build.yml

# Copyright (C) 2021-2026 Saturneric <eric@bktus.com>
#
# This file is part of GpgFrontend.
#
# GpgFrontend is free software: you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation, either version 3 of the License, or
# (at your option) any later version.
#
# GpgFrontend is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with GpgFrontend. If not, see <https://www.gnu.org/licenses/>.
#
# The initial version of the source code is inherited from
# the gpg4usb project, which is under GPL-3.0-or-later.
#
# All the source code of GpgFrontend was modified and released by
# Saturneric <eric@bktus.com> starting on May 12, 2021.
#
# SPDX-License-Identifier: GPL-3.0-or-later

name: Build

on:
  push:
    branches:
      - develop
      - main
    paths-ignore:
      - "resource/lfs/locale/**"
      - "**.md"

  pull_request:
    branches:
      - develop
      - main
    paths-ignore:
      - "resource/lfs/locale/**"
      - "**.md"

  workflow_dispatch:
    inputs:
      build_mode:
        description: "Build mode"
        required: true
        default: "nightly"
        type: choice
        options:
          - nightly
          - release

env:
  BUILD_TYPE: RelWithDebInfo
  GNUPG_VERSION: "2.5.18"

jobs:
  build:
    strategy:
      matrix:
        os:
          [
            "ubuntu-22.04",
            "ubuntu-24.04-arm",
            "macos-14",
            "macos-15-intel",
            "macos-15",
            "macos-26",
            "windows-2022",
          ]
    runs-on: ${{ matrix.os }}
    continue-on-error: true
    steps:
      - name: Set git to use LF(Windows) or CRLF(MacOS) line endings
        run: |
          git config --global core.autocrlf false
          git config --global core.eol lf
        if: runner.os == 'Windows'  || runner.os == 'macOS'

      - uses: actions/checkout@v6
        with:
          lfs: "false"
          submodules: recursive

      - name: Setup Build Mode
        shell: bash
        run: |
          echo "SHORT_SHA=$(git rev-parse --short HEAD)" >> $GITHUB_ENV
          echo "OS_IDENTIFIER=${{ matrix.os }}" >> $GITHUB_ENV

          if [[ "${GITHUB_EVENT_NAME}" == "workflow_dispatch" ]]; then
            BUILD_MODE="${{ github.event.inputs.build_mode }}"
            if [[ "${BUILD_MODE}" == "release" ]]; then
              BUILD_TYPE_EFFECTIVE="Release"
            else
              BUILD_TYPE_EFFECTIVE="RelWithDebInfo"
            fi

          elif [[ "${GITHUB_EVENT_NAME}" == "pull_request" ]]; then
            BUILD_MODE="pr"
            BUILD_TYPE_EFFECTIVE="RelWithDebInfo"

          elif [[ "${GITHUB_REF_NAME}" == "main" ]]; then
            BUILD_MODE="release"
            BUILD_TYPE_EFFECTIVE="Release"

          elif [[ "${GITHUB_REF_NAME}" == "develop" ]]; then
            BUILD_MODE="nightly"
            BUILD_TYPE_EFFECTIVE="RelWithDebInfo"

          else
            BUILD_MODE="nightly"
            BUILD_TYPE_EFFECTIVE="RelWithDebInfo"
          fi

          echo "BUILD_MODE=${BUILD_MODE}" >> $GITHUB_ENV
          echo "BUILD_TYPE=${BUILD_TYPE_EFFECTIVE}" >> $GITHUB_ENV
          echo "BUILD_TYPE_LOWER=$(echo ${BUILD_TYPE_EFFECTIVE} | tr '[:upper:]' '[:lower:]')" >> $GITHUB_ENV

          echo "SANDBOX_CMAKE_FLAG=" >> $GITHUB_ENV
          echo "CODE_SIGNING_IDENTITY=${{secrets.DEVELOPER_ID_CODE_SIGN_IDENTITY}}" >> $GITHUB_ENV
          echo "PROVISIONING_PROFILE_UUID=${{secrets.DEVELOPER_ID_PROVISIONING_PROFILE_UUID}}" >> $GITHUB_ENV

          echo "Build mode: ${BUILD_MODE}"
          echo "Build type: ${BUILD_TYPE_EFFECTIVE}"

      - name: ccache
        uses: hendrikmuhs/ccache-action@v1.2
        with:
          key: ${{ github.job }}-${{ matrix.os }}

