desktop-release.yml

name: App Release

on:
  push:
    branches:
      - main
    paths:
      - "desktop/**"
      - ".github/workflows/desktop-release.yml"
  workflow_dispatch:
    inputs:
      draft:
        description: "Create as draft release"
        required: false
        type: boolean
        default: false

concurrency:
  group: app-release
  cancel-in-progress: false

jobs:
  # ── Resolve version from desktop/src-tauri/tauri.conf.json ──
  version:
    runs-on: ubuntu-latest
    outputs:
      version: ${{ steps.read.outputs.version }}
    steps:
      - uses: actions/checkout@v4
      - id: read
        run: |
          version=$(jq -r '.version' desktop/src-tauri/tauri.conf.json)
          echo "version=$version" >> "$GITHUB_OUTPUT"
          echo "Building version $version"

  # ── Desktop builds (macOS, Windows, Linux) ──
  desktop:
    needs: version
    strategy:
      fail-fast: false
      matrix:
        include:
          - platform: macos-latest
            target: aarch64-apple-darwin
            name: macOS ARM64
          - platform: macos-latest
            target: x86_64-apple-darwin
            name: macOS x86_64
          - platform: ubuntu-22.04
            target: x86_64-unknown-linux-gnu
            name: Linux x86_64
          - platform: windows-latest
            target: x86_64-pc-windows-msvc
            name: Windows x86_64

    runs-on: ${{ matrix.platform }}
    timeout-minutes: 30

    permissions:
      contents: write

    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Setup pnpm
        uses: pnpm/action-setup@v4
        with:
          version: 9.15.4
          run_install: false

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: 20
          cache: pnpm

      - name: Install Rust stable
        uses: dtolnay/rust-toolchain@stable
        with:
          targets: ${{ matrix.target }}

      - name: Cache Rust dependencies
        uses: swatinem/rust-cache@v2
        with:
          workspaces: desktop/src-tauri

      - name: Install Linux dependencies
        if: matrix.platform == 'ubuntu-22.04'
        run: |
          sudo apt-get update
          sudo apt-get install -y \
            libwebkit2gtk-4.1-dev \
            libappindicator3-dev \
            librsvg2-dev \
            patchelf

      - name: Install Node dependencies
        run: pnpm install --frozen-lockfile

      - name: Build Tauri desktop app (signed)
        if: secrets.APPLE_CERTIFICATE != ''
        uses: tauri-apps/tauri-action@v0
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
          TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
          APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }}
          APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
          APPLE_SIGNING_IDENTITY: ${{ secrets.APPLE_SIGNING_IDENTITY }}
          APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
          APPLE_ID: ${{ secrets.APPLE_ID }}
          APPLE_PASSWORD: ${{ secrets.APPLE_PASSWORD }}
        with:
          projectPath: desktop
          tagName: app-v__VERSION__
          releaseName: "Paperclip v__VERSION__"
          releaseBody: "See the [changelog](https://github.com/paperclipinc/paperclip/blob/main/desktop/CHANGELOG.md) for details."
          releaseDraft: ${{ inputs.draft || false }}
          prerelease: false
          includeUpdaterJson: true
          args: --target ${{ matrix.target }}

      - name: Build Tauri desktop app (unsigned)
        if: secrets.APPLE_CERTIFICATE == ''
        uses: tauri-apps/tauri-action@v0
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        with:
          projectPath: desktop
          tagName: app-v__VERSION__
          releaseName: "Paperclip v__VERSION__"
          releaseBody: "See the [changelog](https://github.com/paperclipinc/paperclip/blob/main/desktop/CHANGELOG.md) for details."
          releaseDraft: ${{ inputs.draft || false }}
          prerelease: false
          includeUpdaterJson: true
          args: --target ${{ matrix.target }}

  # ── iOS build (requires Apple signing secrets) ──
  ios:
    if: github.event_name == 'workflow_dispatch'
    needs: version
    runs-on: macos-latest
    timeout-minutes: 45

    permissions:
      contents: write

    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Setup pnpm
        uses: pnpm/action-setup@v4
        with:
          version: 9.15.4
          run_install: false

