release.yml

name: Release

on:
  push:
    tags: ['v*']
  workflow_dispatch:
    inputs:
      version:
        description: 'Version to release (e.g. 0.1.0)'
        required: true

# A called workflow can only ever hold a subset of its caller's permissions, so
# the distribute job's `pull-requests: write` has to be granted here too — it
# opens the PR carrying the refreshed distribution/ manifests. Without this the
# push succeeds and `gh pr create` is denied, which the script swallows, so the
# branch would appear with no PR behind it.
permissions:
  contents: write
  pull-requests: write

jobs:
  # 1) Create the GitHub Release (draft) up front so each per-platform build job
  #    uploads straight to it via the Releases API (pattern from pairux.com).
  create-release:
    runs-on: ubuntu-latest
    outputs:
      tag: ${{ steps.v.outputs.tag }}
      version: ${{ steps.v.outputs.version }}
    steps:
      - uses: actions/checkout@v5
      - id: v
        run: |
          if [ -n "${{ github.event.inputs.version }}" ]; then V="${{ github.event.inputs.version }}"; else V="${GITHUB_REF_NAME#v}"; fi
          echo "version=$V" >> "$GITHUB_OUTPUT"
          echo "tag=v$V" >> "$GITHUB_OUTPUT"
      - name: Create draft release
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          TAG="${{ steps.v.outputs.tag }}"
          if gh release view "$TAG" >/dev/null 2>&1; then
            gh release edit "$TAG" --draft
          else
            gh release create "$TAG" --draft --title "TronBrowser $TAG" --generate-notes
          fi

  # 2) Build each platform's artifacts on its own runner and upload them.
  build:
    needs: create-release
    strategy:
      fail-fast: false
      matrix:
        include:
          - { os: ubuntu-latest, platform: linux }
          - { os: macos-latest, platform: macos }
          - { os: windows-latest, platform: windows }
    runs-on: ${{ matrix.os }}
    steps:
      - uses: actions/checkout@v5
      # Runners ship Node preinstalled; these steps only run scripts + packaging,
      # so we skip setup-node (its packageManager:pnpm detection causes cache noise).

      - name: Sync version
        run: node scripts/set-version.mjs "${{ needs.create-release.outputs.version }}"

      # The automation runtime (tron snapshot/analyze/run/mcp/automate) is the
      # compiled browser-core, agent-runtime and sdk packages, which
      # build-release.sh stages only when it can build them. That takes pnpm and
      # the workspace's dev dependencies; without this step the stage is skipped
      # with a one-line note and every release ships without `sdk/`.
      # Same setup ci.yml uses. Not corepack: `corepack enable` symlinks into
      # /usr/local/bin, which the ubuntu runner user cannot write (EACCES), while
      # the macOS runner can, so the linux build failed and macOS passed.
      - uses: pnpm/action-setup@v6
        if: matrix.platform != 'windows'
      - uses: actions/setup-node@v5
        if: matrix.platform != 'windows'
        with:
          node-version-file: .nvmrc
      - name: Install workspace (for the automation runtime)
        if: matrix.platform != 'windows'
        run: pnpm install --frozen-lockfile --filter @tronbrowser/sdk...

      - name: Package (linux/macos)
        if: matrix.platform != 'windows'
        run: bash apps/desktop/scripts/build-release.sh "v${{ needs.create-release.outputs.version }}" ${{ matrix.platform }}

      - name: Check the automation runtime is in the archive
        if: matrix.platform != 'windows'
        run: |
          if [ "${{ matrix.platform }}" = linux ]; then list="tar -tzf dist/tronbrowser-linux-x64.tar.gz"; else list="unzip -Z1 dist/tronbrowser-macos.zip"; fi
          $list | grep -q 'sdk/automate-bin.js' \
            || { echo "::error::release archive has no sdk/automate-bin.js (automation runtime was not staged)"; exit 1; }

