desktop-release.yml

name: Desktop Release

run-name: Desktop release ${{ inputs.version }}

on:
  workflow_dispatch:
    inputs:
      version:
        description: "Desktop app version to release, for example 0.0.2 or v0.0.2"
        required: true
        type: string
      release_name:
        description: "Release title. Defaults to the tag."
        required: false
        type: string
      qwen_code_version:
        description: "Optional @qwen-code/qwen-code version to vendor into the desktop app."
        required: false
        type: string
      dry_run:
        description: "Build installers only. Do not create or update a GitHub Release."
        required: true
        default: true
        type: boolean
      draft:
        description: "Create a draft release."
        required: true
        default: true
        type: boolean
      prerelease:
        description: "Mark the release as a prerelease."
        required: true
        default: false
        type: boolean
      clobber:
        description: "Replace same-named assets when uploading to an existing release."
        required: true
        default: false
        type: boolean

permissions:
  contents: read

concurrency:
  group: desktop-release-${{ inputs.version }}
  cancel-in-progress: false

env:
  BUN_VERSION: 1.3.9
  CRAFT_BRAND: openwork
  QWEN_CODE_VERSION: ${{ inputs.qwen_code_version }}

jobs:
  release_metadata:
    name: Prepare Release Source
    runs-on: ubuntu-latest
    timeout-minutes: 10
    permissions:
      contents: write
    outputs:
      release_branch: ${{ steps.release-branch.outputs.branch }}
      release_ref: ${{ steps.release-branch.outputs.ref }}
      tag: ${{ steps.release-version.outputs.tag }}
      version: ${{ steps.release-version.outputs.version }}

    steps:
      - name: Check out source
        uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Set up Bun
        uses: oven-sh/setup-bun@v2
        with:
          bun-version: ${{ env.BUN_VERSION }}

      - name: Install dependencies
        run: bun install --frozen-lockfile

      - name: Configure Git user
        run: |
          git config user.name "github-actions[bot]"
          git config user.email "github-actions[bot]@users.noreply.github.com"

      - name: Require main for publishing
        if: ${{ inputs.dry_run == false }}
        env:
          SOURCE_REF: ${{ github.ref_name }}
        run: |
          set -euo pipefail

          if [ "$SOURCE_REF" != "main" ]; then
            echo "::error::Desktop releases with dry_run=false must be run from main. Current ref: $SOURCE_REF"
            exit 1
          fi

      - name: Bump desktop version
        env:
          INPUT_VERSION: ${{ inputs.version }}
        run: bun run bump-desktop-version "$INPUT_VERSION"

      - name: Validate release version
        id: release-version
        env:
          INPUT_VERSION: ${{ inputs.version }}
        run: bun run check-release-version --version "$INPUT_VERSION"

      - name: Create release branch
        id: release-branch
        env:
          IS_DRY_RUN: ${{ inputs.dry_run }}
          RELEASE_TAG: ${{ steps.release-version.outputs.tag }}
        run: |
          set -euo pipefail

          branch="release/desktop-${RELEASE_TAG}"
          git switch -c "$branch"
          git add package.json apps/electron/package.json packages/shared/package.json

          if git diff --staged --quiet; then
            echo "No desktop version changes to commit."
          else
            git commit -m "chore(release): desktop ${RELEASE_TAG}"
          fi

          echo "branch=$branch" >> "$GITHUB_OUTPUT"

          if [ "$IS_DRY_RUN" = "false" ]; then
            git push --set-upstream origin "$branch"
            echo "ref=$branch" >> "$GITHUB_OUTPUT"
          else
            echo "Dry run enabled. Skipping release branch push."
            echo "ref=$GITHUB_SHA" >> "$GITHUB_OUTPUT"
          fi

  build:
    name: Build ${{ matrix.name }}
    runs-on: ${{ matrix.os }}
    timeout-minutes: 90
    needs: release_metadata
    env:
      RELEASE_TAG: ${{ needs.release_metadata.outputs.tag }}
      RELEASE_VERSION: ${{ needs.release_metadata.outputs.version }}
    strategy:
      fail-fast: false
      matrix:
        include:
          - name: macOS
            os: macos-latest
            command: bun run dist:mac
          - name: Windows
            os: windows-latest
            command: bun run dist:win
          - name: Linux
            os: ubuntu-22.04
            command: bun run dist:linux

    steps:
      - name: Check out source
        uses: actions/checkout@v4
        with:
          ref: ${{ needs.release_metadata.outputs.release_ref }}

      - name: Set up Bun
        uses: oven-sh/setup-bun@v2
        with:
          bun-version: ${{ env.BUN_VERSION }}

      - name: Install Linux packaging dependencies
        if: runner.os == 'Linux'
        run: |
          sudo apt-get update
          sudo apt-get install -y libfuse2

      - name: Install dependencies
        run: bun install --frozen-lockfile

      - name: Bump desktop version
        run: bun run bump-desktop-version "$RELEASE_VERSION"

      - name: Confirm release version
        run: bun run check-release-version --version "$RELEASE_VERSION"

      - name: Build desktop installer
        run: ${{ matrix.command }}
        env:
          APPLE_ID: ${{ secrets.APPLE_ID }}
          APPLE_APP_SPECIFIC_PASSWORD: ${{ secrets.APPLE_APP_SPECIFIC_PASSWORD }}
          APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
          CSC_KEY_PASSWORD: ${{ secrets.CSC_KEY_PASSWORD }}
          CSC_LINK: ${{ secrets.CSC_LINK }}
          SENTRY_ELECTRON_INGEST_URL: ${{ secrets.SENTRY_ELECTRON_INGEST_URL }}

