build.yml

name: Build and Release Tauri App

on:
  push:
    branches:
      - main
  workflow_dispatch:
    inputs:
      tag:
        description: 'Version tag (e.g., v0.3.0)'
        required: false
        type: string

env:
  NODE_VERSION: '20'
  RUST_VERSION: 'stable'
  LUMIS_REPO: 'melandlabs/lumis'

jobs:
  get-version:
    runs-on: ubuntu-latest
    outputs:
      version: ${{ steps.version.outputs.version }}
      checkout_ref: ${{ steps.version.outputs.checkout_ref }}
    steps:
      - id: version
        run: |
          if [ "${{ github.event.inputs.tag }}" != "" ]; then
            echo "version=${{ github.event.inputs.tag }}" >> $GITHUB_OUTPUT
            echo "checkout_ref=refs/tags/${{ github.event.inputs.tag }}" >> $GITHUB_OUTPUT
          else
            echo "version=0.0.0-test" >> $GITHUB_OUTPUT
            echo "checkout_ref=refs/heads/main" >> $GITHUB_OUTPUT
          fi

  build-tauri-macos:
    needs: get-version
    if: needs.get-version.outputs.version != ''
    runs-on: macos-latest
    steps:
      - name: Checkout release repo
        uses: actions/checkout@v4

      - name: Clone lumis source code
        run: |
          git clone https://x-access-token:${{ secrets.LUMIS_TOKEN }}@github.com/${{ env.LUMIS_REPO }}.git lumis
          cd lumis
          git checkout ${{ needs.get-version.outputs.checkout_ref }}

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: ${{ env.NODE_VERSION }}

      - name: Install pnpm
        uses: pnpm/action-setup@v2
        with:
          version: 9

      - name: Add pnpm to PATH
        run: |
          echo "$HOME/.local/bin" >> $GITHUB_PATH
          echo "PNPM_HOME=$HOME/.local" >> $GITHUB_ENV

      - name: Setup Python
        uses: actions/setup-python@v5
        with:
          python-version: '3.12'

      - name: Setup Rust
        uses: dtolnay/rust-toolchain@stable
        with:
          toolchain: ${{ env.RUST_VERSION }}

      - name: Install Rust targets
        run: |
          rustup target add aarch64-apple-darwin
          rustup target add x86_64-apple-darwin

      - name: Get pnpm store directory
        run: |
          echo "STORE_PATH=$(pnpm store path --silent)" >> $GITHUB_ENV

      - name: Setup pnpm cache
        uses: actions/cache@v3
        with:
          path: ${{ env.STORE_PATH }}
          key: ${{ runner.os }}-pnpm-store-${{ hashFiles('lumis/**/pnpm-lock.yaml') }}
          restore-keys: |
            ${{ runner.os }}-pnpm-store-

      - name: Install dependencies
        working-directory: ./lumis
        run: pnpm install --frozen-lockfile --ignore-scripts

      - name: Rebuild native modules for Tauri
        working-directory: ./lumis
        run: |
          pnpm rebuild better-sqlite3
          cd node_modules/@photon-ai/imessage-kit && pnpm rebuild

      - name: Create .env file
        working-directory: ./lumis/apps/web
        run: |
          cp .env.example .env
          # Remove POSTGRES_URL to skip database migration in CI
          grep -v '^POSTGRES_URL=' .env > .env.tmp && mv .env.tmp .env

      - name: Import Apple Certificate and Intermediate Certificates
        env:
          APPLE_CERTIFICATE: "${{ secrets.APPLE_CERTIFICATE }}"
          APPLE_CERTIFICATE_PASSWORD: "${{ secrets.APPLE_CERTIFICATE_PASSWORD }}"
        run: |
          # Create a new keychain
          KEYCHAIN_PATH=$RUNNER_TEMP/app-signing.keychain-db
          security create-keychain -p "" $KEYCHAIN_PATH
          security set-keychain-settings -lut 21600 $KEYCHAIN_PATH
          security unlock-keychain -p "" $KEYCHAIN_PATH

          # Import the Apple certificate
          echo "$APPLE_CERTIFICATE" | base64 --decode > cert.p12
          security import cert.p12 -P "$APPLE_CERTIFICATE_PASSWORD" -A -k $KEYCHAIN_PATH
          rm cert.p12

          # Download and import Apple intermediate certificates (not available in CI)
          curl -s -o /tmp/AppleWWDRCAG3.cer https://www.apple.com/certificateauthority/AppleWWDRCAG3.cer
          curl -s -o /tmp/DeveloperIDG2CA.cer https://www.apple.com/certificateauthority/DeveloperIDG2CA.cer
          security import /tmp/AppleWWDRCAG3.cer -A -k $KEYCHAIN_PATH
          security import /tmp/DeveloperIDG2CA.cer -A -k $KEYCHAIN_PATH

