release-tauri.yml

name: Release BenchMesh (Tauri)

# Builds the self-contained desktop app (Rust + Tauri, no Python/Node runtime needed)
# for Linux, Windows and macOS and attaches the installers to a DRAFT GitHub release.
# Review the draft, then publish it manually.
#
# Updates: every bundle is signed with the updater key (secrets TAURI_SIGNING_PRIVATE_KEY /
# _PASSWORD; public key in crates/benchmesh-app/tauri.conf.json) and a `latest.json` manifest is
# attached. Installed apps read it from the latest *published* release at start
# (crates/benchmesh-app/src/update.rs), so publishing the draft is what offers the update.

on:
  push:
    tags:
      - 'v*.*.*'
  workflow_dispatch:
    inputs:
      version:
        description: 'Version for a manual draft build (e.g. 0.1.0)'
        required: true
        default: '0.0.0'

permissions:
  contents: write  # create the draft release and upload installers

env:
  CARGO_TERM_COLOR: always

jobs:
  test:
    runs-on: ubuntu-22.04
    steps:
      - uses: actions/checkout@v4
      - uses: dtolnay/rust-toolchain@stable
        with:
          components: clippy
      - uses: Swatinem/rust-cache@v2
      - name: Rust lint + tests (incl. capture replay)
        run: |
          cargo clippy --all-targets -- -D warnings
          cargo test
          cargo run -q -p bm-devicedef -- validate devices
      - uses: actions/setup-node@v4
        with:
          node-version: '20'
          cache: 'npm'
          cache-dependency-path: frontend/package-lock.json
      - name: Frontend tests
        working-directory: frontend
        run: |
          npm ci
          npx vitest run --reporter=dot

  build:
    # Builds run alongside the tests; check that `test` passed before publishing the draft.
    strategy:
      fail-fast: false
      matrix:
        include:
          - os: ubuntu-22.04
            args: '--bundles deb,appimage'
          - os: ubuntu-22.04-arm  # 64-bit ARM: Raspberry Pi 4 / 5 with 64-bit Raspberry Pi OS, ARM servers
            args: '--bundles deb,appimage'
          - os: windows-latest
            args: '--bundles nsis'
          - os: macos-latest
            args: '--target aarch64-apple-darwin --bundles app,dmg'  # app: the .app.tar.gz updates use
            rust_target: aarch64-apple-darwin
          - os: macos-latest  # Apple-silicon runner cross-builds Intel (macos-13 runners are retired)
            args: '--target x86_64-apple-darwin --bundles app,dmg'
            rust_target: x86_64-apple-darwin
    runs-on: ${{ matrix.os }}
    steps:
      - uses: actions/checkout@v4

      - name: Linux build dependencies
        if: runner.os == 'Linux'
        run: |
          sudo apt-get update
          sudo apt-get install -y libwebkit2gtk-4.1-dev libayatana-appindicator3-dev librsvg2-dev patchelf

      - uses: dtolnay/rust-toolchain@stable
        with:
          targets: ${{ matrix.rust_target }}
      - uses: Swatinem/rust-cache@v2
        with:
          key: ${{ matrix.os }}-${{ matrix.rust_target }}
      - uses: taiki-e/install-action@v2
        with:
          tool: tauri-cli@2.12

      - uses: actions/setup-node@v4
        with:
          node-version: '20'
          cache: 'npm'
          cache-dependency-path: frontend/package-lock.json
      - name: Build the UI (bundled into the app)
        working-directory: frontend
        run: |
          npm ci
          npm run build

      - name: Set app version
        shell: bash
        run: |
          if [[ "$GITHUB_REF" == refs/tags/v* ]]; then V="${GITHUB_REF#refs/tags/v}"; else V="${{ github.event.inputs.version }}"; fi
          echo "APP_VERSION=$V" >> "$GITHUB_ENV"
          node -e "const f='crates/benchmesh-app/tauri.conf.json';const c=require('./'+f);c.version=process.argv[1];require('fs').writeFileSync(f,JSON.stringify(c,null,2)+'\n')" "$V"

      - uses: tauri-apps/tauri-action@v0
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
          TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
        with:
          projectPath: crates/benchmesh-app
          tauriScript: cargo tauri
          args: ${{ matrix.args }}
          tagName: ${{ github.ref_type == 'tag' && github.ref_name || format('v{0}', github.event.inputs.version) }}
          releaseName: 'BenchMesh v__VERSION__'
          releaseBody: |
            BenchMesh desktop app - Rust backend + Tauri. Self-contained: no Python or Node.js installation required.
            Download page with install help: https://benchmesh.online/download

            ## Downloads
            - **Windows 10/11 (x64):** `BenchMesh_<version>_x64-setup.exe`
            - **macOS, Apple silicon (M1 and later):** `BenchMesh_<version>_aarch64.dmg`
            - **macOS, Intel:** `BenchMesh_<version>_x64.dmg`
            - **Linux (x64), any distribution:** `BenchMesh_<version>_amd64.AppImage`
            - **Debian / Ubuntu:** `BenchMesh_<version>_amd64.deb`
            - **Linux 64-bit ARM (Raspberry Pi 4 / 5 with 64-bit Raspberry Pi OS):** `BenchMesh_<version>_arm64.deb`,
              `BenchMesh_<version>_aarch64.AppImage`

            The installers are not code-signed yet, so the operating system warns on first start.

            ### Windows
            SmartScreen may say "Windows protected your PC": choose **More info → Run anyway**.

            ### macOS
            The app is not notarised by Apple. After dragging **BenchMesh** from the disk image into
            **Applications**, macOS may refuse to open it ("BenchMesh is damaged and can't be opened" or
            "Apple could not verify BenchMesh"). Either:
            1. open **Terminal** and run `xattr -dr com.apple.quarantine /Applications/BenchMesh.app`,
               then start BenchMesh normally; or
            2. try to open BenchMesh once, then go to **System Settings → Privacy & Security**, scroll to
               "BenchMesh was blocked…" and click **Open Anyway** (confirm with your password).
               On macOS 14 and older, Control-click the app → **Open** → **Open** also works.
            This is needed once; later updates install from inside the app.
            LAN instruments (macOS 15+): allow BenchMesh's Local Network access when asked, or later in
            System Settings → Privacy & Security → Local Network.
            USB instruments: USBTMC instruments need no driver; USB-serial adapters (CH340, CP210x,
            FTDI) are supported by current macOS - older versions may need the chip vendor's driver.

            ### Linux
            AppImage: `chmod +x BenchMesh_*.AppImage` and run it; it adds itself to the applications
            menu (and the dock shows its icon). USB-TMC instruments (oscilloscopes, generators) need one
            udev rule and serial instruments the `dialout` group - the app shows the command to copy, or
            see https://benchmesh.online/docs/linux
            `.deb`: `sudo apt install ./BenchMesh_*_amd64.deb` (`_arm64.deb` on a Raspberry Pi; updates come
            from the releases page).

            ### Headless (any OS, e.g. a Raspberry Pi next to the bench)
            `benchmesh --headless --remote-password '<at least 10 characters>'` runs BenchMesh without a
            window; use it from a browser on another computer (the addresses are printed). Instruments →
            System shows the computer's resources, restarts or shuts BenchMesh down, makes it start with
            the computer and installs new versions (Check for updates; the AppImage, Windows and macOS
            update themselves, a .deb gets the apt command). See https://benchmesh.online/docs/headless

            User data stays in `~/.benchmesh` (config.yaml, recordings.db, flows).
          releaseDraft: true
          prerelease: false