release.yml

name: Release

on:
  push:
    tags:
      - 'v*'
  workflow_dispatch:
    inputs:
      version:
        description: 'Version to release (e.g., v1.0.0)'
        required: true
        type: string

permissions:
  contents: write

jobs:
  prepare:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@v5
        with:
          fetch-depth: 0

      - name: Set up Go
        uses: actions/setup-go@v6
        with:
          go-version-file: 'go.mod'

      - name: Set up Node.js
        uses: actions/setup-node@v5
        with:
          node-version: '22'

      - name: Install pnpm
        run: npm install -g pnpm

      - name: Generate code
        run: make generate

      - name: Build frontend
        run: make build-web

      - name: Upload prepared artifacts
        uses: actions/upload-artifact@v5
        with:
          name: prepared
          path: |
            internal/model/registry_generated.go
            internal/web/dist/

  build:
    needs: prepare
    runs-on: ${{ matrix.runner }}
    strategy:
      matrix:
        include:
          # Linux AMD64
          - goos: linux
            goarch: amd64
            suffix: ''
            runner: ubuntu-latest
            cgo: 0
          # Linux ARM64
          - goos: linux
            goarch: arm64
            suffix: ''
            runner: ubuntu-latest
            cgo: 0
          # macOS AMD64
          - goos: darwin
            goarch: amd64
            suffix: ''
            runner: macos-15-intel
            cgo: 1
          # macOS ARM64 (Apple Silicon)
          - goos: darwin
            goarch: arm64
            suffix: ''
            runner: macos-latest
            cgo: 1
          # Windows AMD64
          - goos: windows
            goarch: amd64
            suffix: '.exe'
            runner: ubuntu-latest
            cgo: 0
          # Windows ARM64
          - goos: windows
            goarch: arm64
            suffix: '.exe'
            runner: ubuntu-latest
            cgo: 0

    steps:
      - name: Checkout code
        uses: actions/checkout@v5
        with:
          fetch-depth: 0

      - name: Set up Go
        uses: actions/setup-go@v6
        with:
          go-version-file: 'go.mod'

      - name: Download prepared artifacts
        uses: actions/download-artifact@v5
        with:
          name: prepared
          path: internal/

      - name: Get version
        id: get_version
        run: |
          if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
            VERSION="${{ github.event.inputs.version }}"
          else
            VERSION="${GITHUB_REF#refs/tags/}"
          fi
          echo "version=$VERSION" >> "$GITHUB_OUTPUT"

      - name: Build binary
        env:
          GOOS: ${{ matrix.goos }}
          GOARCH: ${{ matrix.goarch }}
          CGO_ENABLED: ${{ matrix.cgo }}
        run: |
          OUTPUT_NAME="jcode-${{ matrix.goos }}-${{ matrix.goarch }}${{ matrix.suffix }}"
          make build-binary \
            VERSION="${{ steps.get_version.outputs.version }}" \
            BIN="dist/${OUTPUT_NAME}"
          # Computer Use is implemented by native Swift helpers, so the macOS
          # CLI release must ship them beside jcode (not only inside Tauri).
          # The shared suffix lets the daemon resolve its capture sibling.
          if [ "${{ matrix.goos }}" = "darwin" ]; then
            case "${{ matrix.goarch }}" in
              arm64) SWIFT_TARGET="arm64-apple-macos14.0" ;;
              amd64) SWIFT_TARGET="x86_64-apple-macos14.0" ;;
              *) echo "unsupported Swift architecture: ${{ matrix.goarch }}" >&2; exit 1 ;;
            esac
            swiftc -O -target "$SWIFT_TARGET" \
              -o "dist/jcode-computerd-capture-${{ matrix.goos }}-${{ matrix.goarch }}" \
              ./cmd/jcode-computerd/WindowCaptureHelper.swift
            swiftc -O -target "$SWIFT_TARGET" \
              -o "dist/jcode-computerd-${{ matrix.goos }}-${{ matrix.goarch }}" \
              ./cmd/jcode-computerd/main.swift
            for helper in \
              "dist/jcode-computerd-capture-${{ matrix.goos }}-${{ matrix.goarch }}" \
              "dist/jcode-computerd-${{ matrix.goos }}-${{ matrix.goarch }}"; do
              MINOS="$(vtool -show-build "$helper" | awk '$1 == "minos" { print $2 }')"
              [ "$MINOS" = "14.0" ] || { echo "$helper has unexpected minos $MINOS" >&2; exit 1; }
            done
          fi

