desktop-release.yml

name: Desktop Release

on:
  push:
    tags:
      - 'v*.*.*'
  workflow_dispatch:
    inputs:
      tag:
        description: Tag to build (e.g. v1.5.36)
        required: true

permissions:
  contents: write

jobs:
  build:
    strategy:
      fail-fast: false
      matrix:
        include:
          - os: macos-latest
            name: macOS
            script: electron:build:mac
          - os: windows-latest
            name: Windows
            script: electron:build:win
          - os: ubuntu-latest
            name: Linux
            script: electron:build:linux

    runs-on: ${{ matrix.os }}
    timeout-minutes: 60
    name: ${{ matrix.name }}

    steps:
      - name: Resolve tag
        id: resolve_tag
        shell: bash
        env:
          INPUT_TAG: ${{ github.event.inputs.tag }}
          REF_NAME: ${{ github.ref_name }}
        run: |
          TAG_NAME="${INPUT_TAG:-$REF_NAME}"
          case "$TAG_NAME" in
            v[0-9]*.[0-9]*.[0-9]*|v[0-9]*.[0-9]*.[0-9]*-*)
              ;;
            *)
              echo "Refusing to build non-version tag: $TAG_NAME" >&2
              exit 1
              ;;
          esac
          echo "tag=$TAG_NAME" >> "$GITHUB_OUTPUT"

      - name: Checkout
        uses: actions/checkout@v4
        with:
          ref: ${{ steps.resolve_tag.outputs.tag }}
          fetch-depth: 0

      - name: Setup Node
        uses: actions/setup-node@v4
        with:
          node-version-file: .nvmrc
          cache: npm

      - name: Setup Python (for node-gyp)
        uses: actions/setup-python@v5
        with:
          python-version: '3.11'

      - name: Sync package version with tag
        shell: bash
        env:
          TAG: ${{ steps.resolve_tag.outputs.tag }}
        run: |
          TAG_VERSION="${TAG#v}"
          CURRENT_VERSION="$(node -p "require('./package.json').version")"
          if [ "$CURRENT_VERSION" != "$TAG_VERSION" ]; then
            npm pkg set version="$TAG_VERSION"
          fi

      - name: Install dependencies
        run: npm ci
        env:
          CI: 'true'

      - name: Install Linux system deps
        if: matrix.os == 'ubuntu-latest'
        run: |
          sudo apt-get update
          sudo apt-get install -y libopenjp2-tools rpm fakeroot dpkg

      - name: Install macOS system deps
        if: matrix.os == 'macos-latest'
        run: |
          brew install pkg-config xz

      - name: Prepare safe Windows HOME
        if: matrix.os == 'windows-latest'
        shell: pwsh
        run: |
          New-Item -ItemType Directory -Force -Path "D:\\swarmclaw-home" | Out-Null
          "USERPROFILE=D:\\swarmclaw-home" | Out-File -FilePath $env:GITHUB_ENV -Append -Encoding utf8
          "HOMEDRIVE=D:" | Out-File -FilePath $env:GITHUB_ENV -Append -Encoding utf8
          "HOMEPATH=\\swarmclaw-home" | Out-File -FilePath $env:GITHUB_ENV -Append -Encoding utf8

      - name: Check macOS signing inputs
        if: matrix.os == 'macos-latest'
        shell: bash
        env:
          CSC_LINK_SECRET: ${{ secrets.CSC_LINK }}
          CSC_KEY_PASSWORD_SECRET: ${{ secrets.CSC_KEY_PASSWORD }}
          APPLE_ID_SECRET: ${{ secrets.APPLE_ID }}
          APPLE_APP_SPECIFIC_PASSWORD_SECRET: ${{ secrets.APPLE_APP_SPECIFIC_PASSWORD }}
          APPLE_TEAM_ID_SECRET: ${{ secrets.APPLE_TEAM_ID }}
          APPLE_API_KEY_SECRET: ${{ secrets.APPLE_API_KEY }}
          APPLE_API_KEY_ID_SECRET: ${{ secrets.APPLE_API_KEY_ID }}
          APPLE_API_ISSUER_SECRET: ${{ secrets.APPLE_API_ISSUER }}
        run: |
          set -euo pipefail
          has_certificate=false
          has_apple_id_notary=false
          has_api_key_notary=false

