release.yml

name: Release

on:
  workflow_dispatch:
    inputs:
      platform:
        description: 'Platform to build'
        required: false
        default: 'all'
        type: choice
        options:
          - all
          - macos
          - linux
          - windows
  release:
    types: [published]

permissions:
  contents: write

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  build-macos:
    name: Build macOS (ARM64)
    if: >
      github.event_name == 'release' ||
      inputs.platform == 'all' || inputs.platform == 'macos' || inputs.platform == ''
    runs-on: [macOS, ARM64]
    timeout-minutes: 30

    steps:
      - uses: actions/checkout@v6

      - name: Setup Tauri build environment
        uses: ./.github/actions/setup-tauri-build

      - name: Import Apple certificate
        env:
          APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }}
          APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
          KEYCHAIN_PASSWORD: ${{ secrets.KEYCHAIN_PASSWORD }}
        run: |
          KEYCHAIN_PATH="$HOME/Library/Keychains/ci_signing.keychain-db"
          echo $APPLE_CERTIFICATE | base64 --decode > certificate.p12
          security create-keychain -p "$KEYCHAIN_PASSWORD" ci_signing.keychain
          security default-keychain -s ci_signing.keychain
          security unlock-keychain -p "$KEYCHAIN_PASSWORD" ci_signing.keychain
          security set-keychain-settings -t 3600 -u ci_signing.keychain
          security list-keychains -d user -s ci_signing.keychain login.keychain
          security import certificate.p12 -k ci_signing.keychain \
            -P "$APPLE_CERTIFICATE_PASSWORD" -T /usr/bin/codesign
          security set-key-partition-list -S apple-tool:,apple:,codesign: \
            -s -k "$KEYCHAIN_PASSWORD" ci_signing.keychain
          security find-identity -v -p codesigning ci_signing.keychain
          rm certificate.p12

      - name: Decode App Store Connect API key
        env:
          APPLE_API_KEY_B64: ${{ secrets.APPLE_API_KEY_B64 }}
        run: |
          echo "$APPLE_API_KEY_B64" | base64 --decode > /tmp/auth_key.p8

      - name: Build frontend
        working-directory: ./app/frontend
        run: npm run build

      - uses: tauri-apps/tauri-action@v0
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          APPLE_SIGNING_IDENTITY: ${{ secrets.APPLE_SIGNING_IDENTITY }}
          APPLE_API_ISSUER: ${{ secrets.APPLE_API_ISSUER }}
          APPLE_API_KEY: ${{ secrets.APPLE_API_KEY }}
          APPLE_API_KEY_PATH: /tmp/auth_key.p8
          LASTFM_API_KEY: ${{ secrets.LASTFM_API_KEY }}
          LASTFM_API_SECRET: ${{ secrets.LASTFM_API_SECRET }}
        with:
          tagName: ${{ github.event.release.tag_name }}
          releaseId: ${{ github.event.release.id }}
          args: --target aarch64-apple-darwin --bundles app --config '{"build":{"beforeBuildCommand":""}}'
          projectPath: './crates/mt-tauri'

      - name: Create DMG
        run: |
          APP_PATH="target/aarch64-apple-darwin/release/bundle/macos/mt.app"
          DMG_PATH="target/aarch64-apple-darwin/release/bundle/dmg/mt_1.0.0_aarch64.dmg"
          mkdir -p "$(dirname "$DMG_PATH")"
          hdiutil create -volname "mt" -srcfolder "$APP_PATH" \
            -ov -format UDZO "$DMG_PATH"

      - name: Upload DMG to release
        if: github.event_name == 'release'
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          gh release upload "${{ github.event.release.tag_name }}" \
            target/aarch64-apple-darwin/release/bundle/dmg/mt_1.0.0_aarch64.dmg

      - name: Cleanup CI keychain
        if: always()
        run: |
          security delete-keychain ci_signing.keychain || true
          rm -f /tmp/auth_key.p8

  build-linux-amd64:
    name: Build Linux (amd64)
    if: >
      github.event_name == 'release' ||
      inputs.platform == 'all' || inputs.platform == 'linux' || inputs.platform == ''
    runs-on: ubuntu-latest
    timeout-minutes: 30

    steps:
      - uses: actions/checkout@v6

      - name: Setup Tauri build environment
        uses: ./.github/actions/setup-tauri-build

      - name: Build frontend
        working-directory: ./app/frontend
        run: npm run build

      - uses: tauri-apps/tauri-action@v0
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          LASTFM_API_KEY: ${{ secrets.LASTFM_API_KEY }}
          LASTFM_API_SECRET: ${{ secrets.LASTFM_API_SECRET }}
        with:
          tagName: ${{ github.event.release.tag_name }}
          releaseId: ${{ github.event.release.id }}
          args: --target x86_64-unknown-linux-gnu --bundles deb --config '{"build":{"beforeBuildCommand":""}}'
          projectPath: './crates/mt-tauri'

  build-linux-arm64:
    name: Build Linux (ARM64)
    if: >
      github.event_name == 'release' ||
      inputs.platform == 'all' || inputs.platform == 'linux' || inputs.platform == ''
    runs-on: ubuntu-latest
    timeout-minutes: 60

    steps:
      - uses: actions/checkout@v6

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Set up QEMU
        uses: docker/setup-qemu-action@v3
        with:
          platforms: arm64

      - name: Build ARM64 .deb
        run: |
          docker buildx build \
            --platform linux/arm64 \
            --file docker/Dockerfile.linux-arm64 \
            --build-arg LASTFM_API_KEY=${{ secrets.LASTFM_API_KEY }} \
            --build-arg LASTFM_API_SECRET=${{ secrets.LASTFM_API_SECRET }} \
            --target artifacts \
            --output type=local,dest=dist/linux-arm64 \
            .

