release.yml

# SPDX-License-Identifier: LicenseRef-PolyForm-Noncommercial-1.0.0
# Build installable binaries and attach them to a GitHub Release on every v* tag.
#
# macOS   → universal .dmg (Apple Silicon + Intel). Signs + notarizes automatically
#           IF the APPLE_* secrets are set; otherwise the .dmg is unsigned
#           (users right-click → Open the first time).
# Linux   → .AppImage / .deb / .rpm.
# Windows → .exe (NSIS) / .msi (WiX). Unsigned, so SmartScreen shows
#           "More info → Run anyway" on first launch.
name: Release

on:
  push:
    tags:
      - "v*"

jobs:
  release:
    permissions:
      contents: write
    strategy:
      fail-fast: false
      matrix:
        include:
          - platform: macos-latest
            args: "--target universal-apple-darwin"
            rust-targets: "aarch64-apple-darwin,x86_64-apple-darwin"
          - platform: ubuntu-22.04
            args: ""
            rust-targets: ""
          - platform: windows-latest
            args: ""
            rust-targets: ""
    runs-on: ${{ matrix.platform }}
    steps:
      - uses: actions/checkout@v4

      - name: Extract release notes for this tag
        # The single source of truth for "what changed" is CHANGELOG.md. We pull
        # out the section whose heading matches the tag and hand it to
        # tauri-action as the release body — which is also what tauri-action
        # writes into latest.json's `notes`, i.e. what the in-app updater shows.
        # Runs on every matrix platform (bash is available on all three runners)
        # so each job produces an identical body and latest.json stays consistent.
        id: notes
        shell: bash
        run: |
          ver="${GITHUB_REF_NAME}"
          # Print the lines under `## <tag>` up to the next `## ` heading, with
          # leading and trailing blank lines trimmed but internal ones kept.
          # Done inside awk so it needs nothing beyond POSIX (no tac/GNU sed) —
          # this step also runs on the macOS and Windows runners.
          body="$(awk -v head="## $ver" '
            $0 == head { grab=1; next }
            grab && /^## / { exit }
            grab {
              if ($0 ~ /[^[:space:]]/) { while (pending-- > 0) print ""; pending=0; print; started=1 }
              else if (started) { pending++ }
            }
          ' CHANGELOG.md)"
          if [ -z "$body" ]; then
            echo "::warning::no CHANGELOG.md section for $ver — using a fallback line"
            body="See the release page for what's new in ${ver}."
          fi
          {
            echo "body<<__NOTES_EOF__"
            echo "$body"
            echo "__NOTES_EOF__"
          } >> "$GITHUB_OUTPUT"

      - name: Install Linux system dependencies
        if: matrix.platform == 'ubuntu-22.04'
        run: |
          sudo apt-get update
          sudo apt-get install -y \
            libwebkit2gtk-4.1-dev \
            build-essential curl wget file \
            libxdo-dev libssl-dev \
            libayatana-appindicator3-dev \
            librsvg2-dev patchelf

      - name: Install NASM (Windows)
        # The vendored OpenSSL that backs SQLCipher assembles with NASM on MSVC.
        # Strawberry Perl is already on the runner; NASM is not.
        if: matrix.platform == 'windows-latest'
        uses: ilammy/setup-nasm@v1

      - name: Set up Node
        uses: actions/setup-node@v4
        with:
          node-version: 20

      - name: Set up Rust
        uses: dtolnay/rust-toolchain@stable
        with:
          targets: ${{ matrix.rust-targets }}

      - name: Cache Rust build
        uses: swatinem/rust-cache@v2
        with:
          workspaces: ./src-tauri -> target

      - name: Install frontend dependencies
        run: npm ci

      - name: Build and release
        uses: tauri-apps/tauri-action@v0
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          # Updater signing — required for self-update to verify downloads.
          # Add TAURI_SIGNING_PRIVATE_KEY as a repo secret (contents of
          # ~/.tauri/field-notes-updater.key). Password is empty for this key.
          TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
          TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
          # macOS Developer ID signing + notarization.
          # Currently DISABLED — with no Apple Developer cert, passing empty
          # APPLE_* values makes Tauri attempt (and fail) an empty codesign, so
          # the build ad-hoc signs instead. To enable once you have a Developer
          # ID: add these as repository secrets and uncomment this block.
          # APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }}
          # APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
          # APPLE_SIGNING_IDENTITY: ${{ secrets.APPLE_SIGNING_IDENTITY }}
          # APPLE_ID: ${{ secrets.APPLE_ID }}
          # APPLE_PASSWORD: ${{ secrets.APPLE_PASSWORD }}
          # APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
        with:
          tagName: ${{ github.ref_name }}
          releaseName: "Field Notes ${{ github.ref_name }}"
          # The changelog section for this tag, from the step above. This is the
          # release body AND `latest.json`'s `notes`, so the in-app updater prompt
          # now shows what actually changed. Download links and Gatekeeper /
          # SmartScreen help are deliberately NOT here — they'd be noise in the
          # app; they're added to the GitHub release page after publishing
          # (see RELEASING.md).
          releaseBody: ${{ steps.notes.outputs.body }}
          releaseDraft: true
          # The updater reads /releases/latest/download/latest.json, and GitHub's
          # "latest" excludes prereleases. So marking a v*-beta / v*-rc tag as a
          # prerelease is what keeps it out of everyone's auto-update — it must not
          # depend on remembering to tick a box in the publish dialog. A plain
          # `v0.4.0` has no `-`, stays non-prerelease, and becomes the update everyone
          # (including beta testers, since 0.4.0 > 0.4.0-beta.1) is offered.
          prerelease: ${{ contains(github.ref_name, '-') }}
          args: ${{ matrix.args }}