release.yml

name: Package and Release

on:
  push:
    tags:
      - v*

jobs:
  test:
    name: Lint and Test
    runs-on: ubuntu-24.04
    timeout-minutes: 20
    steps:
      - uses: actions/checkout@v6
      - uses: pnpm/action-setup@v4
      - uses: actions/setup-node@v4
        with:
          node-version: 24
          cache: 'pnpm'
      - name: Install system dependencies
        run: |
          sudo apt-get update
          sudo apt-get install -y xvfb libx11-dev pkg-config libpipewire-0.3-dev libspa-0.2-dev
      - run: pnpm install  
      - name: Lint JS
        run: pnpm lint:js
      - name: Lint HBS
        run: pnpm lint:hbs
      - name: Browser Test
        run: pnpm test:ember
      - name: Electron Test
        run: xvfb-run --auto-servernum pnpm test:electron     
  build:
    name: Build (${{ matrix.os }})
    if: startsWith(github.ref, 'refs/tags/')
    needs: test
    runs-on: ${{ matrix.os }}
    timeout-minutes: 30
    strategy:
      matrix:
        os: [macos-latest, ubuntu-24.04, ubuntu-24.04-arm, windows-latest]
    steps:
      - uses: actions/checkout@v6
      - uses: pnpm/action-setup@v4
      - uses: actions/setup-node@v4
        with:
          node-version: 24
          cache: 'pnpm'
      - name: Install Linux dependencies
        if: startsWith(matrix.os, 'ubuntu')
        run: |
          sudo apt-get update
          sudo apt-get install -y libx11-dev pkg-config libpipewire-0.3-dev libspa-0.2-dev
      - run: pnpm install
      - name: Add macOS certs
        if: startsWith(matrix.os, 'macos') && startsWith(github.ref, 'refs/tags/')
        run: chmod +x add-osx-cert.sh && ./add-osx-cert.sh
        env:
          CERTIFICATE_OSX_APPLICATION: ${{ secrets.CERTIFICATE_OSX_APPLICATION }}
          CERTIFICATE_PASSWORD: ${{ secrets.CERTIFICATE_PASSWORD }}

      - name: Make
        if: startsWith(github.ref, 'refs/tags/')
        shell: bash
        run: |
          if [ "${{ runner.os }}" == "macOS" ]; then
            pnpm make -- --arch=universal
          else
            pnpm make
          fi
        env:
          APPLE_ID: ${{ secrets.APPLE_ID }}
          APPLE_ID_PASSWORD: ${{ secrets.APPLE_ID_PASSWORD }}

      # Core22 and snapcraft are now handled by the action-build step below

      - name: Get version from package.json (Windows)
        if: startsWith(github.ref, 'refs/tags/') && runner.os == 'Windows'
        id: version
        run: |
          $version = pnpm pkg get version
          echo "VERSION=$version" >> $env:GITHUB_OUTPUT
        shell: powershell
      - name: Get version from package.json (Unix)
        if: startsWith(github.ref, 'refs/tags/') && runner.os != 'Windows'
        id: version_unix
        run: |
          VERSION=$(pnpm pkg get version | tr -d '"')
          echo "VERSION=$VERSION" >> $GITHUB_OUTPUT
        shell: bash
      - name: Sign Windows Executable with eSigner
        if: matrix.os == 'windows-latest' && startsWith(github.ref, 'refs/tags/')
        uses: sslcom/esigner-codesign@develop
        with:
          command: sign
          username: ${{ secrets.ES_USERNAME }}
          password: ${{ secrets.ES_PASSWORD }}
          credential_id: ${{ secrets.CREDENTIAL_ID }}
          totp_secret: ${{ secrets.ES_TOTP_SECRET }}
          file_path: ${{ github.workspace }}/out/make/squirrel.windows/x64/Swach-${{ steps.version.outputs.VERSION }}.Setup.exe
          override: true
          malware_block: false
          environment_name: PROD
      - name: Debug DEB contents (amd64)
        if: startsWith(matrix.os, 'ubuntu') && runner.arch == 'X64' && startsWith(github.ref, 'refs/tags/')
        run: |
          DEB_FILE="out/make/deb/x64/swach_${{ steps.version_unix.outputs.VERSION }}_amd64.deb"
          echo "Examining DEB file: $DEB_FILE"
          dpkg-deb -c "$DEB_FILE" | head -20
          echo ""
          echo "Looking for executable:"
          dpkg-deb -c "$DEB_FILE" | grep -E -i "(swach|Swach|executable|bin/)"
      
