release.yml

# Release
#
# Triggered when a GitHub release is published (manually via the GitHub UI or
# API).  The release tag (e.g. v0.3.0) is used as the app version — package.json
# does NOT need to be updated before releasing.
#
# Steps to release:
#   1. Go to GitHub → Releases → Draft a new release
#   2. Create a tag (e.g. v0.3.0) and publish the release
#   3. This workflow runs CI, then builds and uploads binaries for all platforms

name: Release

on:
  release:
    types: [published]

permissions:
  contents: write

jobs:
  ci:
    name: CI · Lint, Typecheck & Test
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Setup Node.js
        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version: '22'
          cache: 'npm'

      - name: Install dependencies
        run: npm ci

      - name: Lint
        run: npm run lint

      - name: Typecheck
        run: npm run typecheck

      - name: Test
        run: npm test

      - name: Integration tests
        run: npm run test:integration

  build:
    needs: [ci]
    strategy:
      fail-fast: false
      matrix:
        include:
          - os: windows-latest
            platform: win
            label: Windows
          - os: macos-latest
            platform: mac
            label: macOS
          - os: ubuntu-latest
            platform: linux
            label: Linux

    name: Build · ${{ matrix.label }}
    runs-on: ${{ matrix.os }}

    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Setup Node.js
        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version: '22'
          cache: 'npm'

      # Linux arm64 cross-compilation requires additional tools
      - name: Install Linux build dependencies
        if: matrix.os == 'ubuntu-latest'
        run: |
          sudo apt-get update
          sudo apt-get install -y \
            gcc-aarch64-linux-gnu \
            g++-aarch64-linux-gnu \
            rpm \
            fakeroot \
            dpkg

      - name: Install dependencies
        run: npm ci

      - name: Build (electron-vite)
        run: npm run build

      - name: Package and publish
        env:
          # electron-builder uses GH_TOKEN to upload assets to the release
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          # macOS code signing — base64-encoded .p12 certificate and its password.
          # Set CSC_LINK and CSC_KEY_PASSWORD in GitHub repository secrets.
          # When absent the build proceeds unsigned (Gatekeeper will block it).
          CSC_LINK: ${{ secrets.CSC_LINK }}
          CSC_KEY_PASSWORD: ${{ secrets.CSC_KEY_PASSWORD }}
          # Prevent electron-builder from searching the system keychain;
          # we supply the cert explicitly via CSC_LINK.
          CSC_IDENTITY_AUTO_DISCOVERY: false
          # macOS notarization — required for Gatekeeper on modern macOS.
          # Set APPLE_ID, APPLE_APP_SPECIFIC_PASSWORD, and APPLE_TEAM_ID
          # in GitHub repository secrets. build/notarize.js skips gracefully
          # when these are absent.
          APPLE_ID: ${{ secrets.APPLE_ID }}
          APPLE_APP_SPECIFIC_PASSWORD: ${{ secrets.APPLE_APP_SPECIFIC_PASSWORD }}
          APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
        # Strip the leading 'v' from the tag (v1.2.3 → 1.2.3) and inject it
        # as the app version so package.json never needs to be updated manually.
        shell: bash
        run: |
          # Unset signing vars if the secrets are not configured — an empty
          # string causes electron-builder to resolve it as a path (the cwd).
          [ -z "$CSC_LINK" ] && unset CSC_LINK || true

          VERSION="${{ github.event.release.tag_name }}"
          VERSION="${VERSION#v}"
          npx electron-builder --${{ matrix.platform }} --publish always \
            --config.extraMetadata.version="$VERSION"

      - name: Update Homebrew Cask
        if: matrix.platform == 'mac'
        env:
          GH_TOKEN: ${{ secrets.TAP_GITHUB_TOKEN }}
          TAG: ${{ github.event.release.tag_name }}
        shell: bash
        run: |
          VERSION="${TAG#v}"

          ARM64_SHA=$(shasum -a 256 "dist/Postly-${VERSION}-arm64.dmg" | awk '{print $1}')
          X64_SHA=$(shasum -a 256 "dist/Postly-${VERSION}.dmg" | awk '{print $1}')

          git clone \
            "https://x-access-token:${GH_TOKEN}@github.com/dever-labs/homebrew-tap.git" \
            tap
          cd tap
          mkdir -p Casks

          python3 "$GITHUB_WORKSPACE/scripts/generate-cask.py" \
            "$VERSION" "$ARM64_SHA" "$X64_SHA" > Casks/postly.rb

          git config user.name "github-actions[bot]"
          git config user.email "github-actions[bot]@users.noreply.github.com"
          git add Casks/postly.rb
          git commit -m "chore: bump postly to ${VERSION}"
          git push