release.yml

name: Release

on:
  push:
    tags:
      - 'v*'
  workflow_dispatch:
    inputs:
      tag:
        description: 'Tag name to publish (e.g. v1.2.3). Leave blank to build artifacts only without creating a release.'
        required: false
        default: ''

permissions:
  contents: write

# Run JS-based actions on Node 24 — silences the Node 20 deprecation warnings
# that GitHub will start enforcing in mid-2026.
env:
  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: 'true'

# Only one release run per ref at a time. Cancel older queued/active runs.
concurrency:
  group: release-${{ github.ref }}
  cancel-in-progress: true

jobs:
  build:
    name: Build (${{ matrix.os }})
    runs-on: ${{ matrix.os }}
    timeout-minutes: 45
    strategy:
      fail-fast: false
      matrix:
        os: [windows-latest, macos-latest, ubuntu-latest]
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      # pnpm must be set up before setup-node so `cache: pnpm` can find it.
      - name: Set up pnpm
        uses: pnpm/action-setup@v4
        with:
          version: 11

      - name: Set up Node.js
        uses: actions/setup-node@v4
        with:
          # pnpm 11.7+ requires Node >= 22.13 (it uses the node:sqlite builtin).
          node-version: '22'
          cache: 'pnpm'

      # better-sqlite3 / electron-winstaller build scripts are pre-approved via
      # allowBuilds in pnpm-workspace.yaml; --frozen-lockfile fails fast if the
      # lockfile drifts from package.json. electron-builder (npmRebuild: true)
      # rebuilds native modules for Electron's ABI during packaging.
      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      # electron-builder downloads its own WiX/Squirrel/etc helpers and caches
      # them under ~/.cache/electron-builder. Caching saves ~30s per run.
      - name: Cache electron-builder downloads
        uses: actions/cache@v4
        with:
          path: |
            ~/.cache/electron
            ~/.cache/electron-builder
          key: ${{ runner.os }}-electron-builder-${{ hashFiles('pnpm-lock.yaml') }}
          restore-keys: |
            ${{ runner.os }}-electron-builder-

      - name: Build Windows (NSIS + MSI + portable)
        if: matrix.os == 'windows-latest'
        run: pnpm run build:win -- --publish never
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          # No code-signing certificate configured — disable signing so the
          # build doesn't fail looking for one. Users will see a SmartScreen
          # warning on first launch until a cert is added.
          CSC_IDENTITY_AUTO_DISCOVERY: 'false'

      - name: Build macOS (DMG x64 + arm64)
        if: matrix.os == 'macos-latest'
        run: pnpm run build:mac -- --publish never
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          # Skip signing + notarisation — Gatekeeper will warn on first open
          # until an Apple Developer ID is configured here.
          CSC_IDENTITY_AUTO_DISCOVERY: 'false'

      - name: Build Linux (AppImage)
        if: matrix.os == 'ubuntu-latest'
        run: pnpm run build:linux -- --publish never
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

      - name: List build output
        shell: bash
        run: ls -lh dist/ || true

      # Capture only the user-facing installers/binaries — skip the unpacked
      # build trees (`*-unpacked/`, `*.blockmap`, etc).
      - name: Upload build artifacts
        uses: actions/upload-artifact@v4
        with:
          name: includa-${{ matrix.os }}
          if-no-files-found: error
          retention-days: 14
          path: |
            dist/*.exe
            dist/*.msi
            dist/*.dmg
            dist/*.AppImage
            dist/latest*.yml

  release:
    name: Publish GitHub Release
    needs: build
    runs-on: ubuntu-latest
    timeout-minutes: 10
    # Only publish when triggered by a v* tag push, OR when manually dispatched
    # with a tag input (so you can re-cut a release without retagging).
    if: startsWith(github.ref, 'refs/tags/v') || (github.event_name == 'workflow_dispatch' && inputs.tag != '')
    steps:
      - name: Download all build artifacts
        uses: actions/download-artifact@v4
        with:
          path: artifacts
          merge-multiple: true

      - name: List collected artifacts
        run: ls -lh artifacts/

      - name: Create GitHub Release
        uses: softprops/action-gh-release@v2
        with:
          tag_name: ${{ inputs.tag || github.ref_name }}
          name: ${{ inputs.tag || github.ref_name }}
          draft: true
          prerelease: true
          generate_release_notes: true
          fail_on_unmatched_files: true
          # Replace any same-named asset already attached (e.g. when re-pushing
          # a moved tag to retrigger the build with bug fixes).
          overwrite_files: true
          body: |
            ## Downloads

            | Platform | File | Notes |
            |---|---|---|
            | Windows | `*-Setup.exe` (NSIS) | Standard installer with Start Menu / uninstaller |
            | Windows | `*.msi` | MSI installer for managed deployments |
            | Windows | `*-portable.exe` | Single-file portable, no install needed |
            | macOS (Intel) | `*-x64.dmg` | Drag-to-Applications |
            | macOS (Apple Silicon) | `*-arm64.dmg` | Drag-to-Applications |
            | Linux | `*.AppImage` | `chmod +x` then run |

            > **First-run note:** Builds are not yet code-signed. Windows
            > SmartScreen will warn — click "More info → Run anyway".
            > macOS Gatekeeper will block — right-click → Open the first time.
            > A Chromium engine (~300 MB) downloads on first scan.
          files: |
            artifacts/*.exe
            artifacts/*.msi
            artifacts/*.dmg
            artifacts/*.AppImage
            artifacts/latest*.yml
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}