release.yml

name: 'Build and Release'

on:
  workflow_dispatch:
    inputs:
      version:
        description: 'Version to release (e.g., v1.0.0).'
        required: true
        type: string

permissions: write-all
env:
  CARGO_INCREMENTAL: 0
  RUST_BACKTRACE: short
  TAURI_PRIVATE_KEY: ${{ secrets.TAURI_PRIVATE_KEY }}
  TAURI_KEY_PASSWORD: ${{ secrets.TAURI_KEY_PASSWORD }}
  # macOS signing and notarization
  APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }}
  APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
  APPLE_ID: ${{ secrets.APPLE_ID }}
  APPLE_SIGNING_IDENTITY: ${{ secrets.APPLE_SIGNING_IDENTITY }}
  APPLE_PASSWORD: ${{ secrets.APPLE_PASSWORD }}
  APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
  # Windows self pfx
  WINDOWS_PFX: ${{ secrets.WINDOWS_PFX }}
  WINDOWS_PFX_PASSWORD: ${{ secrets.WINDOWS_PFX_PASSWORD }}

concurrency:
  group: "${{ github.workflow }} - ${{ github.head_ref || github.ref }}"
  cancel-in-progress: ${{ github.ref != 'refs/heads/main' }}

jobs:

  check_tag_version:
    name: Check Tag and All Version Files Consistency
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repository
        uses: actions/checkout@v6

      - name: Install jq for JSON parsing
        run: sudo apt-get update && sudo apt-get install -y jq

      - name: Validate tag matches versions in package.json, Cargo.toml, tauri.conf.json
        run: |
          # Get the tag to validate
          TAG_REF="${{ inputs.version }}"
          
          TAG_VERSION="${TAG_REF#v}"

          echo "Tag to validate: $TAG_REF"

          # Get version from package.json
          PKG_VERSION=$(jq -r .version package.json)
          echo "package.json version: $PKG_VERSION"

          # Get version from tauri.conf.json
          TAURI_VERSION=$(jq -r .version src-tauri/tauri.conf.json)
          echo "tauri.conf.json version: $TAURI_VERSION"

          # Get version from Cargo.toml using grep/sed
          CARGO_VERSION=$(grep '^version' src-tauri/Cargo.toml | head -n1 | sed 's/version = "\(.*\)"/\1/')
          echo "Cargo.toml version: $CARGO_VERSION"

          # Check all match
          if [[ "$TAG_VERSION" != "$PKG_VERSION" ]]; then
            echo "❌ Tag version ($TAG_VERSION) does not match package.json version ($PKG_VERSION)."
            exit 1
          fi

          if [[ "$TAG_VERSION" != "$TAURI_VERSION" ]]; then
            echo "❌ Tag version ($TAG_VERSION) does not match tauri.conf.json version ($TAURI_VERSION)."
            exit 1
          fi

          if [[ "$TAG_VERSION" != "$CARGO_VERSION" ]]; then
            echo "❌ Tag version ($TAG_VERSION) does not match Cargo.toml version ($CARGO_VERSION)."
            exit 1
          fi

          echo "✅ Tag version matches all version files."

  build:
    name: Build and Sign for All Platforms
    needs: [check_tag_version]
    strategy:
      fail-fast: false
      matrix:
        include:
          - os: windows-latest
            target: x86_64-pc-windows-msvc
            platform: windows
            arch: x64
          - os: windows-latest
            target: aarch64-pc-windows-msvc
            platform: windows
            arch: arm64
          - os: macos-latest
            target: aarch64-apple-darwin
            platform: macos
            arch: arm64
          - os: macos-15-intel
            target: x86_64-apple-darwin
            platform: macos
            arch: x64
          - os: ubuntu-22.04
            target: x86_64-unknown-linux-gnu
            platform: linux
            arch: x64

    runs-on: ${{ matrix.os }}
    steps:
      - name: Checkout repository
        uses: actions/checkout@v6
      