      - name: Upload installer artifacts
        uses: actions/upload-artifact@v4
        with:
          name: desktop-${{ matrix.name }}
          if-no-files-found: error
          retention-days: 14
          path: |
            apps/electron/release/*.AppImage
            apps/electron/release/*.blockmap
            apps/electron/release/*.dmg
            apps/electron/release/*.exe
            apps/electron/release/*.yml
            apps/electron/release/*.zip

  publish:
    name: Publish GitHub Release
    runs-on: ubuntu-latest
    timeout-minutes: 20
    needs:
      - build
      - release_metadata
    if: ${{ inputs.dry_run == false }}
    permissions:
      contents: write
    env:
      RELEASE_TAG: ${{ needs.release_metadata.outputs.tag }}
      RELEASE_VERSION: ${{ needs.release_metadata.outputs.version }}

    steps:
      - name: Download installer artifacts
        uses: actions/download-artifact@v4
        with:
          path: release-assets
          merge-multiple: true

      - name: Publish release assets
        env:
          GH_TOKEN: ${{ github.token }}
          RELEASE_DRAFT: ${{ inputs.draft }}
          RELEASE_NAME: ${{ inputs.release_name }}
          RELEASE_PRERELEASE: ${{ inputs.prerelease }}
          RELEASE_TARGET: ${{ needs.release_metadata.outputs.release_ref }}
          UPLOAD_CLOBBER: ${{ inputs.clobber }}
        run: |
          set -euo pipefail

          assets=()
          while IFS= read -r -d '' file; do
            assets+=("$file")
          done < <(find release-assets -type f -print0 | sort -z)

          if [ "${#assets[@]}" -eq 0 ]; then
            echo "No release assets were downloaded."
            exit 1
          fi

          printf 'Release assets:\n'
          printf '  %s\n' "${assets[@]}"

          title="${RELEASE_NAME:-$RELEASE_TAG}"

          if gh release view "$RELEASE_TAG" >/dev/null 2>&1; then
            upload_args=("$RELEASE_TAG" "${assets[@]}")
            if [ "$UPLOAD_CLOBBER" = "true" ]; then
              upload_args+=(--clobber)
            fi
            gh release upload "${upload_args[@]}"
          else
            create_args=(
              "$RELEASE_TAG"
              "${assets[@]}"
              --generate-notes
              --target "$RELEASE_TARGET"
              --title "$title"
            )
            if [ "$RELEASE_DRAFT" = "true" ]; then
              create_args+=(--draft)
            fi
            if [ "$RELEASE_PRERELEASE" = "true" ]; then
              create_args+=(--prerelease)
            fi
            gh release create "${create_args[@]}"
          fi

  sync-version:
    name: Sync Release Version to Main
    runs-on: ubuntu-latest
    timeout-minutes: 10
    needs:
      - publish
      - release_metadata
    if: ${{ inputs.dry_run == false }}
    permissions:
      contents: write
      pull-requests: write

    steps:
      - name: Create version sync PR
        id: version-pr
        env:
          GH_TOKEN: ${{ secrets.CI_BOT_PAT || github.token }}
          RELEASE_BRANCH: ${{ needs.release_metadata.outputs.release_branch }}
          RELEASE_TAG: ${{ needs.release_metadata.outputs.tag }}
        run: |
          set -euo pipefail

          pr_url="$(gh pr list \
            --repo "$GITHUB_REPOSITORY" \
            --head "$RELEASE_BRANCH" \
            --base main \
            --json url \
            --jq '.[0].url')"

          if [ -z "$pr_url" ]; then
            pr_url="$(gh pr create \
              --repo "$GITHUB_REPOSITORY" \
              --base main \
              --head "$RELEASE_BRANCH" \
              --title "chore(release): desktop ${RELEASE_TAG}" \
              --body "Automated desktop release PR for ${RELEASE_TAG}. Syncs desktop package versions on main.")"
          fi

          echo "url=$pr_url" >> "$GITHUB_OUTPUT"

      - name: Enable auto-merge
        env:
          GH_TOKEN: ${{ secrets.CI_BOT_PAT || github.token }}
          PR_URL: ${{ steps.version-pr.outputs.url }}
          RELEASE_TAG: ${{ needs.release_metadata.outputs.tag }}
        run: |
          set -euo pipefail

          gh pr merge "$PR_URL" \
            --squash \
            --auto \
            --delete-branch \
            --subject "chore(release): desktop ${RELEASE_TAG} [skip ci]"

  dry-run-summary:
    name: Dry Run Summary
    runs-on: ubuntu-latest
    timeout-minutes: 10
    needs:
      - build
      - release_metadata
    if: ${{ inputs.dry_run }}
    env:
      RELEASE_TAG: ${{ needs.release_metadata.outputs.tag }}
      RELEASE_VERSION: ${{ needs.release_metadata.outputs.version }}

    steps:
      - name: Download installer artifacts
        uses: actions/download-artifact@v4
        with:
          path: release-assets
          merge-multiple: true

      - name: List release assets
        run: |
          set -euo pipefail

          assets=()
          while IFS= read -r -d '' file; do
            assets+=("$file")
          done < <(find release-assets -type f -print0 | sort -z)

          if [ "${#assets[@]}" -eq 0 ]; then
            echo "No release assets were downloaded."
            exit 1
          fi

          {
            echo "## Desktop release dry run"
            echo
            echo "Version: $RELEASE_VERSION"
            echo "Release tag: $RELEASE_TAG"
            echo
            echo "Built ${#assets[@]} asset(s). No GitHub Release was created or updated."
            echo
            echo "| Asset | Size |"
            echo "| --- | ---: |"
            for file in "${assets[@]}"; do
              size=$(du -h "$file" | cut -f1)
              echo "| $(basename "$file") | $size |"
            done
          } >> "$GITHUB_STEP_SUMMARY"