      - name: Calculate checksum
        run: |
          cd dist
          for file in jcode-*; do
            if command -v sha256sum &>/dev/null; then
              sha256sum "$file" > "$file.sha256"
            else
              shasum -a 256 "$file" > "$file.sha256"
            fi
          done

      - name: Upload artifacts
        uses: actions/upload-artifact@v5
        with:
          name: binaries-${{ matrix.goos }}-${{ matrix.goarch }}
          path: dist/jcode-*

  # Desktop (Tauri) app bundles. Each platform builds on a native runner because
  # Tauri produces OS-native installers (.dmg / .msi / .deb / AppImage). The Go
  # binary is compiled as the Tauri "sidecar" (binaries/jcode-<target-triple>) and
  # embedded into the bundle; at runtime it serves the same web UI on loopback.
  desktop:
    needs: prepare
    runs-on: ${{ matrix.os }}
    strategy:
      fail-fast: false
      matrix:
        include:
          # macOS Apple Silicon (M-series)
          - os: macos-latest
            triple: aarch64-apple-darwin
            ext: ''
            cgo: 1
            bundles: dmg
            label: macos-arm64
          # macOS Intel
          - os: macos-15-intel
            triple: x86_64-apple-darwin
            ext: ''
            cgo: 1
            bundles: dmg
            label: macos-x64
          # Windows x64
          - os: windows-latest
            triple: x86_64-pc-windows-msvc
            ext: '.exe'
            cgo: 0
            bundles: 'msi,nsis'
            label: windows-x64
          # Linux x64
          - os: ubuntu-22.04
            triple: x86_64-unknown-linux-gnu
            ext: ''
            cgo: 0
            bundles: 'deb,appimage'
            label: linux-x64

    steps:
      - name: Checkout code
        uses: actions/checkout@v5
        with:
          fetch-depth: 0

      - name: Set up Go
        uses: actions/setup-go@v6
        with:
          go-version-file: 'go.mod'

      - name: Set up Node.js
        uses: actions/setup-node@v5
        with:
          node-version: '22'

      - name: Install pnpm
        run: npm install -g pnpm

      - name: Set up Rust
        uses: dtolnay/rust-toolchain@stable
        with:
          targets: ${{ matrix.triple }}

      - name: Cache Rust
        uses: swatinem/rust-cache@v2
        with:
          workspaces: desktop/src-tauri

      - name: Install Linux dependencies
        if: matrix.os == 'ubuntu-22.04'
        run: |
          sudo apt-get update
          sudo apt-get install -y \
            libwebkit2gtk-4.1-dev \
            libgtk-3-dev \
            libayatana-appindicator3-dev \
            librsvg2-dev \
            libssl-dev \
            libxdo-dev \
            libfuse2 \
            patchelf \
            file

      - name: Download prepared artifacts
        uses: actions/download-artifact@v5
        with:
          name: prepared
          path: internal/

      - name: Get version
        id: get_version
        shell: bash
        run: |
          if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
            VERSION="${{ github.event.inputs.version }}"
          else
            VERSION="${GITHUB_REF#refs/tags/}"
          fi
          echo "version=$VERSION" >> "$GITHUB_OUTPUT"

      - name: Sync bundle version
        shell: bash
        run: |
          VER="${{ steps.get_version.outputs.version }}"
          VER="${VER#v}"
          node -e "const fs=require('fs');const f='desktop/src-tauri/tauri.conf.json';const j=JSON.parse(fs.readFileSync(f));j.version='${VER}';fs.writeFileSync(f, JSON.stringify(j,null,2)+'\n')"
          echo "Set desktop bundle version to ${VER}"

