release.yml

name: Release

on:
  push:
    tags:
      - "v*"
  workflow_dispatch:
    inputs:
      version:
        description: "Tag for the release (e.g. v0.1.0). Leave blank to use commit-based draft."
        required: false

permissions:
  contents: write

jobs:
  build:
    strategy:
      fail-fast: false
      matrix:
        include:
          - platform: macos-14
            args: "--target aarch64-apple-darwin"
            label: "macOS (Apple Silicon)"
            rust-target: "aarch64-apple-darwin"
          - platform: windows-latest
            args: ""
            label: "Windows"
            rust-target: ""

    runs-on: ${{ matrix.platform }}
    name: Build ${{ matrix.label }}

    steps:
      - uses: actions/checkout@v4

      - name: Setup Node
        uses: actions/setup-node@v4
        with:
          node-version: 20
          cache: npm

      - name: Setup Rust
        uses: dtolnay/rust-toolchain@stable
        with:
          targets: ${{ matrix.rust-target }}

      - name: Cache cargo
        uses: swatinem/rust-cache@v2
        with:
          workspaces: src-tauri -> target

      - name: Install Linux deps (skipped for non-linux)
        if: runner.os == 'Linux'
        run: |
          sudo apt-get update
          sudo apt-get install -y libwebkit2gtk-4.1-dev libappindicator3-dev librsvg2-dev patchelf

      - name: Install npm deps
        run: npm ci

      - name: Build Tauri app
        uses: tauri-apps/tauri-action@v0
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          # Updater signing — required for the in-app updater to verify artifacts.
          # See README "Auto-update setup" for how to generate and add these.
          TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
          TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
          # macOS ad-hoc code signing. Without an Apple Developer ID we cannot
          # notarize, but ad-hoc signing ("-") at least registers the app
          # binary with the system so Gatekeeper reports it as "unidentified
          # developer" (right-click → Open works) instead of the much scarier
          # "app is damaged and can't be opened" that an *unsigned* .app
          # downloaded via the quarantine bit triggers.
          APPLE_SIGNING_IDENTITY: ${{ matrix.platform == 'macos-14' && '-' || '' }}
        with:
          tagName: ${{ github.event.inputs.version || github.ref_name }}
          releaseName: "EchoWise ${{ github.event.inputs.version || github.ref_name }}"
          releaseBody: |
            Auto-built EchoWise release.

            **Downloads**
            - **macOS**: `.dmg` for Apple Silicon (M1/M2/M3+)
            - **Windows**: `.msi` installer and portable `.exe`

            Existing users will receive this update automatically the next
            time they open EchoWise (if signing secrets are configured).

            See the README for setup instructions.
          releaseDraft: true
          prerelease: false
          # Tauri 2 emits the signed updater bundle + a `latest.json` manifest
          # automatically when TAURI_SIGNING_PRIVATE_KEY is set.
          includeUpdaterJson: true
          args: ${{ matrix.args }}