release.yaml

name: Release

on:
  push:
    tags:
      - "v*"

permissions:
  contents: write

concurrency:
  group: release-${{ github.ref_name }}
  cancel-in-progress: false

env:
  NODE_OPTIONS: "--max-old-space-size=4096"
  GO_VERSION: "1.26"
  NODE_VERSION: "20"
  PNPM_VERSION: "10"

jobs:
  # ─────────────────────────────────────────────────────────────────────────────
  # macOS (darwin/universal) — sign, notarize, DMG
  # ─────────────────────────────────────────────────────────────────────────────
  build-macos:
    runs-on: macos-latest
    steps:
      - name: Normalize version
        id: version
        shell: bash
        run: |
          version=$(echo "${{ github.ref_name }}" | sed 's/^v//')
          echo "version=${version}" >> "$GITHUB_OUTPUT"

      - name: Checkout
        uses: actions/checkout@v4
        with:
          submodules: recursive

      - name: Setup Node
        uses: actions/setup-node@v4
        with:
          node-version: ${{ env.NODE_VERSION }}

      - name: Setup pnpm
        uses: pnpm/action-setup@v4
        with:
          version: ${{ env.PNPM_VERSION }}
          run_install: |
            - args: []
            - args: [--global, typescript]

      - name: Setup Go
        uses: actions/setup-go@v5
        with:
          go-version: ${{ env.GO_VERSION }}
          cache: true
          cache-dependency-path: "go.sum"

      - name: Install Wails
        shell: bash
        run: go install github.com/wailsapp/wails/v2/cmd/wails@latest

      - name: Build runtime package
        shell: bash
        run: pnpm run build
        working-directory: packages/omniviewdev-runtime

      - name: Build Omniview
        shell: bash
        run: |
          wails build -platform darwin/universal \
            -webview2 download \
            -ldflags "\
              -X github.com/omniviewdev/omniview/internal/version.Version=${{ steps.version.outputs.version }} \
              -X github.com/omniviewdev/omniview/internal/version.GitCommit=${{ github.sha }} \
              -X github.com/omniviewdev/omniview/internal/version.BuildDate=$(date -u +%Y-%m-%dT%H:%M:%SZ) \
              -X github.com/omniviewdev/omniview/internal/version.Development=false \
              -X github.com/omniviewdev/registry.OmniviewPublicKeyHex=${{ secrets.REGISTRY_PUBLIC_KEY_HEX }}"

      - name: Import Code-Signing Certificates
        uses: Apple-Actions/import-codesign-certs@v3
        with:
          p12-file-base64: ${{ secrets.APPLE_DEVELOPER_CERTIFICATE_P12_BASE64 }}
          p12-password: ${{ secrets.APPLE_DEVELOPER_CERTIFICATE_PASSWORD }}

      - name: Sign and Notarize
        shell: bash
        env:
          APPLE_SIGN_ID: ${{ secrets.APPLE_DEVELOPER_SIGN_ID }}
          NOTARY_USER: ${{ secrets.CLI_MACOS_NOTARY_USER }}
          NOTARY_PWD: ${{ secrets.CLI_MACOS_NOTARY_PWD }}
          TEAM_ID: ${{ secrets.CLI_MACOS_TEAM_ID }}
        run: |
          codesign --deep --force \
            --options runtime \
            --entitlements build/darwin/entitlements.plist \
            --sign "$APPLE_SIGN_ID" \
            build/bin/Omniview.app

          ditto -c -k --keepParent --rsrc build/bin/Omniview.app archive.zip

          xcrun notarytool submit archive.zip \
            --apple-id "$NOTARY_USER" \
            --password "$NOTARY_PWD" \
            --team-id "$TEAM_ID" \
            --wait

          xcrun stapler staple build/bin/Omniview.app
          spctl --assess --type execute --verbose build/bin/Omniview.app

      - name: Checkout create-dmg
        uses: actions/checkout@v4
        with:
          repository: create-dmg/create-dmg
          path: ./build/create-dmg
          ref: master