      - name: Build sidecar
        shell: bash
        env:
          CGO_ENABLED: ${{ matrix.cgo }}
        run: |
          VERSION="${{ steps.get_version.outputs.version }}"
          COMMIT="$(git rev-parse --short HEAD)"
          LDFLAGS="-s -w -X github.com/cnjack/jcode/internal/command.Version=${VERSION} -X github.com/cnjack/jcode/internal/command.GitCommit=${COMMIT}"
          mkdir -p desktop/src-tauri/binaries
          # Main sidecar. The `desktop` tag compiles in desktop-only features (the
          # BLE settings toggle); `jcode_headless` omits the embedded SPA. It still
          # never links CoreBluetooth — BLE runs in the helper below.
          go build -trimpath -tags "jcode_headless desktop" \
            -ldflags "${LDFLAGS}" \
            -o "desktop/src-tauri/binaries/jcode-${{ matrix.triple }}${{ matrix.ext }}" \
            ./cmd/jcode/
          # BLE helper (externalBin). Built with -tags ble; the matrix cgo flag is
          # 1 on macOS (CoreBluetooth needs cgo) and 0 elsewhere (Linux D-Bus /
          # Windows WinRT are pure Go). The main app spawns it only when BLE is
          # enabled in config, so the bundle never prompts for Bluetooth at launch.
          go build -trimpath -tags ble \
            -ldflags "${LDFLAGS}" \
            -o "desktop/src-tauri/binaries/jcode-ble-${{ matrix.triple }}${{ matrix.ext }}" \
            ./cmd/jcode-ble/
          # Native computer-use helpers are macOS-only. The long-lived daemon
          # owns Accessibility; ScreenCaptureKit runs in a separate short-lived
          # process so a compositor abort cannot break the daemon connection.
          if [ "${{ runner.os }}" = "macOS" ]; then
            case "${{ matrix.triple }}" in
              aarch64-apple-darwin) SWIFT_TARGET="arm64-apple-macos14.0" ;;
              x86_64-apple-darwin) SWIFT_TARGET="x86_64-apple-macos14.0" ;;
              *) echo "unsupported Swift target triple: ${{ matrix.triple }}" >&2; exit 1 ;;
            esac
            swiftc -O -target "$SWIFT_TARGET" \
              -o "desktop/src-tauri/binaries/jcode-computerd-capture-${{ matrix.triple }}" \
              ./cmd/jcode-computerd/WindowCaptureHelper.swift
            swiftc -O -target "$SWIFT_TARGET" \
              -o "desktop/src-tauri/binaries/jcode-computerd-${{ matrix.triple }}" \
              ./cmd/jcode-computerd/main.swift
            for helper in \
              "desktop/src-tauri/binaries/jcode-computerd-capture-${{ matrix.triple }}" \
              "desktop/src-tauri/binaries/jcode-computerd-${{ matrix.triple }}"; do
              MINOS="$(vtool -show-build "$helper" | awk '$1 == "minos" { print $2 }')"
              [ "$MINOS" = "14.0" ] || { echo "$helper has unexpected minos $MINOS" >&2; exit 1; }
            done
          fi

      # Assemble the jcode-computerd.app bundle (macOS resource declared in
      # tauri.macos.conf.json). The script compiles the Swift helpers + Rust
      # onboarding UI into a signed .app at desktop/src-tauri/bundles/.
      - name: Build computerd bundle
        if: runner.os == 'macOS'
        shell: bash
        run: |
          case "${{ matrix.triple }}" in
            aarch64-apple-darwin) SWIFT_TARGET="arm64-apple-macos14.0" ;;
            x86_64-apple-darwin) SWIFT_TARGET="x86_64-apple-macos14.0" ;;
          esac
          mkdir -p desktop/src-tauri/bundles
          script/build_computerd_bundle.sh "$SWIFT_TARGET" "desktop/src-tauri/bundles" "${{ matrix.triple }}"

      # macOS signing + notarization. Everything here is optional: with no secrets
      # the build still succeeds and produces an UNSIGNED bundle (Gatekeeper warns
      # on first launch). When the secrets are present, the Tauri CLI imports the
      # cert into a temp keychain, signs with Developer ID, then notarizes.
      #
      # We resolve the credentials into $GITHUB_ENV here (rather than as a static
      # env block on the build step) for two reasons: the notarization .p8 is a
      # FILE that must be written to disk from a base64 secret, and the two notary
      # auth methods are mutually exclusive — exporting only the configured one
      # avoids an empty APPLE_ID accidentally selecting the Apple-ID path.
      - name: Set up macOS signing & notarization
        if: runner.os == 'macOS'
        shell: bash
        env:
          APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }}
          APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
          APPLE_SIGNING_IDENTITY: ${{ secrets.APPLE_SIGNING_IDENTITY }}
          # Notarization — App Store Connect API key (.p8), preferred for CI.
          APPLE_API_KEY_P8_BASE64: ${{ secrets.APPLE_API_KEY_P8_BASE64 }}
          APPLE_API_KEY_ID: ${{ secrets.APPLE_API_KEY_ID }}
          APPLE_API_ISSUER: ${{ secrets.APPLE_API_ISSUER }}
          # Notarization — Apple ID (alternative; use one method, not both).
          APPLE_ID: ${{ secrets.APPLE_ID }}
          APPLE_PASSWORD: ${{ secrets.APPLE_PASSWORD }}
          APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
        run: |
          # Code-signing certificate (Tauri imports it from these env vars).
          if [ -n "$APPLE_CERTIFICATE" ]; then
            {
              echo "APPLE_CERTIFICATE=$APPLE_CERTIFICATE"
              echo "APPLE_CERTIFICATE_PASSWORD=$APPLE_CERTIFICATE_PASSWORD"
            } >> "$GITHUB_ENV"
            [ -n "$APPLE_SIGNING_IDENTITY" ] && echo "APPLE_SIGNING_IDENTITY=$APPLE_SIGNING_IDENTITY" >> "$GITHUB_ENV"
            echo "code-signing: enabled"
          else
            echo "code-signing: DISABLED (APPLE_CERTIFICATE unset) — bundle will be unsigned"
          fi