      - name: Prepare snapcraft.yaml for build (amd64)
        if: startsWith(matrix.os, 'ubuntu') && runner.arch == 'X64' && startsWith(github.ref, 'refs/tags/')
        run: |
          VERSION=${{ steps.version_unix.outputs.VERSION }}
          sed -i "s/\${SNAP_VERSION}/$VERSION/g" snapcraft.yaml
          cat snapcraft.yaml
      
      - name: Build Snap from DEB (amd64)
        if: startsWith(matrix.os, 'ubuntu') && runner.arch == 'X64' && startsWith(github.ref, 'refs/tags/')
        id: build-snap-amd64
        uses: snapcore/action-build@v1
        env:
          SNAPCRAFT_BUILD_ENVIRONMENT: lxd
      
      - name: Move snap to out/make (amd64)
        if: startsWith(matrix.os, 'ubuntu') && runner.arch == 'X64' && startsWith(github.ref, 'refs/tags/')
        run: |
          mkdir -p out/make
          mv ${{ steps.build-snap-amd64.outputs.snap }} out/make/
      - name: Debug DEB contents (arm64)
        if: startsWith(matrix.os, 'ubuntu') && runner.arch == 'ARM64' && startsWith(github.ref, 'refs/tags/')
        run: |
          DEB_FILE="out/make/deb/arm64/swach_${{ steps.version_unix.outputs.VERSION }}_arm64.deb"
          echo "Examining DEB file: $DEB_FILE"
          dpkg-deb -c "$DEB_FILE" | head -20
          echo ""
          echo "Looking for executable:"
          dpkg-deb -c "$DEB_FILE" | grep -E -i "(swach|Swach|executable|bin/)"
      
      - name: Prepare snapcraft.yaml for build (arm64)
        if: startsWith(matrix.os, 'ubuntu') && runner.arch == 'ARM64' && startsWith(github.ref, 'refs/tags/')
        run: |
          VERSION=${{ steps.version_unix.outputs.VERSION }}
          sed -i "s/\${SNAP_VERSION}/$VERSION/g" snapcraft.yaml
          cat snapcraft.yaml
      
      - name: Build Snap from DEB (arm64)
        if: startsWith(matrix.os, 'ubuntu') && runner.arch == 'ARM64' && startsWith(github.ref, 'refs/tags/')
        id: build-snap-arm64
        uses: snapcore/action-build@v1
        env:
          SNAPCRAFT_BUILD_ENVIRONMENT: lxd
      
      - name: Move snap to out/make (arm64)
        if: startsWith(matrix.os, 'ubuntu') && runner.arch == 'ARM64' && startsWith(github.ref, 'refs/tags/')
        run: |
          mkdir -p out/make
          mv ${{ steps.build-snap-arm64.outputs.snap }} out/make/
      - name: Install Snapcraft for Upload
        if: startsWith(matrix.os, 'ubuntu') && startsWith(github.ref, 'refs/tags/')
        run: |
          sudo snap install snapcraft --classic
      
      - name: Publish Snap to Snap Store
        if: startsWith(matrix.os, 'ubuntu') && startsWith(github.ref, 'refs/tags/')
        run: |
          if [[ "${{ runner.arch }}" == "ARM64" ]]; then
            SNAP_ARCH="arm64"
          else
            SNAP_ARCH="amd64"
          fi
          snapcraft upload $(find out/make/ -name "swach_*_${SNAP_ARCH}.snap") --release latest/stable
        env:
          SNAPCRAFT_STORE_CREDENTIALS: ${{ secrets.SNAPCRAFT_TOKEN }}
      - name: GitHub release
        uses: softprops/action-gh-release@v1
        if: startsWith(github.ref, 'refs/tags/')
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        with:
          files: |
            out/**/*.deb
            out/**/*.dmg
            out/**/*Setup.exe
            out/**/*.rpm
            out/**/*.zip
            out/**/*.snap
      - name: Create a Sentry.io release
        uses: tclindner/sentry-releases-action@v1.3.0
        if: matrix.os == 'ubuntu-24.04'
        env:
          SENTRY_AUTH_TOKEN: ${{ secrets.SENTRY_AUTH_TOKEN }}
          SENTRY_ORG: ship-shape-consulting-llc
          SENTRY_PROJECT: swach
        with:
          tagName: ${{ github.ref }}
          environment: production
          sourceMapOptions: '{"include": ["dist/assets"], "urlPrefix": "~/dist/assets"}'