release.yml

name: Release

on:
  push:
    tags:
      - 'v*'
  workflow_dispatch:

permissions:
  contents: write

jobs:
  build:
    strategy:
      fail-fast: false
      matrix:
        include:
          - os: macos-latest
            platform: mac
          # Windows images have fully rolled to VS2026 (windows-2025 no longer ships VS2022).
          # Old node-gyp 11.x doesn't recognize VS2026 → "Could not find any Visual Studio
          # installation". Fix: force node-gyp ^12.1.0 via package.json overrides (12.1+
          # supports VS2026; @electron/rebuild's bundled ^11.2 can't reach it, so an override
          # is required). Keep the image pinned to windows-2025 to avoid windows-latest
          # introducing new variables.
          - os: windows-2025
            platform: win
          - os: ubuntu-latest
            platform: linux

    runs-on: ${{ matrix.os }}

    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-node@v4
        with:
          node-version: 20
          cache: 'npm'

      - run: npm ci --no-fund --no-audit

      - run: npm run build

      - name: Build Electron (mac)
        if: matrix.platform == 'mac'
        # Apple notarization (notarytool) returns HTTP 403 when the Developer Agreement has
        # expired or is unsigned — unrelated to code. Tolerate the failure: mark only this step
        # as failed and skip the mac artifact, but do not block the entire release pipeline —
        # win/linux artifacts, GitHub Release, and Homebrew bump proceed as normal. Once the
        # agreement is re-signed at developer.apple.com, mac notarization and upload resume
        # automatically.
        continue-on-error: true
        timeout-minutes: 60
        run: npx electron-builder --mac --publish never
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          CSC_LINK: ${{ secrets.CSC_LINK }}
          CSC_KEY_PASSWORD: ${{ secrets.CSC_KEY_PASSWORD }}
          APPLE_ID: ${{ secrets.APPLE_ID }}
          APPLE_APP_SPECIFIC_PASSWORD: ${{ secrets.APPLE_APP_SPECIFIC_PASSWORD }}
          APPLE_TEAM_ID: MUNC45J2DU

      - name: Build Electron (win)
        if: matrix.platform == 'win'
        run: npx electron-builder --win --publish never
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          # Uncomment when Windows signing certificate is available:
          # CSC_LINK: ${{ secrets.WIN_CSC_LINK }}
          # CSC_KEY_PASSWORD: ${{ secrets.WIN_CSC_KEY_PASSWORD }}

      - name: Build Electron (linux)
        if: matrix.platform == 'linux'
        run: npx electron-builder --linux --publish never
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

      - name: Upload artifacts
        uses: actions/upload-artifact@v4
        with:
          name: release-${{ matrix.platform }}
          path: |
            electron-dist/*.dmg
            electron-dist/*.zip
            electron-dist/*.exe
            electron-dist/*.AppImage
          if-no-files-found: ignore

  publish:
    needs: build
    runs-on: ubuntu-latest
    if: startsWith(github.ref, 'refs/tags/v')

    steps:
      - uses: actions/download-artifact@v4
        with:
          path: artifacts
          merge-multiple: true

      - name: List artifacts
        run: find artifacts -type f | head -20

      - name: Create GitHub Release
        # The downstream Homebrew bump is handled by the bump-homebrew job via reusable
        # workflow chained call (see below), within the same run — no dependency on the
        # release:published event. Use the default GITHUB_TOKEN to create the Release; no PAT needed.
        uses: softprops/action-gh-release@v2
        with:
          files: artifacts/*
          generate_release_notes: true
          token: ${{ secrets.GITHUB_TOKEN }}

  # Publish to npm via Trusted Publishing (OIDC). Requires the npm package to be
  # configured with a Trusted Publisher for weiesky/cc-viewer (Settings → Access →
  # Trusted Publishing on npmjs.com). No token needed — OIDC provides an ephemeral
  # automation token automatically.
  npm-publish:
    needs: build
    runs-on: ubuntu-latest
    if: startsWith(github.ref, 'refs/tags/v')
    permissions:
      id-token: write      # required for OIDC token exchange with npm
      contents: read

    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-node@v4
        with:
          node-version: 24
          registry-url: 'https://registry.npmjs.org'

      # OIDC trusted publishing requires npm >= 11.5.1 — Node 20's bundled npm 10.x cannot do
      # the OIDC token exchange, so `npm publish` fails even with a correctly configured
      # Trusted Publisher on npmjs.com (this is what broke the v1.6.346/347 releases).
      - run: npm install -g npm@latest

      - run: npm ci --no-fund --no-audit

      - run: npm publish --provenance
        # prepublishOnly runs `npm run build` automatically.

  # Post-release automatic Homebrew tap formula bump (reusable workflow, uses HOMEBREW_TAP_TOKEN).
  bump-homebrew:
    needs: publish
    # Explicit needs.publish.result: a custom if would drop the implicit success() gate,
    # causing this job to run even when publish fails (bumping a non-existent release).
    if: ${{ needs.publish.result == 'success' && startsWith(github.ref, 'refs/tags/v') }}
    uses: ./.github/workflows/bump-homebrew.yml
    with:
      version: ${{ github.ref_name }}   # vX.Y.Z; the callee strips the leading 'v'
    # Minimal permissions: only pass HOMEBREW_TAP_TOKEN explicitly (the only secret the
    # callee needs); avoid secrets: inherit which would dump all caller secrets
    # (CSC_*/APPLE_* etc.) into the child workflow.
    secrets:
      HOMEBREW_TAP_TOKEN: ${{ secrets.HOMEBREW_TAP_TOKEN }}