release.yml

name: Release

on:
  push:
    tags:
      - 'v*'

permissions:
  contents: write

jobs:
  release:
    strategy:
      fail-fast: false
      matrix:
        include:
          - platform: ubuntu-22.04
            target: x86_64-unknown-linux-gnu
          - platform: macos-latest
            target: aarch64-apple-darwin
          - platform: macos-latest
            target: x86_64-apple-darwin
          - platform: windows-latest
            target: x86_64-pc-windows-msvc

    runs-on: ${{ matrix.platform }}

    steps:
      - name: Checkout repository
        uses: actions/checkout@v6

      - name: Install dependencies (Ubuntu)
        if: matrix.platform == 'ubuntu-22.04'
        run: |
          sudo apt-get update
          sudo apt-get install -y libwebkit2gtk-4.1-dev libappindicator3-dev librsvg2-dev patchelf

      - name: Import Apple Developer Certificate
        if: startsWith(matrix.platform, 'macos-')
        env:
          APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }}
          APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
          KEYCHAIN_PASSWORD: ${{ github.run_id }}
        run: |
          # Create variables
          CERTIFICATE_PATH=$RUNNER_TEMP/certificate.p12
          KEYCHAIN_PATH=$RUNNER_TEMP/app-signing.keychain-db

          # Decode certificate
          echo -n "$APPLE_CERTIFICATE" | base64 --decode -o $CERTIFICATE_PATH

          # Create temporary keychain
          security create-keychain -p "$KEYCHAIN_PASSWORD" $KEYCHAIN_PATH
          security set-keychain-settings -lut 21600 $KEYCHAIN_PATH
          security unlock-keychain -p "$KEYCHAIN_PASSWORD" $KEYCHAIN_PATH

          # Import certificate to keychain
          security import $CERTIFICATE_PATH -P "$APPLE_CERTIFICATE_PASSWORD" -A -t cert -f pkcs12 -k $KEYCHAIN_PATH
          security set-key-partition-list -S apple-tool:,apple: -k "$KEYCHAIN_PASSWORD" $KEYCHAIN_PATH
          security list-keychain -d user -s $KEYCHAIN_PATH

      - name: Write Apple API key to file
        if: startsWith(matrix.platform, 'macos-')
        env:
          APPLE_API_KEY: ${{ secrets.APPLE_API_KEY }}
          APPLE_API_KEY_ID: ${{ secrets.APPLE_API_KEY_ID }}
        run: |
          mkdir -p $RUNNER_TEMP/apple-keys
          API_KEY_PATH=$RUNNER_TEMP/apple-keys/AuthKey_${APPLE_API_KEY_ID}.p8

          # Debug: show format info (first 10 chars of a .p8 are always "-----BEGIN", not sensitive)
          echo "Key starts with: $(echo -n "$APPLE_API_KEY" | head -c 10)"
          echo "Key length: $(echo -n "$APPLE_API_KEY" | wc -c)"

          # If it starts with "-----", it's raw PEM - write directly
          # Otherwise assume it's base64-encoded and decode it
          if echo "$APPLE_API_KEY" | grep -q "^-----"; then
            printf '%s\n' "$APPLE_API_KEY" > "$API_KEY_PATH"
          else
            echo -n "$APPLE_API_KEY" | base64 --decode > "$API_KEY_PATH"
          fi

          echo "Written key starts with: $(head -c 10 "$API_KEY_PATH")"
          echo "APPLE_API_KEY_PATH=$API_KEY_PATH" >> $GITHUB_ENV

      - name: Setup Node.js
        uses: actions/setup-node@v6
        with:
          node-version: 20
          cache: npm

      - name: Setup Rust
        uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # @stable as of 2026-03-27
        with:
          targets: ${{ matrix.target }}

      - name: Rust cache
        uses: swatinem/rust-cache@v2
        with:
          workspaces: src-tauri -> target

      - name: Install frontend dependencies
        run: npm ci

      - name: Build and release
        uses: tauri-apps/tauri-action@v0
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
          TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
          # Apple code signing (macOS only)
          APPLE_SIGNING_IDENTITY: ${{ secrets.APPLE_SIGNING_IDENTITY }}
          # Apple notarization (macOS only) - APPLE_API_KEY_PATH is set by the "Write Apple API key to file" step
          APPLE_API_KEY: ${{ secrets.APPLE_API_KEY_ID }}
          APPLE_API_KEY_PATH: ${{ env.APPLE_API_KEY_PATH }}
          APPLE_API_ISSUER: ${{ secrets.APPLE_API_ISSUER }}
        with:
          tagName: ${{ github.ref_name }}
          releaseName: 'Claude Code Tool Manager ${{ github.ref_name }}'
          releaseBody: |
            ## Download

            | Platform | Download |
            |----------|----------|
            | Windows | `.msi` or `.exe` |
            | macOS (Apple Silicon) | `.dmg` (aarch64) |
            | macOS (Intel) | `.dmg` (x64) |
            | Linux | `.deb` or `.AppImage` |

            ## Install via Homebrew (macOS)

            ```bash
            brew tap tylergraydev/cctm
            brew install --cask claude-code-tool-manager
            ```

            ## What's Changed

            See the [commit history](https://github.com/${{ github.repository }}/commits/${{ github.ref_name }}) for details.
          releaseDraft: true
          prerelease: false
          args: --target ${{ matrix.target }}

      - name: Cleanup keychain and API key
        if: startsWith(matrix.platform, 'macos-') && always()
        run: |
          security delete-keychain $RUNNER_TEMP/app-signing.keychain-db || true
          rm -rf $RUNNER_TEMP/apple-keys || true