release.yml

name: Release

on:
  push:
    tags:
      - 'v*'

jobs:
  build-mac:
    runs-on: macos-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version-file: .nvmrc
          cache: npm
      - uses: actions/cache@v4
        with:
          path: |
            ~/Library/Caches/electron
            ~/Library/Caches/electron-builder
          key: ${{ runner.os }}-electron-${{ hashFiles('package-lock.json') }}
          restore-keys: |
            ${{ runner.os }}-electron-
      - run: npm ci
      # The full gate, as on Windows: a release is never built from code that
      # fails it. npm test builds the app as its first step.
      - run: npm test
      - name: Validate mac signing secrets
        run: |
          test -n "$MAC_CSC_LINK" || { echo "MAC_CSC_LINK is missing"; exit 1; }
          test -n "$MAC_CSC_KEY_PASSWORD" || { echo "MAC_CSC_KEY_PASSWORD is missing"; exit 1; }
        env:
          MAC_CSC_LINK: ${{ secrets.MAC_CSC_LINK }}
          MAC_CSC_KEY_PASSWORD: ${{ secrets.MAC_CSC_KEY_PASSWORD }}
      - run: npx electron-builder --mac --publish always
        env:
          DEBUG: electron-osx-sign*,electron-builder
          GH_TOKEN: ${{ secrets.GH_TOKEN }}
          CSC_LINK: 'data:application/x-pkcs12;base64,${{ secrets.MAC_CSC_LINK }}'
          CSC_KEY_PASSWORD: ${{ secrets.MAC_CSC_KEY_PASSWORD }}
          APPLE_ID: ${{ secrets.APPLE_ID }}
          APPLE_APP_SPECIFIC_PASSWORD: ${{ secrets.APPLE_APP_SPECIFIC_PASSWORD }}
          APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
          EP_PRE_RELEASE: false
          # Upload into a draft. A release that is visible before every
          # platform has uploaded becomes "latest" with only some of its
          # assets, and the other platform's updater 404s on its missing
          # channel file. The publish job below flips the draft once both
          # builds have landed.
          EP_DRAFT: true

  build-windows:
    runs-on: windows-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version-file: .nvmrc
          cache: npm
      - uses: actions/cache@v4
        with:
          path: |
            ~\AppData\Local\electron\Cache
            ~\AppData\Local\electron-builder\Cache
          key: ${{ runner.os }}-electron-${{ hashFiles('package-lock.json') }}
          restore-keys: |
            ${{ runner.os }}-electron-
      - run: npm ci
      - run: npm test
      # Windows signing is optional, matching the existing release channel.
      # Electron-builder signs when credentials exist and otherwise builds unsigned.
      - run: npx electron-builder --win --publish always
        env:
          GH_TOKEN: ${{ secrets.GH_TOKEN }}
          WIN_CSC_LINK: ${{ secrets.WIN_CSC_LINK }}
          WIN_CSC_KEY_PASSWORD: ${{ secrets.WIN_CSC_KEY_PASSWORD }}
          EP_PRE_RELEASE: false
          EP_DRAFT: true

  # Only now does the release become visible to updaters, with mac and
  # Windows assets both present.
  publish:
    needs: [build-mac, build-windows]
    runs-on: ubuntu-latest
    steps:
      - name: Verify both platforms uploaded, then publish
        env:
          GH_TOKEN: ${{ secrets.GH_TOKEN }}
          TAG: ${{ github.ref_name }}
        run: |
          assets=$(gh release view "$TAG" --repo flowtricks/stacki-releases \
            --json assets --jq '[.assets[].name] | join(" ")')
          echo "assets: $assets"
          for required in latest-mac.yml latest.yml; do
            case " $assets " in
              *" $required "*) ;;
              *) echo "missing $required — refusing to publish"; exit 1 ;;
            esac
          done
          gh release edit "$TAG" --repo flowtricks/stacki-releases --draft=false --latest