      - name: Install Rust
        uses: dtolnay/rust-toolchain@nightly

      - name: Add Rust Target
        run: rustup target add ${{ matrix.target }}
      
      - name: Rust Cache
        uses: Swatinem/rust-cache@v2
        with:
          workspaces: src-tauri
          save-if: false

      - name: Install dependencies (ubuntu only)
        if: matrix.os == 'ubuntu-22.04'
        run: |
          sudo apt-get update
          sudo apt-get install -y libxslt1.1 libwebkit2gtk-4.1-dev libayatana-appindicator3-dev librsvg2-dev patchelf
        
      - name: Install Node
        uses: actions/setup-node@v6
        with:
          node-version: "22"
      
      - name: Run install
        uses: borales/actions-yarn@v5
        with:
          cmd: install

      - name:  install and check
        run: |
          yarn install
          yarn run prebuild:dev --target=${{ matrix.target }}

      - name: Import Apple Developer Certificate (macOS only)
        if: matrix.platform == 'macos' && env.APPLE_CERTIFICATE != ''
        uses: apple-actions/import-codesign-certs@v5
        with:
          p12-file-base64: ${{ secrets.APPLE_CERTIFICATE }}
          p12-password: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}

      - name: Decode and Setup PFX Certificate (Windows)
        if: matrix.platform == 'windows' && env.WINDOWS_PFX != ''
        shell: pwsh
        run: |
           $certDir = "certificate"
           New-Item -ItemType Directory -Force -Path $certDir | Out-Null
           $pfxPath = Join-Path $certDir "certificate.pfx"
           $certBytes = [Convert]::FromBase64String("${{ secrets.WINDOWS_PFX }}")
           [IO.File]::WriteAllBytes($pfxPath, $certBytes)
           $password = ConvertTo-SecureString "${{ secrets.WINDOWS_PFX_PASSWORD }}" -AsPlainText -Force
           Import-PfxCertificate -FilePath $pfxPath -CertStoreLocation Cert:\CurrentUser\My -Password $password | Out-Null

      - name: Build the app
        uses: tauri-apps/tauri-action@v0
        env:
          NODE_OPTIONS: "--max_old_space_size=4096"
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_PRIVATE_KEY }}
          TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_KEY_PASSWORD }}
          # macOS signing and notarization environment variables
          APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }}
          APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
          APPLE_ID: ${{ secrets.APPLE_ID }}
          APPLE_PASSWORD: ${{ secrets.APPLE_PASSWORD }}
          APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
          # Enable signing and notarization for macOS
          APPLE_SIGNING_IDENTITY: ${{ secrets.APPLE_SIGNING_IDENTITY }}
        with:
          args: --target ${{ matrix.target }}
      
      - name: Rename And upload Updater(MacOS)
        if: matrix.target == 'x86_64-apple-darwin' || matrix.target == 'aarch64-apple-darwin'
        shell: bash
        run: |
          TAG=${{ inputs.version }}
          VERSION=${TAG#v}
          SOURCE_DIR="src-tauri/target/${{ matrix.target }}/release/bundle/macos"
          TARGET_NAME="OpenList-Desktop-${VERSION}-${{ matrix.arch }}.app.tar.gz"
          if [ -f "$SOURCE_DIR/OpenList-Desktop.app.tar.gz" ]; then
            mv "$SOURCE_DIR/OpenList-Desktop.app.tar.gz" "$SOURCE_DIR/$TARGET_NAME"
            mv "$SOURCE_DIR/OpenList-Desktop.app.tar.gz.sig" "$SOURCE_DIR/$TARGET_NAME.sig"
          fi
      
