release.yml

name: Release

on:
  push:
    tags:
      - 'v*'

permissions: {}

jobs:
  build:
    name: Build
    strategy:
      fail-fast: false
      matrix:
        os:
          - macos-15-intel
          - ubuntu-latest
          - windows-latest
        arch:
          - x64
        include:
          - os: macos-latest-xlarge
            arch: arm64
          - os: ubuntu-24.04-arm
            arch: armv7l
          - os: ubuntu-24.04-arm
            arch: arm64
          - os: windows-latest
            arch: ia32
    runs-on: "${{ matrix.os }}"
    permissions:
      actions: write
      contents: read
    environment: release
    steps:
      - run: git config --global core.autocrlf input
      - name: Checkout
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
      - name: Setup Node.js
        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
        with:
          node-version-file: .nvmrc
          package-manager-cache: false
      - run: yarn install --immutable
      - run: yarn run contributors
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
      - run: yarn run electron-releases
      - name: Install dependencies (Linux)
        if: ${{ startsWith(matrix.os, 'ubuntu-') }}
        run: sudo apt-get update && sudo apt install rpm squashfs-tools
      - name: Load certificates (macOS)
        if: ${{ startsWith(matrix.os, 'macos-') }}
        env:
          MACOS_CERT_P12: ${{ secrets.MACOS_CERT_P12 }}
          MACOS_CERT_PASSWORD: ${{ secrets.MACOS_CERT_PASSWORD }}
        run: chmod +x tools/add-macos-cert.sh && . ./tools/add-macos-cert.sh
      - name: Signing Manager Setup (Windows)
        if: ${{ startsWith(matrix.os, 'windows-') }}
        uses: digicert/ssm-code-signing@1d820463733701cf1484c7eb5d7d24a15ca2c454 # v1.2.1
      - name: Write authentication cert to disk (Windows)
        if: ${{ startsWith(matrix.os, 'windows-') }}
        shell: bash
        env:
          SM_CLIENT_CERT_P12_BASE64: ${{ secrets.SM_CLIENT_CERT_P12_BASE64 }}
        run: | 
          echo "$SM_CLIENT_CERT_P12_BASE64" | base64 --decode > /d/cert.p12
          echo "SM_CLIENT_CERT_FILE=D:\\cert.p12" >> "$GITHUB_ENV" 
      - name: Sync cert (Windows)
        if: ${{ startsWith(matrix.os, 'windows-') }}
        shell: pwsh
        env:
          CERT_FINGERPRINT: ${{ secrets.CERT_FINGERPRINT }}
          KEYPAIR_ALIAS: ${{ secrets.KEYPAIR_ALIAS }}
          SM_API_KEY: ${{ secrets.SM_API_KEY }}
          SM_CLIENT_CERT_FILE: ${{ env.SM_CLIENT_CERT_FILE }}
          SM_CLIENT_CERT_PASSWORD: ${{ secrets.SM_CLIENT_CERT_PASSWORD }}
          SM_HOST: ${{ secrets.SM_HOST }}
        run: |
          smksp_registrar list
          smctl windows certsync --keypair-alias=$env:KEYPAIR_ALIAS
      - name: Build (macOS)
        if: ${{ startsWith(matrix.os, 'macos-') }}
        env:
          APPLE_ID: ${{ secrets.APPLE_ID }}
          APPLE_ID_PASSWORD: ${{ secrets.APPLE_ID_PASSWORD }}
        run: yarn run publish --arch=${{ matrix.arch }} --dry-run # zizmor: ignore[use-trusted-publishing]
      - name: Build (Windows)
        if: ${{ startsWith(matrix.os, 'windows-') }}
        env:
          CERT_FINGERPRINT: ${{ secrets.CERT_FINGERPRINT }}
          KEYPAIR_ALIAS: ${{ secrets.KEYPAIR_ALIAS }}
          SM_API_KEY: ${{ secrets.SM_API_KEY }}
          SM_CLIENT_CERT_FILE: ${{ env.SM_CLIENT_CERT_FILE }}
          SM_CLIENT_CERT_PASSWORD: ${{ secrets.SM_CLIENT_CERT_PASSWORD }}
          SM_HOST: ${{ secrets.SM_HOST }}
        run: yarn run publish --arch=${{ matrix.arch }} --dry-run # zizmor: ignore[use-trusted-publishing]
      - name: Build (Linux)
        if: ${{ startsWith(matrix.os, 'ubuntu-') }}
        run: yarn run publish --arch=${{ matrix.arch }} --dry-run # zizmor: ignore[use-trusted-publishing]
      - uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
        with:
          name: build-artifacts-${{ matrix.os }}-${{ matrix.arch }}
          path: out
      - uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
        if: ${{ startsWith(matrix.os, 'ubuntu-') && matrix.arch == 'x64' }}
        with:
          name: webpack-source-maps
          path: .webpack
          include-hidden-files: true

  test:
    permissions:
      contents: read
    uses: ./.github/workflows/test.yml

  release:
    name: Release
    runs-on: ubuntu-latest
    needs:
      - build
      - test
    environment: release
    permissions:
      contents: read
      id-token: write
    steps:
      - run: git config --global core.autocrlf input
      - name: Checkout
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
      - name: Setup Node.js
        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
        with:
          node-version: '22.17.x'
          package-manager-cache: false
      - run: yarn install --immutable
      - name: Download All Artifacts
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          path: out
          pattern: build-artifacts-*
          merge-multiple: true
      - name: Get GitHub app token
        id: secret-service
        uses: electron/secret-service-action@3476425e8b30555aac15b1b7096938e254b0e155 # v1.0.0
      - name: Publish to GitHub
        env:
          GITHUB_TOKEN: ${{ fromJSON(steps.secret-service.outputs.secrets).GITHUB_TOKEN }}
        run: yarn run publish --from-dry-run

  notify-sentry-deploy:
    name: Notify Sentry Deploy
    runs-on: ubuntu-latest
    needs: release
    permissions:
      actions: read
    steps:
      - name: Checkout
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          fetch-depth: 0
          persist-credentials: false
      - name: Download source maps artifact
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: webpack-source-maps
          path: .webpack
      - uses: getsentry/action-release@5657c9e888b4e2cc85f4d29143ea4131fde4a73a # v3.6.0
        env:
          SENTRY_AUTH_TOKEN: ${{ secrets.SENTRY_AUTH_TOKEN }}
          SENTRY_ORG: electronjs
          SENTRY_PROJECT: electron-fiddle
        with:
          environment: production
          release: Electron-Fiddle@${{ github.ref_name }}
          sourcemaps: ./.webpack/
          url_prefix: '~/.webpack'