release.yml

name: Build/Release

on:
  push:
    tags:
      - 'v*'

env:
  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true

permissions:
  contents: write

jobs:
  release:
    runs-on: ${{ matrix.os }}

    strategy:
      matrix:
        os: [macos-latest, ubuntu-latest, windows-latest]

    steps:
      - name: Check out Git repository
        uses: actions/checkout@v4

      - name: Verify tag matches package.json version
        shell: bash
        run: |
          TAG_VERSION="${GITHUB_REF_NAME#v}"
          PKG_VERSION=$(node -p "require('./package.json').version")
          echo "Tag version:         $TAG_VERSION"
          echo "package.json version: $PKG_VERSION"
          if [ "$TAG_VERSION" != "$PKG_VERSION" ]; then
            echo "::error::Tag $GITHUB_REF_NAME does not match package.json version $PKG_VERSION. Refusing to build."
            exit 1
          fi

      - name: Install Node.js, NPM and Yarn
        uses: actions/setup-node@v4
        with:
          node-version: 20
          cache: 'npm'

      - name: Install dependencies
        run: npm ci

      - name: Bundle agent server
        run: npm run bundle:agent

      - name: Build and Release
        uses: samuelmeuli/action-electron-builder@v1
        env:
          # Apple Notarization
          APPLE_ID: ${{ secrets.APPLE_ID }}
          APPLE_APP_SPECIFIC_PASSWORD: ${{ secrets.APPLE_APP_SPECIFIC_PASSWORD }}
          APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
          # Code Signing
          CSC_LINK: ${{ secrets.CSC_LINK }}
          CSC_KEY_PASSWORD: ${{ secrets.CSC_KEY_PASSWORD }}
          # GitHub Device Flow client IDs — public values inlined into the
          # Electron renderer at build time so the desktop app can do
          # GitHub OAuth without contacting redstring.io. The desktop App
          # slug is constant so it's literal here; falls back to the
          # default in src/services/githubDeviceFlow.js if unset.
          VITE_GITHUB_CLIENT_ID: ${{ secrets.VITE_GITHUB_CLIENT_ID }}
          VITE_GITHUB_APP_CLIENT_ID: ${{ secrets.VITE_GITHUB_APP_CLIENT_ID }}
          VITE_GITHUB_APP_SLUG: ${{ secrets.VITE_GITHUB_APP_SLUG }}
        with:
          # GitHub token, automatically provided to the action
          github_token: ${{ secrets.GITHUB_TOKEN }}
          release: true