release.yml

name: Release

on:
  workflow_dispatch:

permissions:
  contents: write

jobs:
  prepare:
    name: Compute CalVer version
    runs-on: ubuntu-latest
    outputs:
      version: ${{ steps.next.outputs.version }}
    steps:
      - uses: actions/checkout@v6
        with:
          fetch-depth: 1
          fetch-tags: true

      - name: Compute next CalVer
        id: next
        run: |
          VERSION=$(python3 script/next-version.py)
          echo "Next version: ${VERSION}"
          echo "version=${VERSION}" >> "$GITHUB_OUTPUT"

  build:
    name: Build (${{ matrix.artifact }})
    needs: prepare
    strategy:
      fail-fast: false
      matrix:
        include:
          - runner: macos-latest
            target: aarch64-apple-darwin
            formats: dmg
            updater_format: app
            artifact: macos-arm64
          - runner: ubuntu-22.04
            target: x86_64-unknown-linux-gnu
            formats: deb,appimage
            updater_format: appimage
            artifact: linux
          - runner: windows-latest
            target: x86_64-pc-windows-msvc
            formats: nsis
            updater_format: nsis
            artifact: windows
    runs-on: ${{ matrix.runner }}
    steps:
      - uses: actions/checkout@v6

      - name: Install Rust stable
        uses: dtolnay/rust-toolchain@stable
        with:
          targets: ${{ matrix.target }}

      - name: Rust cache
        uses: Swatinem/rust-cache@v2
        with:
          workspaces: . -> target

      # GHA images point apt at mirror+file:/etc/apt/apt-mirrors.txt with
      # azure.archive.ubuntu.com as priority:1. That host often hangs instead of
      # failing, so sed on sources.list is a no-op. Rewrite the mirror list.
      # https://github.com/actions/runner-images/issues/7048
      - name: Prefer Ubuntu archive over Azure apt mirror
        if: matrix.runner == 'ubuntu-22.04'
        run: |
          printf '%s\n' \
            $'http://archive.ubuntu.com/ubuntu/\tpriority:1' \
            $'http://security.ubuntu.com/ubuntu/\tpriority:2' \
            | sudo tee /etc/apt/apt-mirrors.txt >/dev/null
          printf '%s\n' \
            'Acquire::http::Timeout "20";' \
            'Acquire::https::Timeout "20";' \
            'Acquire::Retries "2";' \
            | sudo tee /etc/apt/apt.conf.d/99-gha-timeouts >/dev/null

      - name: Install Linux dependencies
        if: matrix.runner == 'ubuntu-22.04'
        run: |
          curl -fsSL https://raw.githubusercontent.com/zed-industries/zed/main/script/linux -o /tmp/zed-linux-deps.sh
          bash /tmp/zed-linux-deps.sh

      - name: Stamp CalVer into Cargo.toml
        shell: bash
        env:
          VERSION: ${{ needs.prepare.outputs.version }}
        run: python3 script/set-version.py "${VERSION}"

      - name: Install cargo-packager
        run: cargo install cargo-packager --locked

      - name: Build and package installers
        shell: bash
        env:
          TARGET: ${{ matrix.target }}
          FORMATS: ${{ matrix.formats }}
        run: |
          cargo build -p desktop --release --target "$TARGET"
          cargo packager --release \
            -p desktop \
            --target "$TARGET" \
            --formats "$FORMATS"

      - name: Verify macOS bundle signature
        if: matrix.runner == 'macos-latest'
        shell: bash
        run: |
          set -euo pipefail
          # -print -quit: `find | head` SIGPIPEs under pipefail while walking Based.app/.
          DMG=$(find apps/desktop/dist -name '*.dmg' -print -quit)
          if [ -z "$DMG" ]; then
            echo "::error::No .dmg found in apps/desktop/dist"
            exit 1
          fi
          echo "Verifying $DMG"
          MNT=$(mktemp -d)
          cleanup() { hdiutil detach "$MNT" -quiet 2>/dev/null || true; rmdir "$MNT" 2>/dev/null || true; }
          trap cleanup EXIT
          # packager `license-file` is passed as --eula; without Agree on stdin,
          # hdiutil prints the license and exits with "attach canceled".
          hdiutil attach "$DMG" -mountpoint "$MNT" -nobrowse <<<'Y'
          APP="$MNT/Based.app"
          if [ ! -d "$APP" ]; then
            echo "::error::Based.app not found at $APP"
            ls -la "$MNT" || true
            exit 1
          fi
          codesign --verify --deep --strict "$APP"

