release.yml

name: Release

# 推送 v* 标签（scripts/release.sh 创建）时构建并发布。
# 发布说明取自附注标签的内容（该版本的提交历史），缺失时回退到 cargo xtask notes。
# 暂不做系统代码签名（macOS 公证 / Windows 签名），仅使用更新器密钥签名更新包。
on:
  push:
    tags: ["v*"]

permissions:
  contents: write

concurrency:
  group: release-${{ github.ref }}
  cancel-in-progress: false

env:
  CARGO_TERM_COLOR: always

jobs:
  notes:
    name: Release notes
    runs-on: ubuntu-latest
    outputs:
      body: ${{ steps.notes.outputs.body }}
    steps:
      - uses: actions/checkout@v7
        with:
          fetch-depth: 0
      - uses: dtolnay/rust-toolchain@stable
      - uses: Swatinem/rust-cache@v2
        with:
          key: xtask
      - name: Read release notes from the tag
        id: notes
        run: |
          # checkout 可能只拿到轻量引用，显式获取附注标签对象
          git fetch --force origin "refs/tags/${GITHUB_REF_NAME}:refs/tags/${GITHUB_REF_NAME}"
          body="$(git tag -l --format='%(contents)' "${GITHUB_REF_NAME}")"
          if [ -z "$(printf '%s' "$body" | tr -d '[:space:]')" ] || [ "$body" = "${GITHUB_REF_NAME}" ]; then
            body="$(cargo xtask notes "${GITHUB_REF_NAME}" "${GITHUB_REF_NAME}")"
          fi
          {
            echo 'body<<TOOLFORGE_NOTES_EOF'
            printf '%s\n' "$body"
            echo 'TOOLFORGE_NOTES_EOF'
          } >> "$GITHUB_OUTPUT"
          printf '%s\n' "$body" >> "$GITHUB_STEP_SUMMARY"

  build:
    name: Build (${{ matrix.name }})
    needs: notes
    strategy:
      fail-fast: false
      matrix:
        include:
          - name: macOS arm64
            os: macos-latest
            target: aarch64-apple-darwin
          - name: macOS x64
            os: macos-latest
            target: x86_64-apple-darwin
          - name: Windows x64
            os: windows-latest
            target: x86_64-pc-windows-msvc
          - name: Linux x64
            os: ubuntu-22.04
            target: x86_64-unknown-linux-gnu
    runs-on: ${{ matrix.os }}
    steps:
      - uses: actions/checkout@v7
      - name: Install Linux dependencies
        if: runner.os == 'Linux'
        run: |
          sudo apt-get update
          sudo apt-get install -y libwebkit2gtk-4.1-dev libappindicator3-dev librsvg2-dev patchelf
      - uses: pnpm/action-setup@v6
      - uses: actions/setup-node@v7
        with:
          node-version: 22
          cache: pnpm
      - uses: dtolnay/rust-toolchain@stable
        with:
          targets: ${{ matrix.target }}
      - uses: Swatinem/rust-cache@v2
        with:
          key: release-${{ matrix.target }}
      - name: Install dependencies
        run: pnpm install --frozen-lockfile
      # 命令行工具 tfp 作为 sidecar 打进安装包（tauri.release.conf.json 的 externalBin）
      - name: Build CLI sidecar
        run: cargo xtask cli-sidecar --target ${{ matrix.target }}
      - name: Build and upload
        uses: tauri-apps/tauri-action@v1
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          # 使用项目专属的 Secret 名，避免读到组织级同名 Secret（其他项目的密钥）。
          # 私钥需与 tauri.conf.json 中的 updater 公钥配对；密码未设置时为空字符串。
          TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TOOLFORGE_UPDATER_PRIVATE_KEY }}
          TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TOOLFORGE_UPDATER_KEY_PASSWORD }}
        with:
          projectPath: apps/desktop
          # projectPath 下没有锁文件，tauri-action 会误用 npm；显式使用 pnpm
          tauriScript: pnpm tauri
          tagName: ${{ github.ref_name }}
          releaseName: ${{ github.ref_name }}
          releaseBody: ${{ needs.notes.outputs.body }}
          # 全部平台上传完成后再由 publish 任务正式发布，避免 latest.json 指向不完整的发布
          releaseDraft: true
          prerelease: ${{ contains(github.ref_name, '-') }}
          includeUpdaterJson: true
          args: --target ${{ matrix.target }} --config src-tauri/tauri.release.conf.json

  publish:
    name: Publish release
    needs: build
    runs-on: ubuntu-latest
    permissions:
      contents: write
      # 触发官网部署（workflow_dispatch）
      actions: write
    steps:
      - name: Publish draft
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: gh release edit "${GITHUB_REF_NAME}" --repo "${GITHUB_REPOSITORY}" --draft=false
      # 用 GITHUB_TOKEN 发布不会产生 release 事件去触发其他工作流，
      # 官网的下载链接与更新日志要显式重建；workflow_dispatch 是例外，可以由 GITHUB_TOKEN 触发
      - name: Rebuild website
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: gh workflow run site-deploy.yml --repo "${GITHUB_REPOSITORY}" --ref "${{ github.event.repository.default_branch }}"