    
      - name: Upload artifacts
        uses: actions/upload-artifact@v6
        with:
          name: ${{ matrix.platform }}-${{ matrix.arch }}-build
          path: |
            src-tauri/target/${{ matrix.target }}/release/bundle/**/*.sig
            src-tauri/target/${{ matrix.target }}/release/bundle/**/*.exe
            src-tauri/target/${{ matrix.target }}/release/bundle/**/*.dmg
            src-tauri/target/${{ matrix.target }}/release/bundle/**/*.deb
            src-tauri/target/${{ matrix.target }}/release/bundle/**/*.rpm
            src-tauri/target/${{ matrix.target }}/release/bundle/macos/*.tar.gz
          retention-days: 30
  
  release-for-linux-arm:
    name: Release Build for Linux ARM
    needs: [check_tag_version]

    strategy:
      fail-fast: false
      matrix:
        include:
          - os: ubuntu-22.04
            target: aarch64-unknown-linux-gnu
            arch: arm64
          - os: ubuntu-22.04
            target: armv7-unknown-linux-gnueabihf
            arch: armhf
    runs-on: ${{ matrix.os }}
    steps:
      - name: Checkout Repository
        uses: actions/checkout@v6

      - name: Install Rust
        uses: dtolnay/rust-toolchain@nightly

      - name: Add Rust Target
        run: rustup target add ${{ matrix.target }}

      - name: Rust Cache
        uses: Swatinem/rust-cache@v2
        with:
          workspaces: src-tauri
          save-if: false

      - name: Install Node
        uses: actions/setup-node@v6
        with:
          node-version: "22"

      - name: Run install
        uses: borales/actions-yarn@v5
        with:
          cmd: install

      - name:  install and check
        run: |
          yarn install
          yarn run prebuild:dev --target=${{ matrix.target }}

      - name: "Setup for linux"
        run: |-
          sudo ls -lR /etc/apt/

          cat > /tmp/sources.list << EOF
          deb [arch=amd64,i386] http://archive.ubuntu.com/ubuntu jammy main multiverse universe restricted
          deb [arch=amd64,i386] http://archive.ubuntu.com/ubuntu jammy-security main multiverse universe restricted
          deb [arch=amd64,i386] http://archive.ubuntu.com/ubuntu jammy-updates main multiverse universe restricted
          deb [arch=amd64,i386] http://archive.ubuntu.com/ubuntu jammy-backports main multiverse universe restricted

          deb [arch=armhf,arm64] http://ports.ubuntu.com/ubuntu-ports jammy main multiverse universe restricted
          deb [arch=armhf,arm64] http://ports.ubuntu.com/ubuntu-ports jammy-security main multiverse universe restricted
          deb [arch=armhf,arm64] http://ports.ubuntu.com/ubuntu-ports jammy-updates main multiverse universe restricted
          deb [arch=armhf,arm64] http://ports.ubuntu.com/ubuntu-ports jammy-backports main multiverse universe restricted
          EOF

          sudo mv /etc/apt/sources.list /etc/apt/sources.list.default
          sudo mv /tmp/sources.list /etc/apt/sources.list

          sudo dpkg --add-architecture ${{ matrix.arch }}
          sudo apt update

          sudo apt install -y \
            libxslt1.1:${{ matrix.arch }} \
            libwebkit2gtk-4.1-dev:${{ matrix.arch }} \
            libayatana-appindicator3-dev:${{ matrix.arch }} \
            libssl-dev:${{ matrix.arch }} \
            patchelf:${{ matrix.arch }} \
            librsvg2-dev:${{ matrix.arch }}

      - name: "Install aarch64 tools"
        if: matrix.target == 'aarch64-unknown-linux-gnu'
        run: |
          sudo apt install -y \
            gcc-aarch64-linux-gnu \
            g++-aarch64-linux-gnu

      - name: "Install armv7 tools"
        if: matrix.target == 'armv7-unknown-linux-gnueabihf'
        run: |
          sudo apt install -y \
            gcc-arm-linux-gnueabihf \
            g++-arm-linux-gnueabihf