      - name: Upload ARM64 artifacts to release
        if: github.event_name == 'release'
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          gh release upload "${{ github.event.release.tag_name }}" \
            dist/linux-arm64/*.deb

  build-windows:
    name: Build Windows (x64)
    if: >
      github.event_name == 'release' ||
      inputs.platform == 'all' || inputs.platform == 'windows' || inputs.platform == ''
    runs-on: [self-hosted, Windows, X64]
    timeout-minutes: 45

    steps:
      - uses: actions/checkout@v6

      - name: Setup Tauri build environment
        uses: ./.github/actions/setup-tauri-build

      - name: Install Windows SDK (signtool)
        shell: pwsh
        run: |
          choco install windows-sdk-10.1 -y
          $signtool = Get-ChildItem -Path "${env:ProgramFiles(x86)}\Windows Kits\10\bin" `
            -Recurse -Filter signtool.exe | Where-Object { $_.FullName -match '\\x64\\' } `
            | Sort-Object { [version]($_.FullName -replace '.*\\(\d+\.\d+\.\d+\.\d+)\\.*','$1') } `
            | Select-Object -Last 1 -ExpandProperty FullName
          echo "SIGNTOOL_PATH=$signtool" >> $env:GITHUB_ENV

      - name: Generate self-signed code signing certificate
        shell: pwsh
        env:
          WINDOWS_CERT_PASSWORD: ${{ secrets.WINDOWS_CERT_PASSWORD }}
        run: |
          $password = ConvertTo-SecureString -String $env:WINDOWS_CERT_PASSWORD -Force -AsPlainText
          $cert = New-SelfSignedCertificate -Type CodeSigningCert -Subject 'CN=MT' `
            -CertStoreLocation Cert:\CurrentUser\My -NotAfter (Get-Date).AddYears(5)
          Export-PfxCertificate -Cert $cert -FilePath "${{ runner.temp }}\mt-cert.pfx" -Password $password
          echo "CERT_PATH=${{ runner.temp }}\mt-cert.pfx" >> $env:GITHUB_ENV

      - name: Build frontend
        shell: pwsh
        working-directory: ./app/frontend
        run: |
          npm run build

      - name: Write signing config override
        shell: pwsh
        env:
          WINDOWS_CERT_PASSWORD: ${{ secrets.WINDOWS_CERT_PASSWORD }}
        run: |
          # Write a .cmd wrapper so signtool path with spaces is properly quoted
          # (.cmd files require cmd.exe to interpret — they can't be launched via CreateProcess)
          $signScript = Join-Path "${{ runner.temp }}" 'sign.cmd'
          @"
          @echo off
          "$env:SIGNTOOL_PATH" sign /f "$env:CERT_PATH" /p "$env:WINDOWS_CERT_PASSWORD" /t http://timestamp.digicert.com /fd SHA256 %1
          "@ | Out-File -FilePath $signScript -Encoding ascii
          $config = @{
            build = @{ beforeBuildCommand = "" }
            bundle = @{ windows = @{ signCommand = @{ cmd = "cmd"; args = @("/C", $signScript, "%1") } } }
          } | ConvertTo-Json -Depth 5
          $configPath = "${{ runner.temp }}\sign-override.json"
          $config | Out-File -FilePath $configPath -Encoding utf8
          echo "SIGN_CONFIG_PATH=$configPath" >> $env:GITHUB_ENV

      - name: Build NSIS installer
        uses: tauri-apps/tauri-action@v0
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          LASTFM_API_KEY: ${{ secrets.LASTFM_API_KEY }}
          LASTFM_API_SECRET: ${{ secrets.LASTFM_API_SECRET }}
        with:
          tagName: ${{ github.event.release.tag_name }}
          releaseId: ${{ github.event.release.id }}
          args: --target x86_64-pc-windows-msvc --bundles nsis --config "${{ env.SIGN_CONFIG_PATH }}"
          projectPath: './crates/mt-tauri'

      - name: Cleanup certificate
        if: always()
        shell: pwsh
        run: |
          Remove-Item -Force "${{ runner.temp }}\mt-cert.pfx" -ErrorAction SilentlyContinue
          Remove-Item -Force "${{ runner.temp }}\sign-override.json" -ErrorAction SilentlyContinue
          Get-ChildItem Cert:\CurrentUser\My -CodeSigningCert | Where-Object { $_.Subject -eq 'CN=MT' } | Remove-Item