release-app.yml

name: Release App Artifacts
on:
  push:
    tags: [v*]

jobs:
  build-artifacts:
    if: github.repository == 'mountain-loop/yaak'
    permissions:
      contents: write

    name: Build
    strategy:
      fail-fast: false
      matrix:
        include:
          - platform: "macos-latest" # for Arm-based Macs (M1 and above).
            args: '--target aarch64-apple-darwin --config ./tauri.release.conf.json --config ''{"build":{"features":["updater","license","wry"]}}'''
            yaak_arch: "arm64"
            os: "macos"
            runtime: "wry"
            targets: "aarch64-apple-darwin"
          - platform: "macos-latest" # for Intel-based Macs.
            args: '--target x86_64-apple-darwin --config ./tauri.release.conf.json --config ''{"build":{"features":["updater","license","wry"]}}'''
            yaak_arch: "x64"
            os: "macos"
            runtime: "wry"
            targets: "x86_64-apple-darwin"
          - platform: "ubuntu-22.04"
            args: '--config ./tauri.release.conf.json --config ''{"build":{"features":["updater","license","wry"]}}'''
            yaak_arch: "x64"
            os: "ubuntu"
            runtime: "wry"
            targets: ""
          - platform: "ubuntu-22.04-arm"
            args: '--config ./tauri.release.conf.json --config ''{"build":{"features":["updater","license","wry"]}}'''
            yaak_arch: "arm64"
            os: "ubuntu"
            runtime: "wry"
            targets: ""
          - platform: "ubuntu-22.04"
            args: >-
              --bundles deb
              --config ./tauri.release.conf.json
              --config '{"productName":"yaak-cef","mainBinaryName":"yaak-cef","identifier":"app.yaak.desktop.cef","build":{"features":["license","cef"]},"bundle":{"createUpdaterArtifacts":false}}'
            yaak_arch: "x64"
            os: "ubuntu"
            runtime: "cef"
            targets: ""
          - platform: "ubuntu-22.04-arm"
            args: >-
              --bundles deb
              --config ./tauri.release.conf.json
              --config '{"productName":"yaak-cef","mainBinaryName":"yaak-cef","identifier":"app.yaak.desktop.cef","build":{"features":["license","cef"]},"bundle":{"createUpdaterArtifacts":false}}'
            yaak_arch: "arm64"
            os: "ubuntu"
            runtime: "cef"
            targets: ""
          - platform: "windows-latest"
            args: '--config ./tauri.release.conf.json --config ''{"build":{"features":["updater","license","wry"]}}'''
            yaak_arch: "x64"
            os: "windows"
            runtime: "wry"
            targets: ""
          # Windows ARM64
          - platform: "windows-latest"
            args: '--target aarch64-pc-windows-msvc --config ./tauri.release.conf.json --config ''{"build":{"features":["updater","license","wry"]}}'''
            yaak_arch: "arm64"
            os: "windows"
            runtime: "wry"
            targets: "aarch64-pc-windows-msvc"
    runs-on: ${{ matrix.platform }}
    timeout-minutes: 60
    steps:
      - name: Checkout yaakapp/app
        uses: actions/checkout@v4

      - name: Setup Vite+
        uses: voidzero-dev/setup-vp@v1
        with:
          node-version: "24"
          cache: true

      - name: install Rust stable
        uses: dtolnay/rust-toolchain@stable
        with:
          targets: ${{ matrix.targets }}

      - uses: Swatinem/rust-cache@v2
        with:
          shared-key: ci
          cache-on-failure: true

      - name: Cache CEF (Linux only)
        if: matrix.os == 'ubuntu' && matrix.runtime == 'cef'
        uses: actions/cache@v4
        with:
          path: ~/.cache/tauri-cef
          key: cef-${{ runner.os }}-${{ runner.arch }}-${{ hashFiles('Cargo.lock') }}

