build_and_publish.yaml

name: "build and publish"

on:
  workflow_dispatch:
  push:
    branches:
      - "test-deploy"
    tags:
      - "v*" # Trigger on any tag that starts with 'v'

jobs:
  publish-tauri:
    permissions:
      contents: write
    strategy:
      fail-fast: false
      matrix:
        include:
          - platform: "macos-latest"
            args: "--target aarch64-apple-darwin"
            arch: "apple-silicon"
          - platform: "macos-latest"
            args: "--target x86_64-apple-darwin"
            arch: "intel"

    runs-on: ${{ matrix.platform }}
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0 # Fetch all history for all tags and branches

      - name: Rust Cache
        uses: Swatinem/rust-cache@v2
        with:
          prefix-key: "rust-cache"
          shared-key: ${{ matrix.platform }}-${{ matrix.arch }}
          workspaces: "./src-tauri -> target"

      - name: setup node
        uses: actions/setup-node@v4
        with:
          node-version: lts/*

      - name: install Rust stable
        uses: dtolnay/rust-toolchain@stable
        with:
          targets: ${{ matrix.platform == 'macos-latest' && 'aarch64-apple-darwin,x86_64-apple-darwin' || '' }}

      - name: install frontend dependencies
        run: npm ci

      - name: import Apple Developer Certificate
        env:
          APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }}
          APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
          KEYCHAIN_PASSWORD: ${{ secrets.KEYCHAIN_PASSWORD }}
        run: |
          echo $APPLE_CERTIFICATE | base64 --decode > certificate.p12
          security create-keychain -p "$KEYCHAIN_PASSWORD" build.keychain
          security default-keychain -s build.keychain
          security unlock-keychain -p "$KEYCHAIN_PASSWORD" build.keychain
          security set-keychain-settings -t 3600 -u build.keychain
          security import certificate.p12 -k build.keychain -P "$APPLE_CERTIFICATE_PASSWORD" -T /usr/bin/codesign
          security set-key-partition-list -S apple-tool:,apple:,codesign: -s -k "$KEYCHAIN_PASSWORD" build.keychain
          security find-identity -v -p codesigning build.keychain

      - name: verify certificate
        run: |
          CERT_INFO=$(security find-identity -v -p codesigning build.keychain | grep "Developer ID Application")
          CERT_ID=$(echo "$CERT_INFO" | awk -F'"' '{print $2}')
          echo "CERT_ID=$CERT_ID" >> $GITHUB_ENV
          echo "Certificate imported."

      - name: Install SQLx CLI
        run: cargo install sqlx-cli --no-default-features --features native-tls,sqlite

      - name: Setup Apple API Key for notarization
        env:
          APPLE_API_KEY: ${{ secrets.APPLE_API_KEY_PATH }}
        run: |
          mkdir -p ~/private_keys
          echo "$APPLE_API_KEY" | base64 --decode > ~/private_keys/AuthKey.p8
          echo "Created API key file at ~/private_keys/AuthKey.p8"

      - name: Get Version
        id: get_version
        run: |
          VERSION=$(node -p "require('./package.json').version")
          echo "VERSION=$VERSION" >> $GITHUB_ENV

      - name: Get last release
        id: last_release
        run: |
          last_release=$(curl -s -H "Authorization: token ${{ secrets.GH_PERSONAL_ACCESS_TOKEN }}" \
            "https://api.github.com/repos/${{ github.repository }}/releases/latest" | \
            jq -r .tag_name)
          echo "Last release tag: $last_release"
          echo "last_release=$last_release" >> $GITHUB_OUTPUT

      - name: Create Changelog
        id: create_changelog
        run: |
          git log ${{ steps.last_release.outputs.last_release }}..HEAD --pretty=format:"- %s %h%n" > changelog.md
          echo "changelog<<EOF" >> $GITHUB_OUTPUT
          echo "$(cat changelog.md)" >> $GITHUB_OUTPUT
          echo "EOF" >> $GITHUB_OUTPUT

      - name: build and publish
        uses: tauri-apps/tauri-action@v0.5.20
        env:
          GITHUB_TOKEN: ${{ secrets.GH_PERSONAL_ACCESS_TOKEN }}
          APPLE_SIGNING_IDENTITY: ${{ secrets.APPLE_SIGNING_IDENTITY }}
          APPLE_API_ISSUER: ${{ secrets.APPLE_API_ISSUER }}
          APPLE_API_KEY: ${{ secrets.APPLE_API_KEY }}
          APPLE_API_KEY_PATH: ~/private_keys/AuthKey.p8
          APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
          APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }}
          TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
          SENTRY_AUTH_TOKEN: ${{ secrets.SENTRY_AUTH_TOKEN }}
          SENTRY_RELEASE: ${{ env.VERSION }}
          VITE_SUPABASE_URL: https://wnwyftlrmrtfkshyenlc.supabase.co
          VITE_SUPABASE_ANON_KEY: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJzdXBhYmFzZSIsInJlZiI6Indud3lmdGxybXJ0ZmtzaHllbmxjIiwicm9sZSI6ImFub24iLCJpYXQiOjE3MzgyNTI3NzQsImV4cCI6MjA1MzgyODc3NH0.4s8uVgcU8MHOZIppT89qsgxIu_WsAWY0aOxgEUkv2eQ
          VITE_GOOGLE_REDIRECT: https://ebb.cool/auth-success
          VITE_SPOTIFY_CLIENT_ID: 0a9880c412a44cef9a8dc460479dcc92
          VITE_SPOTIFY_CLIENT_SECRET: 1f2f2f532dc34d1783454a4dffbe1f57
          VITE_PUBLIC_POSTHOG_KEY: phc_x7r5tfRz3GLFzxKcQfwBtUPXApOPgLbG1nYHIsL60aN
          VITE_PUBLIC_POSTHOG_HOST: https://us.i.posthog.com
        with:
          tagName: v__VERSION__
          releaseName: "v__VERSION__"
          releaseBody: |
            Changes in this Release:

            ${{ steps.create_changelog.outputs.changelog }}
          args: ${{ matrix.args }}
          includeUpdaterJson: true

  upload-dmg:
    runs-on: ubuntu-latest
    needs: publish-tauri
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0 # Fetch all history for all tags and branches

      - name: setup node
        uses: actions/setup-node@v4
        with:
          node-version: lts/*

      - name: Get Version
        id: get_version
        run: |
          VERSION=$(node -p "require('./package.json').version")
          echo "VERSION=$VERSION" >> $GITHUB_ENV

      - name: Add DMG to release
        run: |
          chmod +x .github/scripts/process_dmg_releases.js
          .github/scripts/process_dmg_releases.js \
            "${{ secrets.GH_PERSONAL_ACCESS_TOKEN }}" \
            "${{ github.repository }}" \
            "${{ env.VERSION }}" \
        env:
          GITHUB_TOKEN: ${{ secrets.GH_PERSONAL_ACCESS_TOKEN }}