donutbrowser/.github/workflows/release.yml

name: Release

on:
  push:
    tags:
      - "v*"

env:
  TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
  TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
  STABLE_RELEASE: "true"

jobs:
  security-scan:
    name: Security Vulnerability Scan
    uses: "google/osv-scanner-action/.github/workflows/osv-scanner-reusable.yml@e69cc6c86b31f1e7e23935bbe7031b50e51082de" # v2.0.2
    with:
      scan-args: |-
        -r
        --skip-git
        --lockfile=pnpm-lock.yaml
        --lockfile=src-tauri/Cargo.lock
        --lockfile=nodecar/pnpm-lock.yaml
        ./
    permissions:
      security-events: write
      contents: read
      actions: read

  lint-js:
    name: Lint JavaScript/TypeScript
    uses: ./.github/workflows/lint-js.yml
    secrets: inherit

  lint-rust:
    name: Lint Rust
    uses: ./.github/workflows/lint-rs.yml
    secrets: inherit

  release:
    needs: [security-scan, lint-js, lint-rust]
    permissions:
      contents: write
    strategy:
      fail-fast: false
      matrix:
        include:
          - platform: "macos-latest"
            args: "--target aarch64-apple-darwin"
            arch: "aarch64"
            target: "aarch64-apple-darwin"
            pkg_target: "latest-macos-arm64"
            nodecar_script: "build:mac-aarch64"
          - platform: "macos-latest"
            args: "--target x86_64-apple-darwin"
            arch: "x86_64"
            target: "x86_64-apple-darwin"
            pkg_target: "latest-macos-x64"
            nodecar_script: "build:mac-x86_64"
          - platform: "ubuntu-22.04"
            args: "--target x86_64-unknown-linux-gnu"
            arch: "x86_64"
            target: "x86_64-unknown-linux-gnu"
            pkg_target: "latest-linux-x64"
            nodecar_script: "build:linux-x64"
          - platform: "ubuntu-22.04"
            args: "--target aarch64-unknown-linux-gnu"
            arch: "aarch64"
            target: "aarch64-unknown-linux-gnu"
            pkg_target: "latest-linux-arm64"
            nodecar_script: "build:linux-arm64"
          # Future platforms can be added here:
          # - platform: "windows-latest"
          #   args: "--target x86_64-pc-windows-msvc"
          #   arch: "x86_64"
          #   target: "x86_64-pc-windows-msvc"
          #   pkg_target: "latest-win-x64"
          #   nodecar_script: "build:win-x64"
          # - platform: "windows-latest"
          #   args: "--target aarch64-pc-windows-msvc"
          #   arch: "aarch64"
          #   target: "aarch64-pc-windows-msvc"
          #   pkg_target: "latest-win-arm64"
          #   nodecar_script: "build:win-arm64"

    runs-on: ${{ matrix.platform }}
    steps:
      - uses: actions/checkout@v4

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version-file: .node-version

      - name: Setup pnpm
        uses: pnpm/action-setup@v4

      - name: Setup Rust
        uses: dtolnay/rust-toolchain@stable
        with:
          targets: ${{ matrix.target }}

      - name: Check and Update Repository URLs (Ubuntu ARM64 only)
        if: matrix.platform == 'ubuntu-22.04' && matrix.arch == 'aarch64'
        run: |
          echo "Checking repository links..."
          if ! curl -s --head https://security.ubuntu.com/ubuntu/dists/jammy/main/binary-arm64/Packages | grep "200 OK"; then
            echo "Repository link invalid. Updating mirrors..."
            sudo apt-get update --fix-missing
          fi

      - name: Install dependencies (Ubuntu only)
        if: matrix.platform == 'ubuntu-22.04'
        run: |
          sudo apt-get update
          sudo apt-get install -y libwebkit2gtk-4.1-dev libgtk-3-dev libayatana-appindicator3-dev librsvg2-dev pkg-config
          # Install cross-compilation tools for ARM64
          if [[ "${{ matrix.arch }}" == "aarch64" ]]; then
            sudo dpkg --add-architecture arm64 || true  # Prevent failure if architecture is already added
            sudo apt-get update || sudo apt-get update --fix-missing
            sudo apt-get install -y gcc-aarch64-linux-gnu g++-aarch64-linux-gnu
            sudo apt-get install -y libwebkit2gtk-4.1-dev:arm64 libgtk-3-dev:arm64 libayatana-appindicator3-dev:arm64 librsvg2-dev:arm64 || echo "Package fetch failed for ARM64 dependencies."
            sudo apt-get install -y libglib2.0-dev:arm64 libcairo2-dev:arm64 libpango1.0-dev:arm64 libgdk-pixbuf2.0-dev:arm64 libatk1.0-dev:arm64 || echo "Package fetch failed for ARM64 dependencies."
          fi

      - name: Setup cross-compilation environment (Ubuntu ARM64 only)
        if: matrix.platform == 'ubuntu-22.04' && matrix.arch == 'aarch64'
        run: |
          echo "CC_aarch64_unknown_linux_gnu=aarch64-linux-gnu-gcc" >> $GITHUB_ENV
          echo "CXX_aarch64_unknown_linux_gnu=aarch64-linux-gnu-g++" >> $GITHUB_ENV
          echo "AR_aarch64_unknown_linux_gnu=aarch64-linux-gnu-ar" >> $GITHUB_ENV
          echo "CARGO_TARGET_AARCH64_UNKNOWN_LINUX_GNU_LINKER=aarch64-linux-gnu-gcc" >> $GITHUB_ENV
          echo "PKG_CONFIG_SYSROOT_DIR=/usr" >> $GITHUB_ENV
          echo "PKG_CONFIG_PATH=/usr/lib/aarch64-linux-gnu/pkgconfig:/usr/share/pkgconfig" >> $GITHUB_ENV
          echo "PKG_CONFIG_ALLOW_CROSS=1" >> $GITHUB_ENV

      - name: Rust cache
        uses: swatinem/rust-cache@v2
        with:
          workdir: ./src-tauri

      - name: Install frontend dependencies
        run: pnpm install --frozen-lockfile

      - name: Install nodecar dependencies
        working-directory: ./nodecar
        run: |
          pnpm install --frozen-lockfile

      - name: Build nodecar sidecar
        shell: bash
        working-directory: ./nodecar
        run: |
          pnpm run ${{ matrix.nodecar_script }}

      - name: Copy nodecar binary to Tauri binaries
        shell: bash
        run: |
          mkdir -p src-tauri/binaries
          if [[ "${{ matrix.platform }}" == "windows-latest" ]]; then
            cp nodecar/dist/nodecar.exe src-tauri/binaries/nodecar-${{ matrix.target }}.exe
          else
            cp nodecar/dist/nodecar src-tauri/binaries/nodecar-${{ matrix.target }}
          fi

      - name: Build frontend
        run: pnpm build

      - name: Build Tauri app
        uses: tauri-apps/tauri-action@v0
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          GITHUB_REF_NAME: ${{ github.ref_name }}
        with:
          tagName: ${{ github.ref_name }}
          releaseName: "Donut Browser ${{ github.ref_name }}"
          releaseBody: "See the assets to download this version and install."
          releaseDraft: false
          prerelease: false
          args: ${{ matrix.args }}