      - name: install dependencies (Linux only)
        if: matrix.os == 'ubuntu'
        run: |
          sudo apt-get update
          sudo apt-get install -y cmake ninja-build libwebkit2gtk-4.1-dev libappindicator3-dev librsvg2-dev libnss3 patchelf xdg-utils
          # crates/yaak-wasm compiles SQLite to wasm via sqlite-wasm-rs, whose C shim
          # uses C23 [[noreturn]] and expects a freestanding wasm32 target. Ubuntu
          # 22.04 ships only clang <=15: 14 rejects the attribute, and 15 falls
          # through to host glibc headers ("bits/libc-header-start.h" not found).
          # clang-18 handles it (it is what ubuntu-24.04 uses). Install it from
          # apt.llvm.org since 22.04's repos stop at 15. Only the wasm build uses
          # this compiler, so the shipped binary keeps 22.04's glibc floor.
          wget -qO /tmp/llvm.sh https://apt.llvm.org/llvm.sh
          chmod +x /tmp/llvm.sh
          sudo /tmp/llvm.sh 18
          echo "CC_wasm32_unknown_unknown=/usr/bin/clang-18" >> "$GITHUB_ENV"
          echo "AR_wasm32_unknown_unknown=/usr/bin/llvm-ar-18" >> "$GITHUB_ENV"

      - name: Install Protoc for plugin-runtime
        uses: arduino/setup-protoc@v3
        with:
          repo-token: ${{ secrets.GITHUB_TOKEN }}

      - name: Install trusted-signing-cli (Windows only)
        if: matrix.os == 'windows'
        shell: pwsh
        run: |
          $ErrorActionPreference = 'Stop'
          $dir = "$env:USERPROFILE\trusted-signing"
          New-Item -ItemType Directory -Force -Path $dir | Out-Null
          $url = "https://github.com/Levminer/trusted-signing-cli/releases/download/0.8.0/trusted-signing-cli.exe"
          $exe = Join-Path $dir "trusted-signing-cli.exe"
          Invoke-WebRequest -Uri $url -OutFile $exe
          echo $dir >> $env:GITHUB_PATH
          & $exe --version

      - run: vp install
      - run: npm run bootstrap
        env:
          YAAK_TARGET_ARCH: ${{ matrix.yaak_arch }}
      - run: npm run lint
      - name: Run JS Tests
        run: vp test
      - name: Run Rust Tests
        run: cargo test --all --exclude yaak-cli --features yaak-app-client/wry

      - name: Set version
        run: npm run replace-version
        env:
          YAAK_VERSION: ${{ github.ref_name }}

      - name: Sign vendored binaries (macOS only)
        if: matrix.os == 'macos'
        env:
          APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }}
          APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
          APPLE_SIGNING_IDENTITY: ${{ secrets.APPLE_SIGNING_IDENTITY }}
          KEYCHAIN_PASSWORD: ${{ secrets.KEYCHAIN_PASSWORD }}
        run: |
          # Create keychain
          KEYCHAIN_PATH=$RUNNER_TEMP/app-signing.keychain-db
          security create-keychain -p "$KEYCHAIN_PASSWORD" $KEYCHAIN_PATH
          security set-keychain-settings -lut 21600 $KEYCHAIN_PATH
          security unlock-keychain -p "$KEYCHAIN_PASSWORD" $KEYCHAIN_PATH

          # Import certificate
          echo "$APPLE_CERTIFICATE" | base64 --decode > certificate.p12
          security import certificate.p12 -P "$APPLE_CERTIFICATE_PASSWORD" -A -t cert -f pkcs12 -k $KEYCHAIN_PATH
          security list-keychain -d user -s $KEYCHAIN_PATH

          # Sign vendored binaries with hardened runtime and their specific entitlements
          codesign --force --options runtime --entitlements crates-tauri/yaak-app-client/macos/entitlements.yaakprotoc.plist --sign "$APPLE_SIGNING_IDENTITY" crates-tauri/yaak-app-client/vendored/protoc/yaakprotoc || true
          codesign --force --options runtime --entitlements crates-tauri/yaak-app-client/macos/entitlements.yaaknode.plist --sign "$APPLE_SIGNING_IDENTITY" crates-tauri/yaak-app-client/vendored/node/yaaknode || true

      - uses: tauri-apps/tauri-action@v0
        env:
          YAAK_TARGET_ARCH: ${{ matrix.yaak_arch }}

          ENABLE_CODE_SIGNING: ${{ secrets.APPLE_CERTIFICATE }}
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_PRIVATE_KEY }}
          TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_KEY_PASSWORD }}