      - name: Install Dependence (Linux)
        run: |
          sudo apt-get update
          sudo apt-get -y install build-essential binutils git autoconf automake gettext texinfo
          sudo apt-get -y install gcc g++ ninja-build
          sudo apt-get -y install libarchive-dev libssl-dev libsodium-dev
          sudo apt-get -y install gpgsm libxcb-xinerama0 libxcb-icccm4-dev libcups2-dev libdrm-dev libegl1-mesa-dev
          sudo apt-get -y install libfuse2 libgcrypt20-dev libnss3-dev libpci-dev libpulse-dev libudev-dev libxtst-dev
          sudo apt-get -y install libglu1-mesa-dev libfontconfig1-dev libx11-xcb-dev libxcb-image0 gyp
          sudo apt-get -y install libglu1-mesa-dev libfontconfig1-dev libx11-xcb-dev libxcb-* libxkbcommon-x11-0
          sudo apt-get -y install libwayland-cursor0 libwayland-egl1
        if: runner.os == 'Linux'

      - name: Codesign Configuration (macOS)
        run: |
          APP_CERT_PATH=$RUNNER_TEMP/app_certificate.p12

          PP_PATH=$RUNNER_TEMP/${{secrets.DEVELOPER_ID_PROVISIONING_PROFILE_UUID}}.provisionprofile
          echo -n "${{secrets.DEVELOPER_ID_PROVISIONING_PROFILE_DATA}}" | base64 --decode -o $PP_PATH
          KEYCHAIN_PATH=$RUNNER_TEMP/app-signing.keychain-db

          # Import the certificates and provisioning profile into the keychain
          echo -n "${{secrets.DEVELOP_ID_CERT}}" | base64 --decode -o $APP_CERT_PATH

          security create-keychain -p gpgfrontend build.keychain
          security default-keychain -s build.keychain
          security unlock-keychain -p gpgfrontend build.keychain
          security import $APP_CERT_PATH -k build.keychain -P ${{secrets.DEVELOP_ID_CERT_PWD}} -T /usr/bin/codesign
          security set-key-partition-list -S apple-tool:,apple:,codesign: -s -k gpgfrontend build.keychain
          security set-keychain-settings -lut 3600

          PROFILE_DIR="$HOME/Library/MobileDevice/Provisioning Profiles"
          mkdir -p "$PROFILE_DIR"
          cp "$PP_PATH" "$HOME/Library/MobileDevice/Provisioning Profiles/${{env.PROVISIONING_PROFILE_UUID}}.provisionprofile"
        if: runner.os == 'macOS'

      - name: Install Qt6
        uses: jurplel/install-qt-action@v4
        with:
          version: "6.10.3"
          cache: "true"
        if: runner.os == 'Linux' || runner.os == 'macOS'

      - name: Install Dependence (macOS)
        run: |
          brew install --formula automake texinfo libarchive googletest create-dmg libsodium
        if: runner.os == 'macOS'

      - name: Set up MinGW (Windows)
        uses: msys2/setup-msys2@v2
        id: msys2
        with:
          update: false
          release: false
          cache: true
          install: >-
            git
            zip
            unzip
            msys2-devel
            base-devel
            msys2-runtime-devel
            mingw-w64-x86_64-gcc
            mingw-w64-x86_64-make
            mingw-w64-x86_64-cmake
            mingw-w64-x86_64-qt6-base
            mingw-w64-x86_64-qt6-tools
            mingw-w64-x86_64-ninja
            mingw-w64-x86_64-libarchive
            mingw-w64-x86_64-gtest
            mingw-w64-x86_64-autotools
            mingw-w64-x86_64-texinfo
            mingw-w64-x86_64-libassuan
            mingw-w64-x86_64-ccache
            mingw-w64-x86_64-rust
            mingw-w64-x86_64-libsodium
        if: runner.os == 'Windows'

      - name: Install Rust
        uses: dtolnay/rust-toolchain@stable
        if: runner.os == 'Linux' || runner.os == 'macOS'

      - name: Cache Cargo
        uses: Swatinem/rust-cache@v2
        with:
          workspaces: |
            rust -> build/cargo
          shared-key: rust-${{ runner.os }}-${{ matrix.os }}-${{ env.BUILD_TYPE }}
          cache-on-failure: true
        if: runner.os == 'Linux' || runner.os == 'macOS'

