gsender

name: CI

on:
  push:
    # Sequence of patterns matched against refs/heads
    branches:
      - master
      - dev
      - features/* # all feature branches
      - bugfix/*
      - ci/* # all branches with the prefix 'ci/'
    # Sequence of patterns matched against refs/tags
    tags:
      - '*'
  pull_request:
    branches: [ "master" ]

env:
  GITHUB_TOKEN: ${{ secrets.CI_TOKEN }}
  NODE_OPTIONS: --max-old-space-size=8192
  VITE_PUBLIC_POSTHOG_PROJECT_TOKEN: ${{ secrets.VITE_PUBLIC_POSTHOG_PROJECT_TOKEN }}
  VITE_PUBLIC_POSTHOG_HOST: ${{ secrets.VITE_PUBLIC_POSTHOG_HOST }}

jobs:
  build-linux:
    name: Build Linux packages
    runs-on: ubuntu-latest
    environment: CI
    permissions:
      contents: write
    steps:
      - name: Checkout code
        uses: actions/checkout@v3
      - name: Setup and build
        uses: ./.github/actions/setup-build
      - name: Build Linux binaries
        run: yarn run build:linux
      - name: Prepare release assets
        shell: bash
        run: |
          GIT_COMMIT_LOG=`git log -1 --format='%ci %H %s'`
          PACKAGE_NAME=`node -e "console.log(require('./src/package.json').name)"`
          PACKAGE_VERSION=`node -e "console.log(require('./src/package.json').version)"`
          mkdir -p releases/linux
          ls -al output
          cp -af "output/${PACKAGE_NAME}-${PACKAGE_VERSION}-x86_64.AppImage" "releases/linux/${PACKAGE_NAME}-${PACKAGE_VERSION}-Linux-Intel-64Bit.AppImage"
          cp -af "output/${PACKAGE_NAME}-${PACKAGE_VERSION}-amd64.deb" "releases/linux/${PACKAGE_NAME}-${PACKAGE_VERSION}-Linux-Intel-64Bit.deb"
          cp -af "output/${PACKAGE_NAME}-${PACKAGE_VERSION}-arm64.AppImage" "releases/linux/${PACKAGE_NAME}-${PACKAGE_VERSION}-Linux-ARM-64Bit.AppImage"
          cp -af "output/${PACKAGE_NAME}-${PACKAGE_VERSION}-arm64.deb" "releases/linux/${PACKAGE_NAME}-${PACKAGE_VERSION}-Linux-ARM-64Bit.deb"
          ls -al output releases/linux
          if [[ "$GITHUB_REF_TYPE" == "branch" && "$GITHUB_REF_NAME" == "master" ]]; then
            yarn github-release delete \
              --owner=gSender \
              --repo=gsender \
              --tag="${GITHUB_REF_NAME}-latest" \
              --release-name="${GITHUB_REF_NAME}" \
              "*-linux*";
            yarn github-release upload \
              --owner=gSender \
              --repo=gsender \
              --tag="${GITHUB_REF_NAME}-latest" \
              --release-name="${GITHUB_REF_NAME}" \
              --body="${GIT_COMMIT_LOG}" \
              releases/linux/*;
          fi
      - name: Release
        uses: softprops/action-gh-release@v1
        if: startsWith(github.ref, 'refs/tags/')
        with:
          files: releases/linux/*
          prerelease: true
          draft: true

