release.yml

name: Release

on:
  workflow_dispatch:
  push:
    tags:
      - 'v*'

permissions:
  contents: write

concurrency:
  group: release-${{ github.ref_name }}
  cancel-in-progress: false

jobs:
  prepare-release:
    runs-on: ubuntu-latest
    outputs:
      tag: ${{ steps.release.outputs.tag }}
      version: ${{ steps.release.outputs.version }}
    steps:
      - name: Checkout repository
        uses: actions/checkout@v7

      - name: Prepare one draft release for all platform builds
        id: release
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          set -euo pipefail
          version="$(node -p "require('./package.json').version")"
          if [[ "$GITHUB_REF" == refs/tags/* ]]; then
            tag="$GITHUB_REF_NAME"
          else
            tag="v$version"
          fi

          if [[ "$tag" != "v$version" ]]; then
            echo "Tag $tag does not match package version v$version." >&2
            exit 1
          fi

          if gh release view "$tag" --repo "$GITHUB_REPOSITORY" >/dev/null 2>&1; then
            is_draft="$(
              gh release view "$tag" \
                --repo "$GITHUB_REPOSITORY" \
                --json isDraft \
                --jq '.isDraft'
            )"
            if [[ "$is_draft" != "true" ]]; then
              echo "Release $tag is already published." >&2
              exit 1
            fi
            echo "Reusing existing draft release $tag."
          else
            gh release create "$tag" \
              --repo "$GITHUB_REPOSITORY" \
              --verify-tag \
              --draft \
              --generate-notes \
              --title "Textonom $version"
          fi

          echo "tag=$tag" >> "$GITHUB_OUTPUT"
          echo "version=$version" >> "$GITHUB_OUTPUT"

  build-and-publish-linux:
    needs: prepare-release
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repository
        uses: actions/checkout@v7

      - name: Installing Node
        uses: actions/setup-node@v6
        with:
          node-version: 24

      - name: Build and publish
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          sudo apt-get update && sudo apt-get install -y rpm
          sudo snap install snapcraft --classic
          npm install
          npm run publish:linux

  build-and-publish-mac:
    needs: prepare-release
    runs-on: macos-latest
    steps:
      - name: Checkout repository
        uses: actions/checkout@v7

      - name: Installing Node
        uses: actions/setup-node@v6
        with:
          node-version: 24

      - name: Build and publish
        env:
          GH_TOKEN: ${{ github.token }}
          CSC_LINK: ${{ secrets.MAC_CSC_LINK }}
          CSC_KEY_PASSWORD: ${{ secrets.MAC_CSC_KEY_PASSWORD }}
          APPLE_ID: ${{ secrets.APPLE_ID }}
          APPLE_APP_SPECIFIC_PASSWORD: ${{ secrets.APPLE_APP_SPECIFIC_PASSWORD }}
          APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
        run: |
          # GitHub exposes missing secrets as empty strings. electron-builder treats
          # an empty CSC_LINK as the current directory, so remove signing variables
          # entirely until a certificate is configured.
          if [[ -z "${CSC_LINK:-}" ]]; then
            unset CSC_LINK CSC_KEY_PASSWORD
          fi
          npm install
          npm run publish:mac

  build-and-publish-win:
    needs: prepare-release
    runs-on: windows-latest
    steps:
      - name: Checkout repository
        uses: actions/checkout@v7

      - name: Installing Node
        uses: actions/setup-node@v6
        with:
          node-version: 24

      - name: Build and publish
        env:
          GH_TOKEN: ${{ github.token }}
          WIN_CSC_LINK: ${{ secrets.WIN_CSC_LINK }}
          WIN_CSC_KEY_PASSWORD: ${{ secrets.WIN_CSC_KEY_PASSWORD }}
        shell: pwsh
        run: |
          # Keep unsigned releases working until the optional certificate exists.
          if ([string]::IsNullOrWhiteSpace($env:WIN_CSC_LINK)) {
            Remove-Item Env:WIN_CSC_LINK -ErrorAction SilentlyContinue
            Remove-Item Env:WIN_CSC_KEY_PASSWORD -ErrorAction SilentlyContinue
          }
          npm install
          npm run publish:win

  hashes:
    needs:
      - prepare-release
      - build-and-publish-linux
      - build-and-publish-mac
      - build-and-publish-win
    runs-on: ubuntu-latest
    steps:
      - name: Download release assets, generate sha256 hashes, upload to release
        env:
          GH_TOKEN: ${{ github.token }}
          TAG: ${{ needs.prepare-release.outputs.tag }}
        run: |
          set -euo pipefail
          mkdir assets
          cd assets
          gh release download "$TAG" \
            --repo "$GITHUB_REPOSITORY" \
            --pattern '*' \
            --skip-existing
          # Exclude any existing hashes file so re-runs don't hash themselves.
          find . -maxdepth 1 -type f ! -name 'hashes.txt' -print0 \
            | sort -z \
            | xargs -0 sha256sum > ../hashes.txt
          cd ..
          sed -i 's| \./| |g' hashes.txt
          cat hashes.txt
          gh release upload "$TAG" hashes.txt \
            --repo "$GITHUB_REPOSITORY" \
            --clobber

  publish-release:
    needs:
      - prepare-release
      - hashes
    runs-on: ubuntu-latest
    steps:
      - name: Publish completed release
        env:
          GH_TOKEN: ${{ github.token }}
          TAG: ${{ needs.prepare-release.outputs.tag }}
        run: |
          set -euo pipefail
          gh release edit "$TAG" \
            --repo "$GITHUB_REPOSITORY" \
            --draft=false