      - name: Build for Linux
        run: |
          export PKG_CONFIG_ALLOW_CROSS=1
          if [ "${{ matrix.target }}" == "aarch64-unknown-linux-gnu" ]; then
            export PKG_CONFIG_PATH=/usr/lib/aarch64-linux-gnu/pkgconfig/:$PKG_CONFIG_PATH
            export PKG_CONFIG_SYSROOT_DIR=/usr/aarch64-linux-gnu/
          elif [ "${{ matrix.target }}" == "armv7-unknown-linux-gnueabihf" ]; then
            export PKG_CONFIG_PATH=/usr/lib/arm-linux-gnueabihf/pkgconfig/:$PKG_CONFIG_PATH
            export PKG_CONFIG_SYSROOT_DIR=/usr/arm-linux-gnueabihf/
          fi
          yarn build --target ${{ matrix.target }}
        env:
          NODE_OPTIONS: "--max_old_space_size=4096"
          TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_PRIVATE_KEY }}
          TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_KEY_PASSWORD }}

      - name: Get Version
        run: |
          sudo apt-get update
          sudo apt-get install jq
          echo "VERSION=$(cat package.json | jq '.version' | tr -d '"')" >> $GITHUB_ENV
          echo "BUILDTIME=$(TZ=Asia/Shanghai date)" >> $GITHUB_ENV

      - name: Upload ARM artifacts
        uses: actions/upload-artifact@v6
        with:
          name: linux-${{ matrix.target }}-build
          path: |
            src-tauri/target/${{ matrix.target }}/release/bundle/deb/*.deb
            src-tauri/target/${{ matrix.target }}/release/bundle/rpm/*.rpm
            src-tauri/target/${{ matrix.target }}/release/bundle/**/*.sig
          retention-days: 30

  publish:
    name: Publish Release
    needs: [ build, release-for-linux-arm]
    runs-on: ubuntu-latest
    if: always() && needs.build.result == 'success' && needs.release-for-linux-arm.result == 'success'
    steps:
      - name: Checkout
        uses: actions/checkout@v6

      - name: Download all build artifacts
        uses: actions/download-artifact@v7
        with:
          pattern: '*-build'
          merge-multiple: true
          path: artifacts

      - name: Read release notes
        id: read_notes
        run: |
          # 使用 EOF 方式处理多行字符串，避免换行符导致崩溃
          echo "BODY<<EOF" >> $GITHUB_OUTPUT
          cat release_notes.md >> $GITHUB_OUTPUT
          echo "EOF" >> $GITHUB_OUTPUT


      - name: Update release with all artifacts
        uses: softprops/action-gh-release@v2
        with:
          tag_name: ${{ inputs.version }}
          name: 'OpenList Desktop ${{ inputs.version }}'
          body: ${{ steps.read_notes.outputs.BODY }}
          draft: true
          prerelease: false
          files: |
            artifacts/**/*.exe
            artifacts/**/*.dmg
            artifacts/**/*.tar.gz
            artifacts/**/*.deb
            artifacts/**/*.rpm
            artifacts/**/*.sig
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

  generate-latest-json:
    name: Generate latest.json for Auto-Update
    needs: [build, release-for-linux-arm, publish]
    runs-on: ubuntu-latest
    if: always() && needs.build.result == 'success' && needs.publish.result == 'success'
    steps:
      - name: Checkout
        uses: actions/checkout@v6

      - name: Download all build artifacts
        uses: actions/download-artifact@v7
        with:
          pattern: '*-build'
          merge-multiple: true
          path: artifacts
        continue-on-error: true

      - name: Generate latest.json
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          TAG="${{ inputs.version }}"
          VERSION="${TAG#v}"
          REPO="${{ github.repository }}"
          BASE_URL="https://github.com/${REPO}/releases/download/${TAG}"
          PUB_DATE=$(date -u +"%Y-%m-%dT%H:%M:%SZ")
          
          # Read release notes from release_notes.md (priority) or changelog.md
          NOTES=""
          if [ -f "release_notes.md" ]; then
            NOTES=$(cat release_notes.md | jq -Rs .)
          else
            NOTES="\"Release ${TAG}\""
          fi
          