          # Apple signing stuff
          APPLE_CERTIFICATE: ${{ matrix.os == 'macos' && secrets.APPLE_CERTIFICATE }}
          APPLE_CERTIFICATE_PASSWORD: ${{ matrix.os == 'macos' && secrets.APPLE_CERTIFICATE_PASSWORD }}
          APPLE_ID: ${{ matrix.os == 'macos' && secrets.APPLE_ID }}
          APPLE_PASSWORD: ${{ matrix.os == 'macos' && secrets.APPLE_PASSWORD }}
          APPLE_SIGNING_IDENTITY: ${{ matrix.os == 'macos' && secrets.APPLE_SIGNING_IDENTITY }}
          APPLE_TEAM_ID: ${{ matrix.os == 'macos' && secrets.APPLE_TEAM_ID }}

          # Windows signing stuff
          AZURE_CLIENT_ID: ${{ matrix.os == 'windows' && secrets.AZURE_CLIENT_ID }}
          AZURE_CLIENT_SECRET: ${{ matrix.os == 'windows' && secrets.AZURE_CLIENT_SECRET }}
          AZURE_TENANT_ID: ${{ matrix.os == 'windows' && secrets.AZURE_TENANT_ID }}
        with:
          tauriScript: "node ../../node_modules/@tauri-apps/cli/tauri.js"
          tagName: "v__VERSION__"
          releaseName: "Release __VERSION__"
          releaseBody: "<!-- generated-by-yaak-releases -->"
          releaseDraft: true
          prerelease: true
          projectPath: ./crates-tauri/yaak-app-client
          args: "${{ matrix.args }}"

      - name: Build and upload CEF tarball from deb (Linux only)
        if: matrix.os == 'ubuntu' && matrix.runtime == 'cef'
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          set -euo pipefail
          deb=$(find target/release/bundle/deb -maxdepth 1 -type f -name '*.deb' | head -n 1)
          version="${GITHUB_REF_NAME#v}"
          extract_dir="target/release/bundle/deb/yaak-cef-linux-${{ matrix.yaak_arch }}"
          tarball="target/release/bundle/deb/yaak-cef_${version}_linux_${{ matrix.yaak_arch }}.tar.gz"
          rm -rf "$extract_dir"
          mkdir -p "$extract_dir"
          dpkg-deb -x "$deb" "$extract_dir"
          tar -C "$extract_dir" -czf "$tarball" .
          gh release upload "${{ github.ref_name }}" "$tarball" --clobber

      # Build a per-machine NSIS installer for enterprise deployment (PDQ, SCCM, Intune)
      - name: Build and upload machine-wide installer (Windows only)
        if: matrix.os == 'windows'
        shell: pwsh
        env:
          YAAK_TARGET_ARCH: ${{ matrix.yaak_arch }}
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          AZURE_CLIENT_ID: ${{ secrets.AZURE_CLIENT_ID }}
          AZURE_CLIENT_SECRET: ${{ secrets.AZURE_CLIENT_SECRET }}
          AZURE_TENANT_ID: ${{ secrets.AZURE_TENANT_ID }}
          TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_PRIVATE_KEY }}
          TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_KEY_PASSWORD }}
        run: |
          Get-ChildItem -Recurse -Path target -File -Filter "*.exe.sig" | Remove-Item -Force
          Push-Location crates-tauri/yaak-app-client
          npx tauri bundle ${{ matrix.args }} --bundles nsis --config '{"bundle":{"createUpdaterArtifacts":true,"windows":{"nsis":{"installMode":"perMachine"}}}}'
          Pop-Location
          $setup = Get-ChildItem -Recurse -Path target -Filter "*setup*.exe" | Select-Object -First 1
          $setupSig = "$($setup.FullName).sig"
          $dest = $setup.FullName -replace '-setup\.exe$', '-setup-machine.exe'
          $destSig = "$dest.sig"
          Copy-Item $setup.FullName $dest
          Copy-Item $setupSig $destSig
          gh release upload "${{ github.ref_name }}" "$dest" --clobber
          gh release upload "${{ github.ref_name }}" "$destSig" --clobber