      - name: Build GpgME (macOS)
        run: |
          cd ${{github.workspace}}/third_party/gpgme
          export CC="ccache gcc"
          export CXX="ccache g++"
          ./autogen.sh
          mkdir build && cd build
          ../configure --enable-static \
          --disable-shared \
          --enable-silent-rules \
          --disable-dependency-tracking \
          --enable-languages=cl \
          --disable-gpgconf-test \
          --disable-gpg-test \
          --disable-gpgsm-test \
          --disable-g13-test
          make -j$(sysctl -n hw.logicalcpu)
          sudo make install
        if: runner.os == 'macOS'

      - name: Build GpgME (Windows)
        shell: msys2 {0}
        run: |
          cd $(cygpath -u "${{github.workspace}}")
          cd third_party/gpgme
          export CC="ccache gcc"
          export CXX="ccache g++"
          export CFLAGS="${CFLAGS} -Wno-int-conversion -Wno-incompatible-pointer-types"
          ./autogen.sh
          mkdir build && cd build
          ../configure --enable-maintainer-mode \
          --enable-static \
          --disable-shared \
          --enable-silent-rules \
          --disable-dependency-tracking \
          --enable-languages=cl \
          --disable-gpgconf-test \
          --disable-gpg-test \
          --disable-gpgsm-test \
          --disable-g13-test \
          --enable-w32-glib
          make -j$(nproc)
          make install
        if: runner.os == 'Windows'

      - name: Build googletest (Linux)
        run: |
          git clone --depth 1 --branch v1.15.2 https://github.com/google/googletest.git ${{github.workspace}}/third_party/googletest
          cd ${{github.workspace}}/third_party/googletest
          mkdir build && cd build
          cmake -G Ninja -DBUILD_SHARED_LIBS=ON \
            -DCMAKE_C_COMPILER_LAUNCHER=ccache \
            -DCMAKE_CXX_COMPILER_LAUNCHER=ccache \
            ..
          ninja
          sudo ninja install
        if: runner.os == 'Linux'

      - name: Build GpgFrontend (macOS)
        run: |
          MACOS_MAJOR=$(sw_vers -productVersion | cut -d. -f1)
          MACOS_MINOR=$(sw_vers -productVersion | cut -d. -f2)

          if [[ "$MACOS_MAJOR" == "13" ]]; then
            DEPLOY_TARGET="13.0"
          elif [[ "$MACOS_MAJOR" == "14" ]]; then
            DEPLOY_TARGET="14.0"
          elif [[ "$MACOS_MAJOR" == "15" ]]; then
            DEPLOY_TARGET="15.0"
          elif [[ "$MACOS_MAJOR" == "26" ]]; then
            DEPLOY_TARGET="26.0"
          else
            DEPLOY_TARGET="${MACOS_MAJOR}.${MACOS_MINOR}"
          fi

          echo "Set MacOS Deployment Target: $DEPLOY_TARGET"

          cmake -B ${{github.workspace}}/build -G Xcode \
            -DCMAKE_BUILD_TYPE=${{env.BUILD_TYPE}} \
            -DCMAKE_OSX_DEPLOYMENT_TARGET=${DEPLOY_TARGET} \
            -DGPGFRONTEND_XCODE_CODE_SIGN_IDENTITY="${{env.CODE_SIGNING_IDENTITY}}" \
            -DGPGFRONTEND_XCODE_TEAM_ID="${{secrets.GPGFRONTEND_XCODE_TEAM_ID}}" \
            -DGPGFRONTEND_XCODE_PROVISIONING_PROFILE_UUID="${{env.PROVISIONING_PROFILE_UUID}}" \
            -DGPGFRONTEND_LINK_GPGME_INTO_CORE=ON
            
          xcodebuild -list -project ${{github.workspace}}/build/GpgFrontend.xcodeproj

          echo "CODE_SIGNING_IDENTITY=${{env.CODE_SIGNING_IDENTITY}}"
          echo "PROFILE_UUID=${{env.PROVISIONING_PROFILE_UUID}}"
          ls -la "$HOME/Library/MobileDevice/Provisioning Profiles/"
          security cms -D -i "$HOME/Library/MobileDevice/Provisioning Profiles/${{env.PROVISIONING_PROFILE_UUID}}.provisionprofile" | plutil -p -
          security find-identity -v -p codesigning