          # Function to read signature from local .sig file
          get_signature() {
            local sig_file="$1"
            if [ -f "$sig_file" ]; then
              cat "$sig_file"
            else
              echo ""
            fi
          }
          
          # Build platforms object
          # Windows x64
          WIN_X64_URL="${BASE_URL}/OpenList-Desktop_${VERSION}_x64-setup.exe"
          WIN_X64_SIG=$(get_signature "artifacts/nsis/OpenList-Desktop_${VERSION}_x64-setup.exe.sig")
          
          # Windows arm64
          WIN_ARM64_URL="${BASE_URL}/OpenList-Desktop_${VERSION}_arm64-setup.exe"
          WIN_ARM64_SIG=$(get_signature "artifacts/nsis/OpenList-Desktop_${VERSION}_arm64-setup.exe.sig")
          
          # macOS arm64 (Apple Silicon)
          MAC_ARM64_URL="${BASE_URL}/OpenList-Desktop_${VERSION}-arm64.app.tar.gz"
          MAC_ARM64_SIG=$(get_signature "artifacts/macos/OpenList-Desktop-${VERSION}-arm64.app.tar.gz.sig")
          
          # macOS x64 (Intel)
          MAC_X64_URL="${BASE_URL}/OpenList-Desktop_${VERSION}_x64.app.tar.gz"
          MAC_X64_SIG=$(get_signature "artifacts/macos/OpenList-Desktop-${VERSION}-x64.app.tar.gz.sig")
          
          # Linux x64
          LINUX_X64_DEB_URL="${BASE_URL}/OpenList-Desktop_${VERSION}_amd64.deb"
          LINUX_X64_DEB_SIG=$(get_signature "artifacts/deb/OpenList-Desktop_${VERSION}_amd64.deb.sig")
          
          # Linux arm64
          LINUX_ARM64_DEB_URL="${BASE_URL}/OpenList-Desktop_${VERSION}_arm64.deb"
          LINUX_ARM64_DEB_SIG=$(get_signature "artifacts/deb/OpenList-Desktop_${VERSION}_arm64.deb.sig")

          # Linux armhf
          LINUX_ARMHF_DEB_URL="${BASE_URL}/OpenList-Desktop_${VERSION}_armhf.deb"
          LINUX_ARMHF_DEB_SIG=$(get_signature "artifacts/deb/OpenList-Desktop_${VERSION}_armhf.deb.sig")
          
          # Create latest.json
          cat > latest.json << EOF
          {
            "version": "${VERSION}",
            "notes": ${NOTES},
            "pub_date": "${PUB_DATE}",
            "platforms": {
              "windows-x86_64": {
                "url": "${WIN_X64_URL}",
                "signature": "${WIN_X64_SIG}"
              },
              "windows-aarch64": {
                "url": "${WIN_ARM64_URL}",
                "signature": "${WIN_ARM64_SIG}"
              },
              "darwin-x86_64": {
                "url": "${MAC_X64_URL}",
                "signature": "${MAC_X64_SIG}"
              },
              "darwin-aarch64": {
                "url": "${MAC_ARM64_URL}",
                "signature": "${MAC_ARM64_SIG}"
              },
              "linux-x86_64": {
                "url": "${LINUX_X64_DEB_URL}",
                "signature": "${LINUX_X64_DEB_SIG}"
              },
              "linux-aarch64": {
                "url": "${LINUX_ARM64_DEB_URL}",
                "signature": "${LINUX_ARM64_DEB_SIG}"
              },
              "linux-armv7": {
                "url": "${LINUX_ARMHF_DEB_URL}",
                "signature": "${LINUX_ARMHF_DEB_SIG}"
              }
            }
          }
          EOF
          
          echo "Generated latest.json:"
          cat latest.json

      - name: Upload latest.json to release
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          TAG="${{ inputs.version }}"
          
          # Upload latest.json to the release
          gh release upload "$TAG" latest.json --clobber
          
          echo "✅ latest.json uploaded to release $TAG"