      - name: Create DMG
        shell: bash
        working-directory: ./build
        run: |
          ./create-dmg/create-dmg \
            --no-internet-enable \
            --volname "Omniview" \
            --volicon "bin/Omniview.app/Contents/Resources/iconfile.icns" \
            --text-size 12 \
            --window-pos 400 400 \
            --window-size 660 450 \
            --icon-size 80 \
            --icon "Omniview.app" 180 180 \
            --hide-extension "Omniview.app" \
            --app-drop-link 480 180 \
            "bin/Omniview_${{ steps.version.outputs.version }}_darwin_universal.dmg" \
            "bin"

      - name: Upload artifact
        uses: actions/upload-artifact@v4
        with:
          name: macos-dmg
          path: build/bin/Omniview_${{ steps.version.outputs.version }}_darwin_universal.dmg
          if-no-files-found: error
          retention-days: 1

  # ─────────────────────────────────────────────────────────────────────────────
  # Linux (linux/amd64)
  # ─────────────────────────────────────────────────────────────────────────────
  build-linux:
    runs-on: ubuntu-latest
    steps:
      - name: Normalize version
        id: version
        shell: bash
        run: |
          version=$(echo "${{ github.ref_name }}" | sed 's/^v//')
          echo "version=${version}" >> "$GITHUB_OUTPUT"

      - name: Checkout
        uses: actions/checkout@v4
        with:
          submodules: recursive

      - name: Install system dependencies
        run: |
          sudo apt-get update
          sudo apt-get install -y libgtk-3-dev libwebkit2gtk-4.1-dev

      - name: Setup Node
        uses: actions/setup-node@v4
        with:
          node-version: ${{ env.NODE_VERSION }}

      - name: Setup pnpm
        uses: pnpm/action-setup@v4
        with:
          version: ${{ env.PNPM_VERSION }}
          run_install: |
            - args: []
            - args: [--global, typescript]

      - name: Setup Go
        uses: actions/setup-go@v5
        with:
          go-version: ${{ env.GO_VERSION }}
          cache: true
          cache-dependency-path: "go.sum"

      - name: Install Wails
        run: go install github.com/wailsapp/wails/v2/cmd/wails@latest

      - name: Build runtime package
        run: pnpm run build
        working-directory: packages/omniviewdev-runtime

      - name: Build Omniview
        run: |
          wails build -platform linux/amd64 \
            -tags webkit2_41 \
            -webview2 download \
            -ldflags "\
              -X github.com/omniviewdev/omniview/internal/version.Version=${{ steps.version.outputs.version }} \
              -X github.com/omniviewdev/omniview/internal/version.GitCommit=${{ github.sha }} \
              -X github.com/omniviewdev/omniview/internal/version.BuildDate=$(date -u +%Y-%m-%dT%H:%M:%SZ) \
              -X github.com/omniviewdev/omniview/internal/version.Development=false \
              -X github.com/omniviewdev/registry.OmniviewPublicKeyHex=${{ secrets.REGISTRY_PUBLIC_KEY_HEX }}"

      - name: Rename executable
        working-directory: ./build/bin
        run: mv Omniview "Omniview_${{ steps.version.outputs.version }}_linux_amd64"

      - name: Upload artifact
        uses: actions/upload-artifact@v4
        with:
          name: linux-binary
          path: build/bin/Omniview_${{ steps.version.outputs.version }}_linux_amd64
          if-no-files-found: error
          retention-days: 1

  # ─────────────────────────────────────────────────────────────────────────────
  # Windows (windows/amd64)
  # ─────────────────────────────────────────────────────────────────────────────
  build-windows:
    runs-on: windows-latest
    steps:
      - name: Normalize version
        id: version
        shell: bash
        run: |
          version=$(echo "${{ github.ref_name }}" | sed 's/^v//')
          echo "version=${version}" >> "$GITHUB_OUTPUT"

      - name: Checkout
        uses: actions/checkout@v4
        with:
          submodules: recursive

      - name: Setup Node
        uses: actions/setup-node@v4
        with:
          node-version: ${{ env.NODE_VERSION }}

      - name: Setup pnpm
        uses: pnpm/action-setup@v4
        with:
          version: ${{ env.PNPM_VERSION }}
          run_install: |
            - args: []
            - args: [--global, typescript]

      - name: Setup Go
        uses: actions/setup-go@v5
        with:
          go-version: ${{ env.GO_VERSION }}
          cache: true
          cache-dependency-path: "go.sum"

      - name: Install Wails
        shell: bash
        run: go install github.com/wailsapp/wails/v2/cmd/wails@latest