          cd ${{github.workspace}}/build/
          xcodebuild -project ${{github.workspace}}/build/GpgFrontend.xcodeproj \
            -scheme GpgFrontend \
            -configuration "${{env.BUILD_TYPE}}" \
            -archivePath ${{github.workspace}}/build/GpgFrontend.xcarchive \
            archive \
            CODE_SIGN_STYLE=Manual \
            DEVELOPMENT_TEAM="${{secrets.GPGFRONTEND_XCODE_TEAM_ID}}" \
            CODE_SIGN_IDENTITY="${{env.CODE_SIGNING_IDENTITY}}"
          mkdir ${{github.workspace}}/build/package

          xcodebuild -exportArchive -archivePath ${{github.workspace}}/build/GpgFrontend.xcarchive \
            -exportOptionsPlist ${{github.workspace}}/build/ExportOptions.plist \
            -exportPath ${{github.workspace}}/build/package/
        if: runner.os == 'macOS'

      - name: Deploy Qt & Code Sign (macOS)
        run: |
          # Use macdeployqt to deploy the Qt frameworks and plugins, and sign
          # the app bundle in one step.
          macdeployqt ${{github.workspace}}/build/package/GpgFrontend.app \
            -verbose=2 \
            -always-overwrite \
            -codesign="${{env.CODE_SIGNING_IDENTITY}}"

          # Sign the app bundle with the specified identity and provisioning profile.
          codesign -s "${{env.CODE_SIGNING_IDENTITY}}" \
            -f --deep --options=runtime --timestamp \
            ${{github.workspace}}/build/package/GpgFrontend.app

          codesign --verify --deep --strict --verbose=4 \
            ${{github.workspace}}/build/package/GpgFrontend.app
        if: runner.os == 'macOS'

      - name: Package & Sign App Bundle (macOS)
        run: |
          security -v unlock-keychain -p gpgfrontend
          ditto -c -k --keepParent ${{github.workspace}}/build/package/GpgFrontend.app ${{github.workspace}}/build/GpgFrontend.app.zip
          hdiutil create ${{github.workspace}}/build/tmp.dmg -ov \
            -volname "GpgFrontend" -fs HFS+ -srcfolder ${{github.workspace}}/build/package/
          mkdir ${{github.workspace}}/build/upload-artifact
          create-dmg --codesign "${{secrets.DEVELOPER_ID_CODE_SIGN_IDENTITY}}" --volicon "${{github.workspace}}/resource/lfs/icns/GpgFrontend.icns" --volname GpgFrontend --app-drop-link 600 185 --window-size 800 400 ${{github.workspace}}/build/upload-artifact/GpgFrontend.dmg ${{github.workspace}}/build/package/GpgFrontend.app
          mv ${{github.workspace}}/build/upload-artifact/GpgFrontend.dmg \
            ${{github.workspace}}/build/upload-artifact/GpgFrontend-${{env.OS_IDENTIFIER}}-${{env.SHORT_SHA}}.dmg
          mv ${{github.workspace}}/build/GpgFrontend.app.zip \
            ${{github.workspace}}/build/GpgFrontend-${{env.OS_IDENTIFIER}}-${{env.SHORT_SHA}}.zip
        if: runner.os == 'macOS'

      - name: Notarize macOS Build (macOS)
        run: |
          xcrun notarytool submit \
          --apple-id ${{secrets.APPLE_DEVELOPER_ID}} \
          --team-id ${{secrets.APPLE_DEVELOPER_TEAM_ID}} \
          --password ${{secrets.APPLE_DEVELOPER_ID_SECRET}} \
          ${{github.workspace}}/build/GpgFrontend-${{env.OS_IDENTIFIER}}-${{env.SHORT_SHA}}.zip
        if: runner.os == 'macOS'

      - name: Build GpgFrontend (Linux)
        run: |
          export LD_LIBRARY_PATH=/usr/local/lib:/usr/local/lib64:$LD_LIBRARY_PATH
          cmake -B ${{github.workspace}}/build -G Ninja \
            -DCMAKE_BUILD_TYPE=${{env.BUILD_TYPE}} \
            -DGPGFRONTEND_BUILD_APP_IMAGE=ON \
            -DGPGFRONTEND_LINK_GPGME_INTO_CORE=ON
          cmake --build ${{ github.workspace }}/build \
            --config ${{ env.BUILD_TYPE }} \
            --parallel \
            --verbose
        if: runner.os == 'Linux'

      - name: Package App Image (Linux)
        run: |
          QT_PLUGIN_DIR=$(qmake -query QT_INSTALL_PLUGINS)
          echo "Found Qt plugin dir: $QT_PLUGIN_DIR"

