release.yml

name: Release

on:
  push:
    tags:
      - "v*"

permissions:
  contents: read

jobs:
  version:
    name: Validate release tag
    runs-on: ubuntu-22.04
    outputs:
      version: ${{ steps.version.outputs.version }}
    steps:
      - id: version
        name: Derive and validate version
        env:
          TAG: ${{ github.ref_name }}
        run: |
          case "$TAG" in
            v[0-9]*.[0-9]*.[0-9]*) ;;
            *) echo "Release tags must be exactly vX.Y.Z (got $TAG)" >&2; exit 1 ;;
          esac
          VERSION="${TAG#v}"
          if [[ ! "$VERSION" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
            echo "Invalid release version: $VERSION" >&2
            exit 1
          fi
          echo "version=$VERSION" >> "$GITHUB_OUTPUT"

  verify:
    name: Verify repository
    needs: version
    runs-on: ubuntu-22.04
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

      - uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4

      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
        with:
          node-version: 22
          cache: pnpm

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      - name: Run verification suite
        shell: bash
        run: |
          set +e
          pnpm verify 2>&1 | tee "$RUNNER_TEMP/verify.log"
          status="${PIPESTATUS[0]}"
          set -e
          if [[ "$status" -ne 0 ]]; then
            details="$(tail -n 80 "$RUNNER_TEMP/verify.log" | sed -z 's/%/%25/g; s/\r/%0D/g; s/\n/%0A/g')"
            echo "::error title=pnpm verify failed::$details"
            exit "$status"
          fi

  build:
    name: Build ${{ matrix.target }}
    needs: version
    strategy:
      fail-fast: false
      matrix:
        include:
          - os: windows-latest
            target: windows-x64
            bundles: nsis
            bundle-paths: apps/desktop/src-tauri/target/release/bundle/nsis
          - os: ubuntu-22.04
            target: linux-x64
            bundles: deb
            bundle-paths: |
              apps/desktop/src-tauri/target/release/bundle/deb
    runs-on: ${{ matrix.os }}
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

      - uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4

      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
        with:
          node-version: 22
          cache: pnpm

      - uses: dtolnay/rust-toolchain@4360b52568e2003a75bf9bc1d59f33a8e3fc893c # stable

      - uses: actions/setup-java@cf277c60eb25467037889841efdb72551f06f6c3 # v4
        with:
          distribution: temurin
          java-version: "21"

      - name: Install Linux dependencies
        if: runner.os == 'Linux'
        run: |
          sudo apt-get update
          sudo apt-get install --no-install-recommends -y \
            libwebkit2gtk-4.1-dev libgtk-3-dev librsvg2-dev patchelf libssl-dev \
            libfuse2 xdg-utils file libayatana-appindicator3-dev

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      - name: Prepare native resources
        shell: bash
        run: |
          if [[ "$RUNNER_OS" != "Windows" ]]; then
            chmod +x services/jvm-sidecar/bootstrap.sh services/jvm-sidecar/gradlew
          fi
          pnpm prepare:resources -- --target=${{ matrix.target }}
          pnpm validate:resources -- --target=${{ matrix.target }}

      - name: Build Tauri bundles
        shell: bash
        env:
          VERSION: ${{ needs.version.outputs.version }}
          TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
          TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
        run: |
          printf '{"version":"%s","bundle":{"createUpdaterArtifacts":true}}\n' "$VERSION" > "$RUNNER_TEMP/tauri-version.json"
          pnpm --filter desktop exec tauri build \
            --bundles "${{ matrix.bundles }}" \
            --config "$RUNNER_TEMP/tauri-version.json"

      - name: Upload release artifacts
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
        with:
          name: release-${{ matrix.target }}
          path: ${{ matrix.bundle-paths }}
          if-no-files-found: error
          retention-days: 7

  release:
    name: Create GitHub Release
    needs: [version, verify, build]
    runs-on: ubuntu-22.04
    permissions:
      contents: write
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

      - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
        with:
          pattern: release-*
          path: release-files
          merge-multiple: true

      - name: Flatten release assets
        shell: bash
        run: |
          set -euo pipefail
          mkdir release-assets
          while IFS= read -r -d '' file; do
            name="$(basename "$file")"
            if [[ -e "release-assets/$name" ]]; then
              echo "Duplicate release asset name: $name" >&2
              exit 1
            fi
            cp "$file" "release-assets/$name"
          done < <(find release-files -type f \( -name '*.deb' -o -name '*.exe' -o -name '*.sig' \) -print0 | sort -z)

      - name: Create updater manifest
        working-directory: release-assets
        env:
          VERSION: ${{ needs.version.outputs.version }}
        shell: bash
        run: |
          set -euo pipefail
          installer="$(find . -maxdepth 1 -type f -name '*-setup.exe' -print -quit)"
          test -n "$installer"
          signature_file="${installer}.sig"
          test -f "$signature_file"
          asset_name="${installer#./}"
          jq -n \
            --arg version "$VERSION" \
            --arg pub_date "$(date -u +'%Y-%m-%dT%H:%M:%SZ')" \
            --arg signature "$(cat "$signature_file")" \
            --arg url "https://github.com/cccadet/omni-sql/releases/download/v${VERSION}/${asset_name}" \
            '{version: $version, pub_date: $pub_date, platforms: {"windows-x86_64": {signature: $signature, url: $url}}}' \
            > latest.json

      - name: Create SHA256SUMS
        working-directory: release-assets
        run: sha256sum -- * > SHA256SUMS

      - name: Verify release assets
        working-directory: release-assets
        shell: bash
        run: |
          set -euo pipefail
          test "$(find . -maxdepth 1 -type f ! -name SHA256SUMS | wc -l)" -gt 0
          sha256sum --check SHA256SUMS

      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
        with:
          name: SHA256SUMS
          path: release-assets/SHA256SUMS
          if-no-files-found: error
          retention-days: 7

      - name: Publish GitHub Release
        uses: softprops/action-gh-release@3bb12739c298aeb8a4eeaf626c5b8d85266b0e65 # v2
        with:
          tag_name: v${{ needs.version.outputs.version }}
          name: omni-sql v${{ needs.version.outputs.version }}
          body_path: docs/releases/v${{ needs.version.outputs.version }}.md
          files: |
            release-assets/*