          if [ -n "${CSC_LINK_SECRET:-}" ] && [ -n "${CSC_KEY_PASSWORD_SECRET:-}" ]; then
            has_certificate=true
          fi
          if [ -n "${APPLE_ID_SECRET:-}" ] && [ -n "${APPLE_APP_SPECIFIC_PASSWORD_SECRET:-}" ] && [ -n "${APPLE_TEAM_ID_SECRET:-}" ]; then
            has_apple_id_notary=true
          fi
          if [ -n "${APPLE_API_KEY_SECRET:-}" ] && [ -n "${APPLE_API_KEY_ID_SECRET:-}" ] && [ -n "${APPLE_API_ISSUER_SECRET:-}" ]; then
            has_api_key_notary=true
          fi

          if [ "$has_certificate" = true ] && { [ "$has_apple_id_notary" = true ] || [ "$has_api_key_notary" = true ]; }; then
            echo "Developer ID signing and notarization inputs are configured."
          else
            echo "Developer ID signing and notarization inputs are incomplete; macOS artifacts will remain ad-hoc signed."
          fi

      - name: Export macOS signing environment
        if: matrix.os == 'macos-latest'
        shell: bash
        env:
          CSC_LINK_SECRET: ${{ secrets.CSC_LINK }}
          CSC_KEY_PASSWORD_SECRET: ${{ secrets.CSC_KEY_PASSWORD }}
          APPLE_ID_SECRET: ${{ secrets.APPLE_ID }}
          APPLE_APP_SPECIFIC_PASSWORD_SECRET: ${{ secrets.APPLE_APP_SPECIFIC_PASSWORD }}
          APPLE_TEAM_ID_SECRET: ${{ secrets.APPLE_TEAM_ID }}
          APPLE_API_KEY_SECRET: ${{ secrets.APPLE_API_KEY }}
          APPLE_API_KEY_ID_SECRET: ${{ secrets.APPLE_API_KEY_ID }}
          APPLE_API_ISSUER_SECRET: ${{ secrets.APPLE_API_ISSUER }}
        run: |
          set -euo pipefail

          append_env() {
            local name="$1"
            local value="$2"
            local delimiter="SWARMCLAW_${name}_$(uuidgen | tr -d '-')"
            {
              echo "${name}<<${delimiter}"
              printf '%s\n' "$value"
              echo "${delimiter}"
            } >> "$GITHUB_ENV"
          }

          if [ -n "${CSC_LINK_SECRET:-}" ] && [ -n "${CSC_KEY_PASSWORD_SECRET:-}" ]; then
            append_env CSC_LINK "$CSC_LINK_SECRET"
            append_env CSC_KEY_PASSWORD "$CSC_KEY_PASSWORD_SECRET"
          fi

          if [ -n "${APPLE_ID_SECRET:-}" ] && [ -n "${APPLE_APP_SPECIFIC_PASSWORD_SECRET:-}" ] && [ -n "${APPLE_TEAM_ID_SECRET:-}" ]; then
            append_env APPLE_ID "$APPLE_ID_SECRET"
            append_env APPLE_APP_SPECIFIC_PASSWORD "$APPLE_APP_SPECIFIC_PASSWORD_SECRET"
            append_env APPLE_TEAM_ID "$APPLE_TEAM_ID_SECRET"
          fi

          if [ -n "${APPLE_API_KEY_SECRET:-}" ] && [ -n "${APPLE_API_KEY_ID_SECRET:-}" ] && [ -n "${APPLE_API_ISSUER_SECRET:-}" ]; then
            append_env APPLE_API_KEY "$APPLE_API_KEY_SECRET"
            append_env APPLE_API_KEY_ID "$APPLE_API_KEY_ID_SECRET"
            append_env APPLE_API_ISSUER "$APPLE_API_ISSUER_SECRET"
          fi

      - name: Build desktop app
        run: npm run ${{ matrix.script }} -- --publish
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          NEXT_TELEMETRY_DISABLED: '1'

      - name: Upload build logs on failure
        if: failure()
        uses: actions/upload-artifact@v4
        with:
          name: build-logs-${{ matrix.name }}
          path: |
            release/**/*.log
            release/builder-debug.yml
          if-no-files-found: ignore