          # enter the sqldrivers directory
          cd $QT_PLUGIN_DIR/sqldrivers

          # remove all non-sqlite drivers to reduce the size of the final AppImage
          find . -type f ! -name '*sqlite*' -delete
          ls -l

          # return to the root of the repository
          cd ${{github.workspace}}

          mkdir ${{github.workspace}}/build/upload-artifact
          cd ${{github.workspace}}/build/upload-artifact

          ARCH=$(uname -m)
          if [[ "$ARCH" == "x86_64" ]]; then
            wget -c -nv https://github.com/probonopd/linuxdeployqt/releases/download/continuous/linuxdeployqt-continuous-x86_64.AppImage
            mv linuxdeployqt-continuous-x86_64.AppImage linuxdeployqt-continuous.AppImage 
            EXTRA_ARGS=""
          elif [[ "$ARCH" == "aarch64" ]]; then
            wget -c -nv https://github.com/probonopd/linuxdeployqt/releases/download/continuous/linuxdeployqt-continuous-aarch64.AppImage
            mv linuxdeployqt-continuous-aarch64.AppImage linuxdeployqt-continuous.AppImage
            mkdir -p ${{github.workspace}}/build/artifacts/AppDir/usr/share/doc/libc6/
            touch ${{github.workspace}}/build/artifacts/AppDir/usr/share/doc/libc6/copyright        
            EXTRA_ARGS="-unsupported-allow-new-glibc"
          fi

          chmod u+x linuxdeployqt-continuous.AppImage
          export LD_LIBRARY_PATH=/usr/local/lib:/usr/local/lib64:$LD_LIBRARY_PATH
          ./linuxdeployqt-continuous.AppImage \
            ${{github.workspace}}/build/artifacts/AppDir/usr/share/applications/*.desktop \
            $EXTRA_ARGS \
            -no-translations \
            -extra-plugins=iconengines,platforms,sqldrivers/libqsqlite.so \
            -appimage \
            -executable-dir=${{github.workspace}}/build/artifacts/AppDir/usr/lib/modules
        if: runner.os == 'Linux'

      - name: Build GpgFrontend (Windows)
        shell: msys2 {0}
        run: |
          cd $(cygpath -u "${{github.workspace}}")
          mkdir build && cd build
          cmake -G "Ninja" -DCMAKE_BUILD_TYPE=${{env.BUILD_TYPE}} \
            -DGPGFRONTEND_LINK_GPGME_INTO_CORE=ON \
            ..
          cmake --build . \
            --config ${{ env.BUILD_TYPE }} \
            --parallel \
            --verbose
        if: runner.os == 'Windows'

      - name: Download GnuPG Binary Release (Windows)
        shell: msys2 {0}
        run: |
          export URL="https://ftp.bktus.com/GnuPG/${{env.GNUPG_VERSION}}"
          export KEY_URL="https://ftp.bktus.com/GPG_KEYS/5CA3DA246843FD03.asc"
          export FILE="gnupg.zip"
          export CHECKSUM_FILE="SHA256SUMS.txt"
          export SIGNATURE_FILE="gnupg.zip.sig"
          export GNUPGHOME=$(mktemp -d)

          cd $(cygpath -u "${{github.workspace}}")

          mkdir -p build/downloads

          curl -o build/downloads/$FILE $URL/$FILE
          curl -o build/downloads/$CHECKSUM_FILE $URL/$CHECKSUM_FILE
          curl -o build/downloads/5CA3DA246843FD03.asc $KEY_URL
          curl -o build/downloads/$SIGNATURE_FILE $URL/$SIGNATURE_FILE

          gpg --import build/downloads/5CA3DA246843FD03.asc
          gpg --verify build/downloads/$SIGNATURE_FILE build/downloads/$FILE
          if [ $? -ne 0 ]; then
            echo "GnuPG signature verification failed!" >&2
            exit 1
          fi

          CHECKSUM=$(grep "$FILE" build/downloads/$CHECKSUM_FILE | awk '{print $1}')
          ACTUAL_CHECKSUM=$(sha256sum build/downloads/$FILE | awk '{print $1}')
          echo "Expected Checksum: $CHECKSUM"
          echo "Actual Checksum: $ACTUAL_CHECKSUM"
          if [ "$CHECKSUM" != "$ACTUAL_CHECKSUM" ]; then
            echo "Checksum verification failed!" >&2
            exit 1
          fi

          mkdir -p build/artifacts
          unzip build/downloads/$FILE -d build/artifacts/
          ls -l build/artifacts/
        if: runner.os == 'Windows'

