ./scripts/release/update-homebrew.sh \
            --project dexdex-worker-server \
            --version "$RELEASE_VERSION" \
            --darwin-amd64-url "$worker_darwin_amd64_url" \
            --darwin-amd64-sha256 "$worker_darwin_amd64_sha" \
            --darwin-arm64-url "$worker_darwin_arm64_url" \
            --darwin-arm64-sha256 "$worker_darwin_arm64_sha" \
            --linux-amd64-url "$worker_linux_amd64_url" \
            --linux-amd64-sha256 "$worker_linux_amd64_sha"

          ./scripts/release/update-homebrew.sh \
            --project dexdex \
            --version "$RELEASE_VERSION" \
            --desktop-url "$desktop_url" \
            --desktop-sha256 "$desktop_sha"