desktop-publish.yml

name: Desktop App CI

on:
  push:
    tags: [ "desktop-v*" ]
  workflow_dispatch:
    inputs:
      platform:
        description: 'Platform to build for'
        required: false
        default: 'all'
        type: choice
        options:
          - all
          - macos
          - windows
          # - linux

jobs:
  build-and-publish:
    runs-on: ${{ matrix.os }}
    permissions:
      contents: write
    strategy:
      fail-fast: false
      matrix:
        include:
          - os: macos-latest
            platform: darwin
            arch: arm64
            ui_theme: macos
          - os: macos-latest
            platform: darwin
            arch: x64
            ui_theme: macos
          # - os: ubuntu-latest
          #   platform: linux
          #   arch: x64
          #   ui_theme: linux
          - os: windows-latest
            platform: win32
            arch: x64
            ui_theme: windows
    steps:
      - uses: actions/checkout@v4

      - name: Verify version matches tag
        if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags/')
        shell: bash
        working-directory: ./desktop
        run: |
          TAG=${GITHUB_REF#refs/tags/}
          TAG=${TAG#desktop-v}
          PKG_VERSION=$(node -p "require('./package.json').version")
          if [ "$TAG" != "$PKG_VERSION" ]; then
            echo "::error::Tag ($TAG) does not match desktop/package.json version ($PKG_VERSION)"
            exit 1
          fi
          echo "Version verified: $PKG_VERSION"

      - name: Build desktop app
        uses: ./.github/actions/build-desktop
        with:
          ui_theme: ${{ matrix.ui_theme }}

      # Import Apple Developer ID certificate for macOS code signing (optional)
      - name: Import Apple signing certificate
        if: matrix.platform == 'darwin' && env.APPLE_CERTIFICATE != ''
        env:
          APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }}
          APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
        run: |
          KEYCHAIN_PATH=$RUNNER_TEMP/app-signing.keychain-db
          KEYCHAIN_PASSWORD=$(openssl rand -base64 32)

          # Create temporary keychain
          security create-keychain -p "$KEYCHAIN_PASSWORD" "$KEYCHAIN_PATH"
          security set-keychain-settings -lut 21600 "$KEYCHAIN_PATH"
          security unlock-keychain -p "$KEYCHAIN_PASSWORD" "$KEYCHAIN_PATH"

          # Import certificate
          echo "$APPLE_CERTIFICATE" | base64 --decode > $RUNNER_TEMP/certificate.p12
          security import $RUNNER_TEMP/certificate.p12 -P "$APPLE_CERTIFICATE_PASSWORD" \
            -A -t cert -f pkcs12 -k "$KEYCHAIN_PATH"
          security set-key-partition-list -S apple-tool:,apple: -k "$KEYCHAIN_PASSWORD" "$KEYCHAIN_PATH"

          # Add to search list
          security list-keychains -d user -s "$KEYCHAIN_PATH" $(security list-keychains -d user | tr -d '"')

          echo "Apple signing certificate imported"

      - name: Package desktop app
        if: github.event_name == 'workflow_dispatch'
        run: npx electron-forge package --arch=${{ matrix.arch }}
        working-directory: ./desktop
        env:
          NODE_ENV: production
          SERVER_URL: ${{ vars.SERVER_URL }}
          WS_SERVER_URL: ${{ vars.WS_SERVER_URL }}
          NODE_OPTIONS: "--max_old_space_size=4096"
          APPLE_ID: ${{ secrets.APPLE_ID }}
          APPLE_ID_PASSWORD: ${{ secrets.APPLE_ID_PASSWORD }}
          APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}

      - name: Publish app
        if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags/')
        run: npx electron-forge publish --arch=${{ matrix.arch }}
        working-directory: ./desktop
        env:
          NODE_ENV: production
          SERVER_URL: ${{ vars.SERVER_URL }}
          WS_SERVER_URL: ${{ vars.WS_SERVER_URL }}
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          NODE_OPTIONS: "--max_old_space_size=4096"
          APPLE_ID: ${{ secrets.APPLE_ID }}
          APPLE_ID_PASSWORD: ${{ secrets.APPLE_ID_PASSWORD }}
          APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}

      # Upload artifacts for manual workflow runs
      - name: Upload build artifacts
        if: github.event_name == 'workflow_dispatch'
        uses: actions/upload-artifact@v4
        with:
          name: desktop-${{ matrix.platform }}-${{ matrix.arch }}
          path: ./desktop/out/
          retention-days: 7

      # Upload make output for the desktop-latest job
      - name: Upload make artifacts for latest release
        if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags/')
        uses: actions/upload-artifact@v4
        with:
          name: desktop-make-${{ matrix.platform }}-${{ matrix.arch }}
          path: ./desktop/out/make/**/*
          retention-days: 1

  # Update the rolling "desktop-latest" release with artifacts from the current build
  update-latest-release:
    if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags/')
    needs: build-and-publish
    runs-on: ubuntu-latest
    permissions:
      contents: write
    steps:
      - uses: actions/checkout@v4
        with:
          sparse-checkout: desktop/package.json

      - name: Get version
        id: version
        run: echo "version=$(node -p "require('./desktop/package.json').version")" >> "$GITHUB_OUTPUT"

      - name: Download all make artifacts
        uses: actions/download-artifact@v4
        with:
          pattern: desktop-make-*
          path: artifacts
          merge-multiple: true

      - name: List artifacts
        run: find artifacts -type f | head -50

      - name: Update desktop-latest release
        uses: softprops/action-gh-release@v2
        with:
          tag_name: desktop-latest
          name: "desktop-v${{ steps.version.outputs.version }}"
          body: |
            Latest desktop app build — **v${{ steps.version.outputs.version }}**

            This is a rolling release that always points to the most recent desktop build.
            For the full changelog, see the [versioned release](https://github.com/${{ github.repository }}/releases/tag/${{ github.ref_name }}).
          prerelease: false
          make_latest: false
          files: artifacts/**/*
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}