      - name: Package (linux deb + rpm + AppImage)
        if: matrix.platform == 'linux'
        run: |
          curl -sSfL "https://github.com/goreleaser/nfpm/releases/download/v2.41.0/nfpm_2.41.0_amd64.deb" -o /tmp/nfpm.deb
          sudo dpkg -i /tmp/nfpm.deb
          sudo apt-get update -qq && sudo apt-get install -y -qq librsvg2-bin
          # deb + rpm for amd64 AND arm64 (arm64 = Librem 5 / PinePhone / postmarketOS)
          bash distribution/deb-rpm/build.sh "v${{ needs.create-release.outputs.version }}"
          bash distribution/appimage/build.sh "v${{ needs.create-release.outputs.version }}"

      - name: Package (Ubuntu Touch click)
        if: matrix.platform == 'linux'
        continue-on-error: true   # non-fatal: never block a release on the UT click
        run: |
          pip install --user clickable-ut || true
          export PATH="$HOME/.local/bin:$PATH"
          bash distribution/ubuntu-touch/build.sh "v${{ needs.create-release.outputs.version }}" arm64 || true

      - name: Package (windows)
        if: matrix.platform == 'windows'
        shell: pwsh
        run: |
          $stage = "dist/stage/tronbrowser"
          New-Item -ItemType Directory -Force -Path "$stage/extensions" | Out-Null
          Copy-Item apps/desktop/launcher/tronbrowser "$stage/tronbrowser"
          Copy-Item apps/desktop/launcher/tronbrowser.cmd "$stage/tronbrowser.cmd"
          Copy-Item apps/desktop/launcher/tron-tor-helper "$stage/tron-tor-helper"
          Copy-Item apps/desktop/launcher/tron-windows.py "$stage/tron-windows.py"
          Copy-Item apps/desktop/launcher/tron-w3bs.ps1 "$stage/tron-w3bs.ps1"
          Copy-Item -Recurse apps/desktop/extensions/ai-sidebar "$stage/extensions/ai-sidebar"
          # Same wholesale-copy problem build-release.sh has: the vitest files
          # next to the extension sources ride along into the zip. Chrome never
          # loads them, and they import vitest, which cannot resolve from an
          # unbundled extension. Drop them.
          Get-ChildItem "$stage/extensions/ai-sidebar" -Filter *.test.js -Recurse | Remove-Item -Force
          Copy-Item LICENSE "$stage/LICENSE"
          "v${{ needs.create-release.outputs.version }}" | Out-File -Encoding ascii "$stage/VERSION"
          New-Item -ItemType Directory -Force -Path dist | Out-Null
          Compress-Archive -Path "dist/stage/tronbrowser" -DestinationPath "dist/tronbrowser-win-x64.zip" -Force

      - name: Upload to release
        shell: bash
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          shopt -s nullglob
          assets=(dist/tronbrowser-*.tar.gz dist/tronbrowser-*.zip dist/*.deb dist/*.rpm dist/*.AppImage dist/*.click)
          gh release upload "${{ needs.create-release.outputs.tag }}" "${assets[@]}" --clobber

  # 3) Publish (un-draft) once every platform has uploaded.
  publish:
    needs: [create-release, build]
    runs-on: ubuntu-latest
    steps:
      - name: Un-draft the release
        env:
          GH_TOKEN: ${{ github.token }}
        run: gh release edit "${{ needs.create-release.outputs.tag }}" --draft=false --repo "${{ github.repository }}"

  # 4) Push the release out to the downstream package managers.
  #
  # This is a direct call, NOT submit-packages.yml's own `release: [published]`
  # trigger. The un-draft above uses GITHUB_TOKEN, and GitHub raises no workflow
  # events for what a GITHUB_TOKEN does, so that trigger never fired once in the
  # three months it was wired up and no channel was ever updated past 0.1.0.
  # Calling the workflow keeps that guarantee without needing a PAT.
  distribute:
    needs: [create-release, publish]
    uses: ./.github/workflows/submit-packages.yml
    secrets: inherit
    with:
      version: ${{ needs.create-release.outputs.version }}
      dry_run: false
      package_managers: all