release-desktop.yml

name: Release Desktop

on:
  push:
    tags:
      - "v*"

permissions:
  contents: write

jobs:
  release-windows:
    name: Build and publish Windows
    runs-on: windows-latest

    steps:
      - name: Check out repository
        uses: actions/checkout@v5

      - name: Install pnpm
        uses: pnpm/action-setup@v6
        with:
          version: 10

      - name: Install Node.js
        uses: actions/setup-node@v6
        with:
          node-version: 22
          cache: pnpm
          cache-dependency-path: apps/kimi-code/pnpm-lock.yaml

      - name: Install Rust
        uses: dtolnay/rust-toolchain@stable

      - name: Install frontend dependencies
        working-directory: apps/kimi-code
        run: pnpm install --frozen-lockfile

      - name: Verify tag matches app version
        shell: pwsh
        run: |
          $config = Get-Content apps/kimi-code/src-tauri/tauri.conf.json | ConvertFrom-Json
          $expectedTag = "v$($config.version)"
          if ("${{ github.ref_name }}" -ne $expectedTag) {
            throw "Tag ${{ github.ref_name }} does not match app version $expectedTag"
          }

      - name: Build and publish Kimi Code for Windows
        uses: tauri-apps/tauri-action@v1
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
        with:
          projectPath: apps/kimi-code
          tagName: ${{ github.ref_name }}
          releaseName: Kimi Code ${{ github.ref_name }}
          releaseDraft: false
          prerelease: false
          releaseAssetNamePattern: '[name]_[version]_windows_[arch][setup][ext]'

      - name: Finalize release metadata
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: node .github/scripts/update-release-downloads.mjs

  release-linux:
    name: Build and publish Linux AppImage and Debian package
    needs: release-windows
    runs-on: ubuntu-22.04

    steps:
      - name: Check out repository
        uses: actions/checkout@v5

      - name: Install Linux dependencies
        run: |
          sudo apt-get update
          sudo apt-get install -y libwebkit2gtk-4.1-dev libappindicator3-dev librsvg2-dev patchelf xdg-utils

      - name: Install pnpm
        uses: pnpm/action-setup@v6
        with:
          version: 10

      - name: Install Node.js
        uses: actions/setup-node@v6
        with:
          node-version: 22
          cache: pnpm
          cache-dependency-path: apps/kimi-code/pnpm-lock.yaml

      - name: Install Rust
        uses: dtolnay/rust-toolchain@stable

      - name: Install frontend dependencies
        working-directory: apps/kimi-code
        run: pnpm install --frozen-lockfile

      - name: Verify tag matches app version
        shell: bash
        run: |
          app_version="$(jq -r .version apps/kimi-code/src-tauri/tauri.conf.json)"
          expected_tag="v${app_version}"
          if [[ "${GITHUB_REF_NAME}" != "${expected_tag}" ]]; then
            echo "Tag ${GITHUB_REF_NAME} does not match app version ${expected_tag}" >&2
            exit 1
          fi

      - name: Build and publish Kimi Code for Linux
        uses: tauri-apps/tauri-action@v1
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
        with:
          projectPath: apps/kimi-code
          tagName: ${{ github.ref_name }}
          releaseName: Kimi Code ${{ github.ref_name }}
          releaseDraft: false
          prerelease: false
          releaseAssetNamePattern: '[name]_[version]_linux_[arch][ext]'
          args: --bundles appimage,deb

      - name: Upload missing Linux assets (fallback)
        if: failure()
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        shell: bash
        run: |
          set -euo pipefail
          version="${GITHUB_REF_NAME#v}"
          failed=0
          upload() {
            local file="$1" asset="$2"
            if [[ ! -f "$file" ]]; then
              echo "::error::Built artifact not found: $file" >&2
              failed=1
              return
            fi
            if gh release view "$GITHUB_REF_NAME" --json assets --jq '.assets[].name' | grep -Fxq "$asset"; then
              echo "Asset already uploaded: $asset"
              return
            fi
            for attempt in 1 2 3; do
              if gh release upload "$GITHUB_REF_NAME" "$file#$asset"; then
                return
              fi
              echo "Upload of $asset failed (attempt $attempt), retrying..." >&2
              sleep 10
            done
            echo "::error::Failed to upload $asset" >&2
            failed=1
          }
          upload "target/release/bundle/deb/Kimi Code_${version}_amd64.deb" "Kimi Code_${version}_linux_amd64.deb"
          upload "target/release/bundle/deb/Kimi Code_${version}_amd64.deb.sig" "Kimi Code_${version}_linux_amd64.deb.sig"
          upload "target/release/bundle/appimage/Kimi Code_${version}_amd64.AppImage" "Kimi Code_${version}_linux_amd64.AppImage"
          upload "target/release/bundle/appimage/Kimi Code_${version}_amd64.AppImage.sig" "Kimi Code_${version}_linux_amd64.AppImage.sig"
          exit "$failed"

      - name: Finalize release metadata
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: node .github/scripts/update-release-downloads.mjs

  release-macos:
    name: Build and publish macOS
    needs: release-linux
    runs-on: macos-latest

    steps:
      - name: Check out repository
        uses: actions/checkout@v5

      - name: Install pnpm
        uses: pnpm/action-setup@v6
        with:
          version: 10

      - name: Install Node.js
        uses: actions/setup-node@v6
        with:
          node-version: 22
          cache: pnpm
          cache-dependency-path: apps/kimi-code/pnpm-lock.yaml

      - name: Install Rust
        uses: dtolnay/rust-toolchain@stable
        with:
          targets: aarch64-apple-darwin,x86_64-apple-darwin

      - name: Install frontend dependencies
        working-directory: apps/kimi-code
        run: pnpm install --frozen-lockfile

      - name: Verify tag matches app version
        shell: bash
        run: |
          app_version="$(node -p "require('./apps/kimi-code/src-tauri/tauri.conf.json').version")"
          expected_tag="v${app_version}"
          if [[ "${GITHUB_REF_NAME}" != "${expected_tag}" ]]; then
            echo "Tag ${GITHUB_REF_NAME} does not match app version ${expected_tag}" >&2
            exit 1
          fi

      - name: Build and publish Kimi Code for Apple Silicon
        uses: tauri-apps/tauri-action@v1
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
        with:
          projectPath: apps/kimi-code
          tagName: ${{ github.ref_name }}
          releaseName: Kimi Code ${{ github.ref_name }}
          releaseDraft: false
          prerelease: false
          releaseAssetNamePattern: '[name]_[version]_macos_[arch][ext]'
          args: --target aarch64-apple-darwin

      - name: Finalize release metadata
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: node .github/scripts/update-release-downloads.mjs

      - name: Build and publish Kimi Code for Intel Mac
        uses: tauri-apps/tauri-action@v1
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
        with:
          projectPath: apps/kimi-code
          tagName: ${{ github.ref_name }}
          releaseName: Kimi Code ${{ github.ref_name }}
          releaseDraft: false
          prerelease: false
          releaseAssetNamePattern: '[name]_[version]_macos_[arch][ext]'
          args: --target x86_64-apple-darwin

      - name: Finalize release metadata
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: node .github/scripts/update-release-downloads.mjs