release.yml

name: BuildAndReleaseChipmunk

on:
  push:
    tags:
      - "*"

permissions:
  contents: write

jobs:
  create_release:
    name: Create release
    runs-on: ubuntu-latest
    outputs:
      upload_url: ${{ steps.create_release.outputs.upload_url }}
    env:
      PUBLISH_FOR_PULL_REQUEST: true
      CSC_FOR_PULL_REQUEST: true
    steps:
      - name: Release
        if: startsWith(github.ref, 'refs/tags/')
        id: create_release
        uses: softprops/action-gh-release@v2
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        with:
          prerelease: true
          tag_name: ${{ github.ref_name }}
          name: ${{ github.ref_name }}

  build_release:
    name: Build release
    needs: create_release
    runs-on: ${{ matrix.os }}
    strategy:
      matrix:
        os: [ubuntu-22.04, windows-latest, macos-15-intel, macOS-latest]
        rust: [stable]
    env:
      APPLEID: ${{ secrets.APPLEID }}
      APPLEIDPASS: ${{ secrets.APPLEIDPASS }}
      # CSC_* is the Developer ID Application certificate for signing the app.
      CSC_KEY_PASSWORD: ${{ secrets.CSC_KEY_PASSWORD }}
      CSC_LINK: ${{ secrets.CSC_LINK }}
      # INSTALLER_KEY/INSTALLER_PWD is the Developer ID Installer .p12 used for
      # signing the macOS .pkg as pkgbuild cannot use the application identity.
      INSTALLER_CSC_KEY_PASSWORD: ${{ secrets.INSTALLER_PWD }}
      INSTALLER_CSC_LINK: ${{ secrets.INSTALLER_KEY }}
      KEYCHAIN_PWD: ${{ secrets.KEYCHAIN_PWD }}
      SIGNING_ID: ${{ secrets.SIGNING_ID }}
      INSTALLER_SIGNING_ID: ${{ secrets.INSTALLER_SIGNING_ID }}
      TEAMID: ${{ secrets.TEAMID }}
    steps:
      - name: Checkout
        uses: actions/checkout@v4
      - name: Install Linux build dependencies
        if: runner.os == 'Linux'
        run: |
          # eframe/wgpu pulls in native Linux UI and input libraries that are
          # not present on the base runner image.
          sudo apt-get update
          sudo apt-get install -y \
            libasound2-dev \
            libgtk-3-dev \
            libudev-dev \
            libwayland-dev \
            libxkbcommon-dev \
            libxkbcommon-x11-dev \
            libxcb-render0-dev \
            libxcb-shape0-dev \
            libxcb-xfixes0-dev \
            libxcb-xkb-dev \
            binutils \
            desktop-file-utils \
            dpkg-dev \
            rpm \
            pkg-config
      - name: Install rust
        uses: dtolnay/rust-toolchain@stable
      - name: Cache Rust build outputs
        uses: Swatinem/rust-cache@v2
        with:
          workspaces: |
            . -> target
      - name: Install just
        run: cargo install just --locked
      - name: Install Windows installer tooling
        if: runner.os == 'Windows'
        shell: pwsh
        run: |
          # release_app.py emits a WiX v3 source file and then calls candle/light
          # to create the MSI.
          choco install wixtoolset --no-progress -y
          $wixRoot = Get-ChildItem "${env:ProgramFiles(x86)}" -Directory -Filter "WiX Toolset*" |
            Sort-Object Name -Descending |
            Select-Object -First 1
          if ($null -eq $wixRoot) {
            throw "WiX Toolset installation was not found"
          }
          $wixBin = Join-Path $wixRoot.FullName "bin"
          Add-Content $env:GITHUB_PATH $wixBin
      - name: Setup keychain for signing and notarizing
        # TODO: Apple code signing temporarily disabled; restore the condition.
        if: false # runner.os == 'macOS'
        run: |
          # The CI keychain is temporary and contains only the certificates
          # needed by this job: Developer ID Application for .app signing and
          # Developer ID Installer for .pkg signing.
          security create-keychain -p "$KEYCHAIN_PWD" build.keychain
          security default-keychain -s build.keychain
          certfile="${HOME}/buildcert.p12"
          echo "$CSC_LINK" | base64 -d > "$certfile"
          security import \
            "$certfile" \
            -P "$CSC_KEY_PASSWORD" \
            -A \
            -k build.keychain
          rm "$certfile"
          # Import the installer certificate only when present so local test
          # runs can still produce an unsigned .pkg.
          if [ -n "$INSTALLER_CSC_LINK" ]; then
            installer_certfile="${HOME}/installer-buildcert.p12"
            installer_cert_password="${INSTALLER_CSC_KEY_PASSWORD:-$CSC_KEY_PASSWORD}"
            echo "$INSTALLER_CSC_LINK" | base64 -d > "$installer_certfile"
            security import \
              "$installer_certfile" \
              -P "$installer_cert_password" \
              -A \
              -k build.keychain
            rm "$installer_certfile"
          fi
          # Allow non-interactive codesign/pkgbuild access to the imported
          # private keys during the CI run.
          security set-key-partition-list \
            -S apple-tool:,apple:,codesign: \
            -s \
            -k "$KEYCHAIN_PWD" \
            build.keychain
          security set-keychain-settings build.keychain
          security unlock-keychain -p "$KEYCHAIN_PWD" build.keychain
          security find-identity -v -p codesigning build.keychain
      - name: Build release
        shell: bash
        run: |
          # release_app.py owns the artifact layout. macOS needs signing and
          # notarization; Linux and Windows produce unsigned portable/installer.
          # TODO: Apple code signing temporarily disabled. Restore this branch
          # together with the keychain step above.
          # if [ "${{ runner.os }}" = "macOS" ]; then
          #   just release-signed
          # else
          #   just release
          # fi
          just release
      - name: List release files
        working-directory: ./target/dist
        run: ls
      - name: Upload release asset
        uses: softprops/action-gh-release@v2
        with:
          tag_name: ${{ github.ref_name }}
          # Portable artifacts intentionally use .tgz to match the legacy
          # release names; installers are uploaded alongside them. Keep this
          # list explicit so temporary signing/notarization files never become
          # public release assets.
          files: |
            ./target/dist/*.tgz
            ./target/dist/*.deb
            ./target/dist/*.rpm
            ./target/dist/*.msi
            ./target/dist/*.pkg