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: 20
          cache: pnpm

      - name: Install Rust stable
        uses: dtolnay/rust-toolchain@stable
        with:
          targets: aarch64-apple-ios

      - name: Cache Rust dependencies
        uses: swatinem/rust-cache@v2
        with:
          workspaces: desktop/src-tauri

      - name: Install Node dependencies
        run: pnpm install --frozen-lockfile

      - name: Install Tauri CLI
        run: pnpm --filter @paperclipai/desktop tauri --version || pnpm install

      - name: Initialize iOS project
        working-directory: desktop
        run: npx tauri ios init

      - name: Build iOS app
        working-directory: desktop
        env:
          APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }}
          APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
          APPLE_SIGNING_IDENTITY: ${{ secrets.APPLE_SIGNING_IDENTITY }}
          APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
          APPLE_DEVELOPMENT_TEAM: ${{ secrets.APPLE_TEAM_ID }}
          APPLE_ID: ${{ secrets.APPLE_ID }}
          APPLE_PASSWORD: ${{ secrets.APPLE_PASSWORD }}
        run: npx tauri ios build --export-method app-store-connect

      - name: Upload iOS artifact
        uses: actions/upload-artifact@v4
        with:
          name: ios-build
          path: desktop/src-tauri/gen/apple/build/**/*.ipa
          if-no-files-found: warn

  # ── Android build (requires signing secrets) ──
  android:
    if: github.event_name == 'workflow_dispatch'
    needs: version
    runs-on: ubuntu-22.04
    timeout-minutes: 45

    permissions:
      contents: write

    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Setup pnpm
        uses: pnpm/action-setup@v4
        with:
          version: 9.15.4
          run_install: false

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: 20
          cache: pnpm

      - name: Install Rust stable
        uses: dtolnay/rust-toolchain@stable
        with:
          targets: aarch64-linux-android,armv7-linux-androideabi,x86_64-linux-android,i686-linux-android

      - name: Cache Rust dependencies
        uses: swatinem/rust-cache@v2
        with:
          workspaces: desktop/src-tauri

      - name: Setup Java
        uses: actions/setup-java@v4
        with:
          distribution: temurin
          java-version: 17

      - name: Setup Android SDK
        uses: android-actions/setup-android@v3

      - name: Install Android NDK
        run: sdkmanager "ndk;27.0.12077973"

      - name: Install Node dependencies
        run: pnpm install --frozen-lockfile

      - name: Decode Android signing key
        if: env.ANDROID_KEYSTORE_BASE64 != ''
        env:
          ANDROID_KEYSTORE_BASE64: ${{ secrets.ANDROID_KEYSTORE_BASE64 }}
        run: echo "$ANDROID_KEYSTORE_BASE64" | base64 -d > /tmp/paperclip.keystore

      - name: Initialize Android project
        working-directory: desktop
        env:
          NDK_HOME: ${{ env.ANDROID_HOME }}/ndk/27.0.12077973
        run: npx tauri android init

      - name: Build Android app
        working-directory: desktop
        env:
          NDK_HOME: ${{ env.ANDROID_HOME }}/ndk/27.0.12077973
          ANDROID_KEYSTORE: /tmp/paperclip.keystore
          ANDROID_KEYSTORE_PASSWORD: ${{ secrets.ANDROID_KEYSTORE_PASSWORD }}
          ANDROID_KEY_ALIAS: ${{ secrets.ANDROID_KEY_ALIAS }}
          ANDROID_KEY_PASSWORD: ${{ secrets.ANDROID_KEY_PASSWORD }}
        run: npx tauri android build --apk

      - name: Upload Android artifact
        uses: actions/upload-artifact@v4
        with:
          name: android-build
          path: |
            desktop/src-tauri/gen/android/app/build/outputs/**/*.apk
            desktop/src-tauri/gen/android/app/build/outputs/**/*.aab
          if-no-files-found: warn

      - name: Clean up keystore
        if: always()
        run: rm -f /tmp/paperclip.keystore