  build-macos:
    name: Build macOS packages
    environment: CI
    runs-on: macos-latest
    env:
      GH_TOKEN: ${{ secrets.CI_TOKEN }}
      APPLE_APP_SPECIFIC_PASSWORD: ${{ secrets.APPLE_APP_SPECIFIC_PASSWORD }}
      APPLE_ID: ${{ secrets.APPLE_ID }}
      APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
      CSC_KEY_PASSWORD: ${{ secrets.CSC_KEY_PASSWORD }}
      CSC_LINK: ${{ secrets.CSC_LINK }}
      # Skip code signing for pull requests
      CSC_IDENTITY_AUTO_DISCOVERY: ${{ github.event_name == 'pull_request' && 'false' || 'true' }}
    permissions:
      contents: write
    steps:
      - name: Checkout code
        uses: actions/checkout@v3
      - name: Pip setuptools
        run: sudo -H pip install setuptools
      - name: Setup and build
        uses: ./.github/actions/setup-build
      - name: Build macOS binaries
        run: yarn run build:macos
      - name: Prepare release assets
        shell: bash
        run: |
          GIT_COMMIT_LOG=`git log -1 --format='%ci %H %s'`
          PACKAGE_NAME=`node -e "console.log(require('./src/package.json').name)"`
          PACKAGE_VERSION=`node -e "console.log(require('./src/package.json').version)"`
          mkdir -p releases/macos
          ls -al output
          cp -af "output/${PACKAGE_NAME}-${PACKAGE_VERSION}-x64.dmg" "releases/macos/gSender-${PACKAGE_VERSION}-Mac-Intel.dmg"
          cp -af "output/${PACKAGE_NAME}-${PACKAGE_VERSION}-arm64.dmg" "releases/macos/gSender-${PACKAGE_VERSION}-Mac-Silicon.dmg"
          ls -al output releases/macos
          if [[ "$GITHUB_REF_TYPE" == "branch" && "$GITHUB_REF_NAME" == "master" ]]; then
            yarn github-release delete \
              --owner=gSender \
              --repo=gsender \
              --tag="${GITHUB_REF_NAME}-latest" \
              --release-name="${GITHUB_REF_NAME}" \
              "*-macos*";
            yarn github-release upload \
              --owner=gSender \
              --repo=gsender \
              --tag="${GITHUB_REF_NAME}-latest" \
              --release-name="${GITHUB_REF_NAME}" \
              --body="${GIT_COMMIT_LOG}" \
              releases/macos/*;
          fi
      - name: Release
        uses: softprops/action-gh-release@v1
        if: startsWith(github.ref, 'refs/tags/')
        with:
          files: releases/macos/*
          prerelease: true
          draft: true
      - name: Upload Mac Artifacts
        uses: actions/upload-artifact@v4
        with:
          name: mac_artifact
          path: releases/macos/*.dmg
          compression-level: 0 # no compression
          retention-days: 2

