desktop-release.yml

name: Desktop Release

on:
  push:
    tags:
      - 'v*'
  workflow_dispatch:
    inputs:
      version:
        description: 'Version to release (e.g., 0.1.0)'
        required: true

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  build:
    strategy:
      fail-fast: false
      matrix:
        include:
          - os: macos-latest
            platform: mac
            arch: arm64
          - os: macos-latest
            platform: mac
            arch: x64
          - os: windows-latest
            platform: win
            arch: x64
          - os: ubuntu-latest
            platform: linux
            arch: x64

    runs-on: ${{ matrix.os }}
    name: Build ${{ matrix.platform }}-${{ matrix.arch }}

    steps:
      - name: Checkout
        uses: actions/checkout@v7

      - name: Setup pnpm
        uses: pnpm/action-setup@v6

      - name: Setup Node.js
        uses: actions/setup-node@v7
        with:
          node-version: 22
          cache: 'pnpm'

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      # macOS code signing
      - name: Import macOS certificates
        if: matrix.platform == 'mac'
        env:
          APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }}
          APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
          KEYCHAIN_PASSWORD: ${{ secrets.KEYCHAIN_PASSWORD }}
        run: |
          if [ -n "$APPLE_CERTIFICATE" ]; then
            echo $APPLE_CERTIFICATE | base64 --decode > certificate.p12
            security create-keychain -p "$KEYCHAIN_PASSWORD" build.keychain
            security default-keychain -s build.keychain
            security unlock-keychain -p "$KEYCHAIN_PASSWORD" build.keychain
            security import certificate.p12 -k build.keychain -P "$APPLE_CERTIFICATE_PASSWORD" -T /usr/bin/codesign
            security set-key-partition-list -S apple-tool:,apple:,codesign: -s -k "$KEYCHAIN_PASSWORD" build.keychain
            rm certificate.p12
          fi

      # Windows code signing
      - name: Setup Windows signing
        if: matrix.platform == 'win'
        env:
          WINDOWS_CERTIFICATE: ${{ secrets.WINDOWS_CERTIFICATE }}
        run: |
          if ($env:WINDOWS_CERTIFICATE) {
            [IO.File]::WriteAllBytes("certificate.pfx", [Convert]::FromBase64String($env:WINDOWS_CERTIFICATE))
          }
        shell: pwsh

      # Linux dependencies for electron-builder
      - name: Install Linux dependencies
        if: matrix.platform == 'linux'
        run: |
          sudo apt-get update
          sudo apt-get install -y libarchive-tools rpm

      - name: Build desktop app
        run: pnpm --filter @profullstack/threatcrush-desktop build

      - name: Package desktop app
        working-directory: apps/desktop
        run: npx electron-builder --${{ matrix.platform }} --${{ matrix.arch }} --publish never

      - name: Upload artifacts
        uses: actions/upload-artifact@v7
        with:
          name: desktop-${{ matrix.platform }}-${{ matrix.arch }}
          path: |
            apps/desktop/release/*.dmg
            apps/desktop/release/*.zip
            apps/desktop/release/*.exe
            apps/desktop/release/*.AppImage
            apps/desktop/release/*.deb
            apps/desktop/release/*.rpm
          retention-days: 7

  release:
    needs: build
    runs-on: ubuntu-latest
    permissions:
      contents: write

    steps:
      - name: Checkout
        uses: actions/checkout@v7

      - name: Get version
        id: version
        env:
          INPUT_VERSION: ${{ github.event.inputs.version }}
          REF_NAME: ${{ github.ref_name }}
        run: |
          if [ -n "$INPUT_VERSION" ]; then
            VERSION="$INPUT_VERSION"
          else
            VERSION="$REF_NAME"
          fi
          VERSION="${VERSION#v}"
          echo "version=$VERSION" >> "$GITHUB_OUTPUT"
          echo "tag=v$VERSION" >> "$GITHUB_OUTPUT"

          if [[ "$VERSION" == *"-alpha"* ]] || [[ "$VERSION" == *"-beta"* ]] || [[ "$VERSION" == *"-rc"* ]]; then
            echo "prerelease=true" >> "$GITHUB_OUTPUT"
          else
            echo "prerelease=false" >> "$GITHUB_OUTPUT"
          fi

      - name: Download all artifacts
        uses: actions/download-artifact@v8
        with:
          path: dist
          pattern: desktop-*
          merge-multiple: true

      - name: List artifacts
        run: ls -la dist/

      - name: Generate checksums
        run: |
          cd dist
          sha256sum * > SHA256SUMS.txt
          cat SHA256SUMS.txt

      - name: Create Release
        uses: softprops/action-gh-release@v3
        with:
          tag_name: ${{ steps.version.outputs.tag }}
          name: ThreatCrush ${{ steps.version.outputs.version }}
          draft: false
          prerelease: ${{ steps.version.outputs.prerelease }}
          generate_release_notes: true
          files: |
            dist/*
        env:
          GITHUB_TOKEN: ${{ secrets.PKG_SUBMIT_TOKEN || secrets.GITHUB_TOKEN }}