      - name: Build and sign updater bundle
        shell: bash
        env:
          TARGET: ${{ matrix.target }}
          UPDATER_FORMAT: ${{ matrix.updater_format }}
          UPDATER_PRIVATE_KEY: ${{ secrets.UPDATER_PRIVATE_KEY }}
        run: |
          cargo packager --release \
            -p desktop \
            --target "$TARGET" \
            --formats "$UPDATER_FORMAT"

          if [ -z "${UPDATER_PRIVATE_KEY:-}" ]; then
            echo "::warning::UPDATER_PRIVATE_KEY not set — skipping updater signing"
            exit 0
          fi

          cd apps/desktop/dist
          shopt -s nullglob

          if [ "$UPDATER_FORMAT" = "app" ]; then
            for app in *.app; do
              [ -d "$app" ] || continue
              tar -czf "${app}.tar.gz" "$app"
              cargo packager signer sign -k "$UPDATER_PRIVATE_KEY" "${app}.tar.gz"
            done
          elif [ "$UPDATER_FORMAT" = "appimage" ]; then
            for img in *.AppImage; do
              cargo packager signer sign -k "$UPDATER_PRIVATE_KEY" "$img"
            done
          elif [ "$UPDATER_FORMAT" = "nsis" ]; then
            for exe in *setup.exe *.exe; do
              [ -f "$exe" ] || continue
              cargo packager signer sign -k "$UPDATER_PRIVATE_KEY" "$exe"
            done
          fi

      - name: Upload artifact
        uses: actions/upload-artifact@v7
        with:
          name: ${{ matrix.artifact }}
          # Match installer extensions only. `formats: dmg` already keeps
          # cargo-packager from leaving a .app bundle in dist/, but listing
          # extensions explicitly is also a safety net against any future
          # packager output that's a directory (which would crash the
          # release uploader the way Based.app/ did once before).
          path: |
            apps/desktop/dist/*.dmg
            apps/desktop/dist/*.deb
            apps/desktop/dist/*.AppImage
            apps/desktop/dist/*.exe
            apps/desktop/dist/*.msi
            apps/desktop/dist/*.app.tar.gz
            apps/desktop/dist/*.sig
          if-no-files-found: ignore

  release:
    name: Publish GitHub Release
    needs: [prepare, build]
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6
        with:
          fetch-depth: 0
          fetch-tags: true

      - name: Download artifacts
        uses: actions/download-artifact@v7
        with:
          path: dist
          merge-multiple: true

      - name: Generate latest.json
        env:
          VERSION: ${{ needs.prepare.outputs.version }}
        run: |
          SEMVER="${VERSION#v}"
          if find dist -name '*.sig' -print -quit | grep -q .; then
            python3 script/generate-update-manifest.py \
              --dist dist \
              --version "$SEMVER" \
              --tag "$VERSION" \
              -o latest.json
          else
            echo "::warning::No signed updater artifacts — skipping latest.json (set UPDATER_PRIVATE_KEY secret)"
          fi

      - name: Publish GitHub Release
        uses: softprops/action-gh-release@v3
        with:
          tag_name: ${{ needs.prepare.outputs.version }}
          name: Based ${{ needs.prepare.outputs.version }}
          target_commitish: ${{ github.sha }}
          generate_release_notes: true
          make_latest: "true"
          draft: false
          # `dist/*` matches one level only. softprops-gh-release uploads
          # files and silently skips directories from glob matches, so any
          # stray directory landing in dist/ would not break the release.
          files: dist/*

      - name: Upload latest.json
        if: hashFiles('latest.json') != ''
        env:
          VERSION: ${{ needs.prepare.outputs.version }}
          GH_TOKEN: ${{ github.token }}
        run: gh release upload "$VERSION" latest.json --clobber

  homebrew:
    name: Homebrew cask
    needs: [prepare, release]
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6

      - name: Bump cask
        shell: bash
        env:
          VERSION: ${{ needs.prepare.outputs.version }}
          HOMEBREW_TAP_TOKEN: ${{ secrets.HOMEBREW_TAP_TOKEN }}
        run: |
          if [ -z "${HOMEBREW_TAP_TOKEN:-}" ]; then
            echo "::warning::HOMEBREW_TAP_TOKEN not set — skipping Homebrew cask bump"
            exit 0
          fi
          python3 script/bump-packaging.py --homebrew

  winget:
    name: winget manifest
    needs: [prepare, release]
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6

      - name: winget-releaser
        id: winget
        shell: bash
        env:
          WINGET_RELEASE_TOKEN: ${{ secrets.WINGET_RELEASE_TOKEN }}
        run: |
          if [ -z "${WINGET_RELEASE_TOKEN:-}" ]; then
            echo "::warning::WINGET_RELEASE_TOKEN not set — skipping winget-releaser (see packaging/winget/BOOTSTRAP.md)"
            echo "skip=true" >> "$GITHUB_OUTPUT"
          fi

      - name: Submit manifest
        if: steps.winget.outputs.skip != 'true'
        uses: vedantmgoyal9/winget-releaser@v2
        with:
          identifier: pavi2410.Based
          installers-regex: 'based_.*_x64-setup\.exe$'
          release-tag: ${{ needs.prepare.outputs.version }}
          token: ${{ secrets.WINGET_RELEASE_TOKEN }}

  website:
    name: Deploy website
    needs: [release]
    runs-on: ubuntu-latest
    steps:
      - name: Trigger Cloudflare deploy
        shell: bash
        env:
          CLOUDFLARE_DEPLOY_HOOK: ${{ secrets.CLOUDFLARE_DEPLOY_HOOK }}
        run: |
          if [ -z "${CLOUDFLARE_DEPLOY_HOOK:-}" ]; then
            echo "::warning::CLOUDFLARE_DEPLOY_HOOK not set — skipping website deploy"
            exit 0
          fi
          curl -fsS -X POST "${CLOUDFLARE_DEPLOY_HOOK}"