          # Notarization auth — pick exactly one method.
          if [ -n "$APPLE_API_KEY_P8_BASE64" ]; then
            # APPLE_API_KEY is the Key ID STRING; the .p8 key material is a file
            # referenced by APPLE_API_KEY_PATH. Decode the base64 secret to disk.
            KEY_PATH="$RUNNER_TEMP/AuthKey_${APPLE_API_KEY_ID}.p8"
            echo -n "$APPLE_API_KEY_P8_BASE64" | base64 --decode > "$KEY_PATH"
            {
              echo "APPLE_API_ISSUER=$APPLE_API_ISSUER"
              echo "APPLE_API_KEY=$APPLE_API_KEY_ID"
              echo "APPLE_API_KEY_PATH=$KEY_PATH"
            } >> "$GITHUB_ENV"
            echo "notarization: App Store Connect API key"
          elif [ -n "$APPLE_ID" ]; then
            {
              echo "APPLE_ID=$APPLE_ID"
              echo "APPLE_PASSWORD=$APPLE_PASSWORD"
              echo "APPLE_TEAM_ID=$APPLE_TEAM_ID"
            } >> "$GITHUB_ENV"
            echo "notarization: Apple ID"
          else
            echo "notarization: DISABLED (no API key or Apple ID secrets)"
          fi

      # The computerd bundle is a nested .app *resource* inside the Tauri app
      # (Resources/jcode-computerd.app). Tauri signs the outer app and its
      # externalBin sidecars with Developer ID, but does NOT re-sign resource
      # bundles — so the ad-hoc signature applied by build_computerd_bundle.sh
      # would survive into the notarization upload and Apple rejects it ("not
      # signed with a valid Developer ID certificate" / "no secure timestamp" /
      # "hardened runtime not enabled"). Re-sign the nested bundle here, before
      # `tauri build`, so the outer signature references a properly signed inner
      # bundle. Skipped when signing is disabled (no APPLE_CERTIFICATE): Tauri
      # then neither signs nor notarizes, and the ad-hoc bundle is fine for an
      # unsigned local build.
      - name: Sign computerd bundle (Developer ID)
        if: runner.os == 'macOS'
        shell: bash
        run: |
          set -euo pipefail
          if [ -z "${APPLE_CERTIFICATE:-}" ]; then
            echo "code-signing disabled — leaving ad-hoc signature (no notarization)"
            exit 0
          fi
          BUNDLE="desktop/src-tauri/bundles/jcode-computerd.app"

          # Import the Developer ID certificate into a throwaway keychain so
          # codesign can use it. Tauri builds its own keychain later for the
          # outer app; the two coexist.
          KEYCHAIN="$RUNNER_TEMP/computerd-signing.keychain-db"
          KEYCHAIN_PW="$(openssl rand -hex 16)"
          security create-keychain -p "$KEYCHAIN_PW" "$KEYCHAIN"
          security set-keychain-settings -lut 21600 "$KEYCHAIN"
          security unlock-keychain -p "$KEYCHAIN_PW" "$KEYCHAIN"
          CERT="$RUNNER_TEMP/computerd-cert.p12"
          echo -n "$APPLE_CERTIFICATE" | base64 --decode > "$CERT"
          security import "$CERT" -P "$APPLE_CERTIFICATE_PASSWORD" \
            -A -t cert -f pkcs12 -k "$KEYCHAIN"
          security set-key-partition-list -S apple-tool:,apple: \
            -k "$KEYCHAIN_PW" "$KEYCHAIN" >/dev/null
          # Prepend our keychain so codesign resolves the identity. The
          # unquoted substitution is intentional: it expands to the list of
          # existing keychain paths, each a separate argument.
          # shellcheck disable=SC2046
          security list-keychains -d user -s "$KEYCHAIN" \
            $(security list-keychains -d user | tr -d '"')