          # List keychains to ensure system can access certificates
          security list-keychain -d user -s $KEYCHAIN_PATH

      - name: Build Tauri app (Apple Silicon) without notarization
        working-directory: ./lumis/apps/web
        run: pnpm tauri:build
        env:
          APPLE_CERTIFICATE: "${{ secrets.APPLE_CERTIFICATE }}"
          APPLE_CERTIFICATE_PASSWORD: "${{ secrets.APPLE_CERTIFICATE_PASSWORD }}"
          APPLE_SIGNING_IDENTITY: "${{ secrets.APPLE_SIGNING_IDENTITY }}"
          APPLE_ID: "${{ secrets.APPLE_ID }}"
          APPLE_PASSWORD: "${{ secrets.APPLE_PASSWORD }}"
          APPLE_TEAM_ID: "${{ secrets.APPLE_TEAM_ID }}"
          APPLE_NOTARIZE: false

      - name: Deep sign all binaries in bundle
        working-directory: ./lumis/apps/web/src-tauri/target/release/bundle/macos/Lumis.app
        run: |
          # Sign all executable files, .node files, and dylib recursively
          echo "Signing all .node files..."
          find . -type f -name "*.node" -print0 | xargs -0 codesign --force --sign "${{ secrets.APPLE_SIGNING_IDENTITY }}" --options runtime --timestamp || true

          echo "Signing all .dylib files..."
          find . -type f -name "*.dylib" -print0 | xargs -0 codesign --force --sign "${{ secrets.APPLE_SIGNING_IDENTITY }}" --options runtime --timestamp || true

          echo "Signing all executable files..."
          find . -type f -perm +111 -print0 | xargs -0 codesign --force --sign "${{ secrets.APPLE_SIGNING_IDENTITY }}" --options runtime --timestamp || true

      - name: Sign specific problematic binaries
        working-directory: ./lumis/apps/web/src-tauri/target/release/bundle/macos/Lumis.app
        run: |
          # Sign all known problematic binaries in nested directories
          BINARY_PATHS=(
            "./Contents/Resources/_up_/cli-bundle/node"
            "./Contents/Resources/_up_/cli-bundle/vendor/ripgrep/arm64-darwin/rg"
            "./Contents/Resources/_up_/cli-bundle/vendor/ripgrep/arm64-darwin/ripgrep.node"
            "./Contents/Resources/_up_/.next/standalone/apps/web/cli-bundle/node"
            "./Contents/Resources/_up_/.next/standalone/apps/web/cli-bundle/vendor/ripgrep/arm64-darwin/rg"
            "./Contents/Resources/_up_/.next/standalone/apps/web/cli-bundle/vendor/ripgrep/arm64-darwin/ripgrep.node"
          )

          for BINARY in "${BINARY_PATHS[@]}"; do
            if [ -f "$BINARY" ]; then
              echo "Signing: $BINARY"
              xattr -cr "$BINARY" 2>/dev/null || true
              codesign --force --sign "${{ secrets.APPLE_SIGNING_IDENTITY }}" --options runtime --timestamp "$BINARY"
            else
              echo "File not found: $BINARY"
            fi
          done

      - name: Re-sign entire app bundle
        working-directory: ./lumis/apps/web/src-tauri/target/release/bundle/macos/Lumis.app
        run: |
          # Finally re-sign the entire app bundle
          echo "Re-signing entire app bundle..."
          xattr -cr . 2>/dev/null || true
          codesign --force --sign "${{ secrets.APPLE_SIGNING_IDENTITY }}" --options runtime --timestamp .

      - name: Rebuild DMG after signing
        working-directory: ./lumis/apps/web/src-tauri/target/release/bundle/macos
        run: |
          # Remove old DMG and rebuild with signed app
          rm -f dmg/*.dmg
          # Get app version from package.json
          VERSION=$(cat ../../../../../package.json | jq -r '.version')
          # Create new DMG with signed app
          hdiutil create -volname "Lumis" -srcfolder "Lumis.app" -ov -format UDZO "dmg/Lumis_${VERSION}_aarch64.dmg"

      - name: Notarize DMG
        run: |
          DMG_PATH=$(ls ./lumis/apps/web/src-tauri/target/release/bundle/dmg/Lumis*.dmg)
          echo "Notarizing: $DMG_PATH"
          xcrun notarytool submit "$DMG_PATH" \
            --apple-id "${{ secrets.APPLE_ID }}" \
            --password "${{ secrets.APPLE_PASSWORD }}" \
            --team-id "${{ secrets.APPLE_TEAM_ID }}" \
            --wait

      - name: Find DMG file
        id: dmg
        working-directory: ./lumis/apps/web/src-tauri/target/release/bundle/dmg
        run: echo "path=$(ls Lumis*.dmg)" >> $GITHUB_OUTPUT