      - name: Package (Windows)
        shell: msys2 {0}
        run: |
          cd $(cygpath -u "${{github.workspace}}")
          cp PrivacyPolicy.md build/artifacts/
          cp README.md build/artifacts/
          cp SECURITY.md build/artifacts/
          cp TRANSLATORS build/artifacts/
          cp COPYING build/artifacts/
          cp gpgfrontend.ico build/artifacts/bin/
          rm -rf build/artifacts/bin/*.a
          rm -rf build/artifacts/bin/modules/*.a
          mv build/artifacts/bin/modules build/artifacts/modules
          touch build/artifacts/bin/ENV.ini
          echo "PortableMode=true" >> build/artifacts/bin/ENV.ini
          cd build
          windeployqt6 --no-translations --force ./artifacts/bin/libgf_core.dll
          windeployqt6 --no-translations --force ./artifacts/bin/libgf_ui.dll
          windeployqt6 --no-translations --force ./artifacts/bin/libgf_test.dll
          windeployqt6 --no-translations --force ./artifacts/bin/GpgFrontend.exe
          for module in ./artifacts/modules/*.dll; do
            windeployqt6 --no-translations --force "$module"
          done
          mkdir upload-artifact
          cd artifacts
          zip -r ../upload-artifact/GpgFrontend-${{env.SHORT_SHA}}-${{matrix.os}}-x86_64.zip *
        if: runner.os == 'Windows'

      - name: Upload Artifact (Linux)
        uses: actions/upload-artifact@v7
        with:
          name: gpgfrontend-${{matrix.os}}-${{env.BUILD_TYPE_LOWER}}-${{env.SHORT_SHA}}
          path: ${{github.workspace}}/build/upload-artifact/Gpg_Frontend*.AppImage*
        if: runner.os == 'Linux'

      - name: Upload Artifact (macOS)
        uses: actions/upload-artifact@v7
        with:
          name: gpgfrontend-${{env.OS_IDENTIFIER}}-${{env.BUILD_TYPE_LOWER}}-${{env.SHORT_SHA}}
          path: ${{github.workspace}}/build/upload-artifact/*
        if: runner.os == 'macOS'

      - name: Upload Artifact (Windows)
        uses: actions/upload-artifact@v7
        with:
          name: gpgfrontend-${{matrix.os}}-${{env.BUILD_TYPE_LOWER}}-${{env.SHORT_SHA}}
          path: ${{github.workspace}}/build/upload-artifact/*
        if: runner.os == 'Windows'

  release:
    needs: build
    runs-on: ubuntu-latest
    # Only publish nightly release from develop branch.
    # Stable releases are packaged manually/offline.
    if: github.event_name != 'pull_request' && github.ref_name == 'develop'
    environment: nightly-release-approval
    steps:
      - uses: actions/checkout@v6
        with:
          lfs: "false"
          submodules: recursive

      - name: Re-create nightly tag
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          cd ${{github.workspace}}
          gh release delete nightly --repo saturneric/GpgFrontend --cleanup-tag --yes || true
          git tag -f nightly $GITHUB_SHA
          git push origin nightly --force

      - name: Download Artifacts
        uses: actions/download-artifact@v4
        with:
          path: artifacts/
          pattern: gpgfrontend-*
          merge-multiple: true

      - name: Ignore Non-Artifact Files
        run: |
          # Remove MAS specific .pkg files if they exist, since they are not
          # needed for the release and we only want to keep the main artifacts
          # (dmg, AppImage, zip).
          find artifacts/ -type f -name '*.pkg' -delete

      - name: Generate SHA256 checksums
        run: |
          sha256sum artifacts/* > artifacts/SHA256SUMS.txt
          cat artifacts/SHA256SUMS.txt

      - name: List files
        run: ls -rl artifacts/

      - name: Generate Nightly Release Title
        id: release_title
        run: echo "title=Nightly Build $(date +'%Y-%m-%d')" >> $GITHUB_OUTPUT

      - name: Update Nightly Release
        uses: softprops/action-gh-release@v2
        with:
          tag_name: nightly
          name: ${{ steps.release_title.outputs.title }}
          draft: false
          prerelease: true
          body_path: ${{ github.workspace }}/.github/NIGHTLY_RELEASE.md
          files: |
            artifacts/*