          # Resolve the signing identity (fall back to the first valid
          # codesigning identity in the keychain when not explicitly set).
          IDENTITY="${APPLE_SIGNING_IDENTITY:-}"
          if [ -z "$IDENTITY" ]; then
            IDENTITY="$(security find-identity -v -p codesigning "$KEYCHAIN" | awk -F'"' 'NR==1{print $2}')"
          fi
          [ -n "$IDENTITY" ] || { echo "no Developer ID signing identity found" >&2; exit 1; }

          # Sign from the inside out: workers first, then the daemon, then the
          # bundle wrapper. Hardened runtime (--options runtime) + a secure
          # timestamp are both mandatory for notarization. A shared identifier
          # keeps the three binaries under one TCC identity (see the bundle
          # script header). The daemon uses only AX + ScreenCaptureKit, which
          # work under hardened runtime without extra entitlements.
          for bin in jcode-computerd-capture jcode-computerd-onboarding jcode-computerd; do
            [ -x "$BUNDLE/Contents/MacOS/$bin" ] || continue
            codesign --force --options runtime --timestamp \
              --sign "$IDENTITY" --identifier com.cnjack.jcode.computerd \
              "$BUNDLE/Contents/MacOS/$bin"
          done
          codesign --force --options runtime --timestamp \
            --sign "$IDENTITY" "$BUNDLE"

          echo "Signed nested bundle with: $IDENTITY"
          codesign --verify --deep --strict --verbose=2 "$BUNDLE"

      - name: Build desktop bundle
        shell: bash
        working-directory: desktop
        env:
          # Lets linuxdeploy build the AppImage on runners without FUSE mounted.
          # The macOS signing/notarization vars arrive via $GITHUB_ENV (above).
          APPIMAGE_EXTRACT_AND_RUN: 1
        run: |
          pnpm install --frozen-lockfile
          pnpm tauri build --bundles ${{ matrix.bundles }}

      - name: Collect bundles
        shell: bash
        run: |
          mkdir -p dist-desktop
          B="desktop/src-tauri/target/release/bundle"
          shopt -s nullglob 2>/dev/null || true
          for f in "$B"/dmg/*.dmg "$B"/msi/*.msi "$B"/nsis/*-setup.exe "$B"/deb/*.deb "$B"/appimage/*.AppImage; do
            [ -f "$f" ] && cp "$f" dist-desktop/
          done
          cd dist-desktop
          for f in *; do
            [ -f "$f" ] || continue
            if command -v sha256sum >/dev/null 2>&1; then
              sha256sum "$f" > "$f.sha256"
            else
              shasum -a 256 "$f" > "$f.sha256"
            fi
          done
          ls -la

      - name: Upload desktop bundles
        uses: actions/upload-artifact@v5
        with:
          name: desktop-${{ matrix.label }}
          path: dist-desktop/*
          if-no-files-found: error

  release:
    needs: [build, desktop]
    runs-on: ubuntu-latest
    permissions:
      contents: write

    steps:
      - name: Checkout code
        uses: actions/checkout@v5
        with:
          fetch-depth: 0

      - name: Get version
        id: get_version
        run: |
          if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
            VERSION="${{ github.event.inputs.version }}"
          else
            VERSION="${GITHUB_REF#refs/tags/}"
          fi
          echo "version=$VERSION" >> "$GITHUB_OUTPUT"

      - name: Download CLI binaries
        uses: actions/download-artifact@v5
        with:
          path: dist
          pattern: binaries-*
          merge-multiple: true

      - name: Download desktop bundles
        uses: actions/download-artifact@v5
        with:
          path: dist-desktop
          pattern: desktop-*
          merge-multiple: true

      - name: List artifacts
        run: |
          echo "── CLI binaries ──"; ls -la dist/
          echo "── Desktop bundles ──"; ls -la dist-desktop/

      - name: Create Release
        uses: softprops/action-gh-release@v2
        with:
          tag_name: ${{ steps.get_version.outputs.version }}
          name: Release ${{ steps.get_version.outputs.version }}
          draft: false
          prerelease: ${{ contains(steps.get_version.outputs.version, 'alpha') || contains(steps.get_version.outputs.version, 'beta') || contains(steps.get_version.outputs.version, 'rc') }}
          files: |
            dist/jcode-*
            dist-desktop/*
          generate_release_notes: true
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}