      - name: Build runtime package
        shell: bash
        run: pnpm run build
        working-directory: packages/omniviewdev-runtime

      - name: Build Omniview
        shell: bash
        run: |
          wails build -platform windows/amd64 \
            -webview2 download \
            -ldflags "\
              -X github.com/omniviewdev/omniview/internal/version.Version=${{ steps.version.outputs.version }} \
              -X github.com/omniviewdev/omniview/internal/version.GitCommit=${{ github.sha }} \
              -X github.com/omniviewdev/omniview/internal/version.BuildDate=$(date -u +%Y-%m-%dT%H:%M:%SZ) \
              -X github.com/omniviewdev/omniview/internal/version.Development=false \
              -X github.com/omniviewdev/registry.OmniviewPublicKeyHex=${{ secrets.REGISTRY_PUBLIC_KEY_HEX }}"

      - name: Rename executable
        working-directory: ./build/bin
        run: Rename-Item -Path "Omniview.exe" -NewName "Omniview_${{ steps.version.outputs.version }}_windows_amd64.exe"

      - name: Upload artifact
        uses: actions/upload-artifact@v4
        with:
          name: windows-binary
          path: build/bin/Omniview_${{ steps.version.outputs.version }}_windows_amd64.exe
          if-no-files-found: error
          retention-days: 1

  # ─────────────────────────────────────────────────────────────────────────────
  # NPM — publish @omniviewdev/* packages (runs in parallel with desktop builds)
  # ─────────────────────────────────────────────────────────────────────────────
  publish-npm:
    uses: ./.github/workflows/npm-publish.yml
    with:
      version: ${{ github.ref_name }}
      dist-tag: latest
    secrets:
      NPM_TOKEN: ${{ secrets.NPM_TOKEN }}

  # ─────────────────────────────────────────────────────────────────────────────
  # Publish — download all artifacts, checksums, GitHub Release, Homebrew
  # ─────────────────────────────────────────────────────────────────────────────
  publish:
    runs-on: ubuntu-latest
    needs: [build-macos, build-linux, build-windows]
    steps:
      - name: Normalize version
        id: version
        shell: bash
        run: |
          version=$(echo "${{ github.ref_name }}" | sed 's/^v//')
          echo "version=${version}" >> "$GITHUB_OUTPUT"

      - name: Download all artifacts
        uses: actions/download-artifact@v4
        with:
          path: artifacts

      - name: Collect release assets
        shell: bash
        run: |
          mkdir -p release
          cp artifacts/macos-dmg/*.dmg release/
          cp artifacts/linux-binary/* release/
          cp artifacts/windows-binary/*.exe release/

      - name: Generate checksums
        shell: bash
        working-directory: release
        run: sha256sum * > checksums_sha256.txt

      - name: Create GitHub Release
        uses: softprops/action-gh-release@v2
        with:
          files: release/*
          generate_release_notes: true
          prerelease: ${{ contains(github.ref_name, '-') }}
          token: ${{ secrets.GITHUB_TOKEN }}

      - name: Update Homebrew Cask
        if: ${{ !contains(github.ref_name, '-') }}
        shell: bash
        env:
          HOMEBREW_TAP_TOKEN: ${{ secrets.HOMEBREW_TAP_TOKEN }}
        run: |
          if [ -z "$HOMEBREW_TAP_TOKEN" ]; then
            echo "::warning::HOMEBREW_TAP_TOKEN not set, skipping Homebrew update"
            exit 0
          fi

          VERSION="${{ steps.version.outputs.version }}"
          DMG_FILE="release/Omniview_${VERSION}_darwin_universal.dmg"
          SHA256=$(sha256sum "$DMG_FILE" | awk '{print $1}')

          git clone "https://x-access-token:${HOMEBREW_TAP_TOKEN}@github.com/omniviewdev/homebrew-tap.git" tap
          cd tap

          sed -i "s/version \".*\"/version \"${VERSION}\"/" Casks/omniview.rb
          sed -i "s/sha256 \".*\"/sha256 \"${SHA256}\"/" Casks/omniview.rb

          git config user.name "github-actions[bot]"
          git config user.email "github-actions[bot]@users.noreply.github.com"
          git add Casks/omniview.rb
          git commit -m "Update omniview to ${VERSION}"
          git push