      - name: Upload Apple Silicon DMG
        uses: actions/upload-artifact@v4
        with:
          name: lumis-dmg-arm64
          path: ./lumis/apps/web/src-tauri/target/release/bundle/dmg/${{ steps.dmg.outputs.path }}

  build-tauri-linux:
    needs: get-version
    if: needs.get-version.outputs.version != ''
    runs-on: ubuntu-22.04
    steps:
      - name: Checkout release repo
        uses: actions/checkout@v4

      - name: Clone lumis source code
        run: |
          git clone https://x-access-token:${{ secrets.LUMIS_TOKEN }}@github.com/${{ env.LUMIS_REPO }}.git lumis
          cd lumis
          git checkout ${{ needs.get-version.outputs.checkout_ref }}

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: ${{ env.NODE_VERSION }}

      - name: Install pnpm
        uses: pnpm/action-setup@v2
        with:
          version: 9

      - name: Add pnpm to PATH
        run: |
          echo "$HOME/.local/bin" >> $GITHUB_PATH
          echo "PNPM_HOME=$HOME/.local" >> $GITHUB_ENV

      - name: Setup Rust
        uses: dtolnay/rust-toolchain@stable
        with:
          toolchain: ${{ env.RUST_VERSION }}

      - name: Install Rust target
        run: |
          rustup target add x86_64-unknown-linux-gnu

      - name: Install dependencies
        working-directory: ./lumis
        run: pnpm install --frozen-lockfile --ignore-scripts

      - name: Rebuild native modules for Tauri
        working-directory: ./lumis
        run: |
          pnpm rebuild better-sqlite3
          cd node_modules/@photon-ai/imessage-kit && pnpm rebuild

      - name: Create .env file
        working-directory: ./lumis/apps/web
        run: |
          cp .env.example .env
          # Remove POSTGRES_URL to skip database migration in CI
          grep -v '^POSTGRES_URL=' .env > .env.tmp && mv .env.tmp .env

      - name: Install Linux build dependencies
        run: |
          sudo apt-get update
          sudo apt-get install -y libwebkit2gtk-4.1-dev libappindicator3-dev librsvg2-dev patchelf

      - name: Build Tauri app (Linux)
        working-directory: ./lumis/apps/web
        run: pnpm tauri:build

      - name: Find deb file
        id: deb
        working-directory: ./lumis/apps/web/src-tauri/target/release/bundle/deb
        run: echo "path=$(ls lumis*.deb)" >> $GITHUB_OUTPUT

      - name: Upload Linux deb
        uses: actions/upload-artifact@v4
        with:
          name: lumis-linux
          path: ./lumis/apps/web/src-tauri/target/release/bundle/deb/${{ steps.deb.outputs.path }}

  release:
    needs: [get-version, build-tauri-macos, build-tauri-linux]
    if: needs.get-version.outputs.version != ''
    runs-on: ubuntu-latest
    permissions:
      contents: write
    steps:
      - name: Download Apple Silicon DMG
        uses: actions/download-artifact@v4
        with:
          name: lumis-dmg-arm64

      - name: Download Linux deb
        uses: actions/download-artifact@v4
        with:
          name: lumis-linux

      - name: Create Release
        uses: softprops/action-gh-release@v1
        with:
          tag_name: ${{ needs.get-version.outputs.version }}
          name: 'Lumis ${{ needs.get-version.outputs.version }}'
          body: 'See the assets to download this version and install.'
          draft: true
          files: |
            Lumis*.dmg
            lumis*.deb
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Update Homebrew Cask
        run: |
          # Find DMG file
          DMG_FILE=$(ls Lumis*.dmg)

          # Extract version from filename (e.g., Lumis_0.3.0_aarch64.dmg -> 0.3.0)
          VERSION=$(echo "$DMG_FILE" | sed -E 's/Lumis_([0-9.]+)_aarch64.dmg/\1/')

          # Calculate SHA256
          SHA256=$(sha256sum "$DMG_FILE" | awk '{print $1}')

          # Update cask file
          sed -i "s/version \"[^\"]*\"/version \"$VERSION\"/" Casks/lumis.rb
          sed -i "s/sha256 \"[^\"]*\"/sha256 \"$SHA256\"/" Casks/lumis.rb

          # Commit changes
          git config --local user.email "github-actions[bot]@users.noreply.github.com"
          git config --local user.name "github-actions[bot]"
          git add Casks/lumis.rb
          git commit -m "chore: update Homebrew cask to v$VERSION" || echo "No changes to commit"

      - name: Push changes
        uses: ad-m/github-push-action@master
        with:
          github_token: ${{ secrets.GITHUB_TOKEN }}