  build-windows:
    name: Build Windows packages
    environment: CI
    runs-on: windows-latest
    permissions:
      contents: write
    steps:
      - name: Prepare VC++ Runtime
        run: choco install -y vcredist2017
      - name: Checkout code
        uses: actions/checkout@v3
      - name: Write client auth certificate
        if: startsWith(github.ref, 'refs/tags/')
        shell: pwsh
        run: |
          $b64 = "${{ secrets.SM_CLIENT_CERT_FILE_BASE64 }}" -replace '\s', ''
          $certBytes = [Convert]::FromBase64String($b64)
          $certPath = "${{ github.workspace }}\sm_client_cert.p12"
          [IO.File]::WriteAllBytes($certPath, $certBytes)
          echo "SM_CLIENT_CERT_FILE=$certPath" | Out-File -Append -FilePath $env:GITHUB_ENV -Encoding utf8
      - name: Set up DigiCert SM Tools
        if: startsWith(github.ref, 'refs/tags/')
        shell: pwsh
        env:
          SM_API_KEY: ${{ secrets.SM_API_KEY }}
          SM_CLIENT_CERT_PASSWORD: ${{ secrets.SM_CLIENT_CERT_PASSWORD }}
          SM_HOST: ${{ secrets.SM_HOST }}
        run: |
          curl -X GET "https://one.digicert.com/signingmanager/api-ui/v1/releases/smtools-windows-x64.msi/download" `
            -H "x-api-key:$env:SM_API_KEY" -o smtools.msi
          $msiPath = (Resolve-Path smtools.msi).Path
          $proc = Start-Process msiexec -ArgumentList "/i `"$msiPath`" /quiet /qn" -Wait -PassThru
          if ($proc.ExitCode -ne 0) { throw "msiexec failed with exit code $($proc.ExitCode)" }
          $smctl = Get-ChildItem "C:\Program Files", "C:\Program Files (x86)" -Recurse -Filter "smctl.exe" -ErrorAction SilentlyContinue | Select-Object -First 1
          if (-not $smctl) { throw "smctl.exe not found after install" }
          $klPath = $smctl.DirectoryName
          Write-Host "smctl found at: $klPath"
          echo $klPath | Out-File -Append -FilePath $env:GITHUB_PATH -Encoding utf8
          Set-Content -Path "C:\Windows\System32\pkcs11properties.cfg" -Value "curl_path=$klPath"
          [System.Environment]::SetEnvironmentVariable("SM_API_KEY",              $env:SM_API_KEY,              "Machine")
          [System.Environment]::SetEnvironmentVariable("SM_CLIENT_CERT_FILE",     $env:SM_CLIENT_CERT_FILE,     "Machine")
          [System.Environment]::SetEnvironmentVariable("SM_CLIENT_CERT_PASSWORD", $env:SM_CLIENT_CERT_PASSWORD, "Machine")
          [System.Environment]::SetEnvironmentVariable("SM_HOST",                 $env:SM_HOST,                 "Machine")
          & $smctl.FullName healthcheck
          & $smctl.FullName creds save $env:SM_API_KEY $env:SM_CLIENT_CERT_PASSWORD
          & $smctl.FullName windows certsync --keypair-alias="${{ secrets.SM_KEYPAIR_ALIAS }}"
      - name: Add signtool to PATH
        if: startsWith(github.ref, 'refs/tags/')
        shell: pwsh
        run: |
          $signtool = Get-ChildItem -Path "${env:ProgramFiles(x86)}\Windows Kits\10\bin" -Recurse -Filter "signtool.exe" |
            Where-Object { $_.FullName -match "x64" } |
            Sort-Object LastWriteTime -Descending |
            Select-Object -First 1
          if (-not $signtool) { throw "signtool.exe not found in Windows SDK" }
          $signtool.DirectoryName | Out-File -Append -FilePath $env:GITHUB_PATH -Encoding utf8
      - name: Setup and build
        uses: ./.github/actions/setup-build
      - name: Build Windows binaries
        env:
          SM_API_KEY: ${{ startsWith(github.ref, 'refs/tags/') && secrets.SM_API_KEY || '' }}
          SM_CLIENT_CERT_PASSWORD: ${{ startsWith(github.ref, 'refs/tags/') && secrets.SM_CLIENT_CERT_PASSWORD || '' }}
          SM_HOST: ${{ startsWith(github.ref, 'refs/tags/') && secrets.SM_HOST || '' }}
          SM_KEYPAIR_ALIAS: ${{ startsWith(github.ref, 'refs/tags/') && secrets.SM_KEYPAIR_ALIAS || '' }}
        run: yarn run build:windows
      - name: Prepare release assets
        shell: bash
        run: |
          GIT_COMMIT_LOG=`git log -1 --format='%ci %H %s'`
          PACKAGE_NAME=`node -e "console.log(require('./src/package.json').name)"`
          PACKAGE_VERSION=`node -e "console.log(require('./src/package.json').version)"`
          mkdir -p releases/windows
          ls -al output
          cp -af "output/${PACKAGE_NAME}-${PACKAGE_VERSION}-x64.exe" "releases/windows/gSender-${PACKAGE_VERSION}-Windows-64Bit.exe"
          # electron-updater's latest.yml references the artifact by electron-builder's
          # original (un-renamed) filename, and validates it against the matching
          # .blockmap for differential downloads. All three must be uploaded together,
          # under their original names, or auto-update breaks even though the
          # human-friendly renamed .exe above still downloads fine manually.
          cp -af "output/${PACKAGE_NAME}-${PACKAGE_VERSION}-x64.exe" "releases/windows/"
          cp -af "output/${PACKAGE_NAME}-${PACKAGE_VERSION}-x64.exe.blockmap" "releases/windows/"
          cp -af "output/latest.yml" "releases/windows/"
          ls -al output releases/windows
          if [[ "$GITHUB_REF_TYPE" == "branch" && "$GITHUB_REF_NAME" == "master" ]]; then
            yarn github-release delete \
              --owner=gSender \
              --repo=gsender \
              --tag="${GITHUB_REF_NAME}-latest" \
              --release-name="${GITHUB_REF_NAME}" \
              "*-windows*" "*.exe" "*.blockmap" "latest.yml";
            yarn github-release upload \
              --owner=gSender \
              --repo=gsender \
              --tag="${GITHUB_REF_NAME}-latest" \
              --release-name="${GITHUB_REF_NAME}" \
              --body="${GIT_COMMIT_LOG}" \
              releases/windows/*;
          fi
      - name: Release
        uses: softprops/action-gh-release@v1
        if: startsWith(github.ref, 'refs/tags/')
        with:
          files: releases/windows/*
          prerelease: true
          draft: true
      - name: Upload Windows Artifacts
        uses: actions/upload-artifact@v4
        with:
          name: windows_artifact
          path: releases/windows/*.exe
          compression-level: 0 # no compression
          retention-days: 2
  build-pi:
    name: Build Raspberry PI packages
    runs-on: ubuntu-24.04-arm
    environment: CI
    env:
      GH_TOKEN: ${{ secrets.CI_TOKEN }}
    permissions:
      contents: write
    steps:
      - name: Checkout code
        uses: actions/checkout@v3
      - name: Build Pi binaries using docker
        shell: bash
        run: |
          scripts/build-pi.sh
      - name: Release
        uses: softprops/action-gh-release@v1
        if: startsWith(github.ref, 'refs/tags/')
        with:
          files: |
            releases/pi/*
          prerelease: true
          draft: true