build.yml

name: Build

on:
  workflow_call:
    inputs:
      publish:
        description: 'Publish artifacts to a GitHub release'
        type: boolean
        default: false
      tag-name:
        description: 'Tag name to publish under (only used when publish=true)'
        type: string
        default: ''
      version:
        description: 'X.Y.Z written into the version files before building (only used when publish=true)'
        type: string
        default: ''
      release-body:
        description: 'GitHub release body (only used when publish=true)'
        type: string
        default: ''
      prerelease:
        description: 'Mark the release as a pre-release'
        type: boolean
        default: false

jobs:
  build:
    strategy:
      fail-fast: false
      matrix:
        include:
          - platform: macos-latest
            args: --target aarch64-apple-darwin
            bunTarget: darwin-arm64
            macTarget: aarch64-apple-darwin
            publishArgs: --config '{"bundle":{"macOS":{"hardenedRuntime":true}}}'
          - platform: macos-latest
            args: --target x86_64-apple-darwin
            bunTarget: darwin-x64
            macTarget: x86_64-apple-darwin
            publishArgs: --config '{"bundle":{"macOS":{"hardenedRuntime":true}}}'
          - platform: ubuntu-22.04
            args: '--verbose'
            bunTarget: linux-x64
          - platform: windows-latest
            args: ''
            bunTarget: windows-x64

    runs-on: ${{ matrix.platform }}
    permissions:
      contents: write

    steps:
      # Actions are pinned by SHA because this workflow runs with
      # TAURI_SIGNING_PRIVATE_KEY in scope when called from release.yml.
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      # Keep in sync with ci.yml and release.yml: this bun compiles the MCP
      # binary, so its runtime ships in the release.
      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
        with:
          bun-version: 1.3.14

      - name: Install Rust stable
        uses: dtolnay/rust-toolchain@b725eda525362e7cf34af9a7243cac1e3f01a7ec # stable
        with:
          targets: ${{ matrix.platform == 'macos-latest' && 'aarch64-apple-darwin,x86_64-apple-darwin' || '' }}

      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
        with:
          workspaces: src-tauri

      # scripts/acknowledgments.ts reads this pin. 0.9.2 is the newest this
      # version of the action ships with checksums.
      - name: Install cargo-about
        uses: taiki-e/install-action@8cca0918f8471c33515202b73f56ab27f2bed283 # v2.87.29
        with:
          tool: cargo-about@0.9.2

      - name: Install Linux dependencies
        if: matrix.platform == 'ubuntu-22.04'
        run: |
          sudo apt-get update
          sudo apt-get install -y libwebkit2gtk-4.1-dev libappindicator3-dev librsvg2-dev patchelf
          # linuxdeploy copies a pixbuf loader archive and a typelib from these, which
          # the runner image only happens to have: the AppImage and its credits
          # (src-tauri/linux/appimage-packages.txt) shouldn't change with the image.
          sudo apt-get install -y libwmf-dev gir1.2-secret-1

      # The Sparkle plugin's build.rs links against it, so cargo fails without it.
      - name: Download Sparkle.framework
        if: matrix.platform == 'macos-latest'
        run: ./scripts/macos/download-sparkle.sh

      - run: bun install --frozen-lockfile

      - name: Install MCP server dependencies
        run: cd mcp-server && bun install --frozen-lockfile

      - name: Write the release version
        if: ${{ inputs.publish && inputs.version != '' }}
        shell: bash
        env:
          VERSION: ${{ inputs.version }}
        run: bun scripts/version.ts set "$VERSION"

      # Override createUpdaterArtifacts so tauri-build doesn't require
      # TAURI_SIGNING_PRIVATE_KEY in PR runs. Bundling is still validated;
      # only the signed updater manifest is skipped.
      - name: Build (no publish)
        if: ${{ !inputs.publish }}
        uses: tauri-apps/tauri-action@84b9d35b5fc46c1e45415bdb6144030364f7ebc5 # v0.6.2
        env:
          APPIMAGE_EXTRACT_AND_RUN: '1'
          NO_STRIP: 'true'
          BUN_TARGET: ${{ matrix.bunTarget }}
          RUST_LOG: ${{ matrix.platform == 'ubuntu-22.04' && 'tauri_bundler=debug,tauri_cli=debug' || '' }}
        with:
          args: ${{ matrix.args }} --config '{"bundle":{"createUpdaterArtifacts":false}}'

      - name: Upload build artifacts (no publish)
        if: ${{ !inputs.publish }}
        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        with:
          name: bundle-${{ matrix.bunTarget }}
          path: |
            src-tauri/target/**/release/bundle/**/*.dmg
            src-tauri/target/**/release/bundle/**/*.deb
            src-tauri/target/**/release/bundle/**/*.AppImage
            src-tauri/target/**/release/bundle/**/*.msi
            src-tauri/target/**/release/bundle/**/*-setup.exe
          if-no-files-found: warn
          retention-days: 7

      - name: Import the Developer ID certificate
        if: ${{ inputs.publish && matrix.platform == 'macos-latest' }}
        env:
          APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }}
          APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
          KEYCHAIN_PASSWORD: ${{ secrets.KEYCHAIN_PASSWORD }}
          APPLE_API_KEY: ${{ secrets.APPLE_API_KEY }}
          APPLE_API_ISSUER: ${{ secrets.APPLE_API_ISSUER }}
          APPLE_API_KEY_P8: ${{ secrets.APPLE_API_KEY_P8 }}
        run: ./scripts/macos/import-signing-identity.sh

      - name: Sign Sparkle's helpers
        if: ${{ inputs.publish && matrix.platform == 'macos-latest' }}
        run: ./scripts/macos/sign-sparkle-helpers.sh

      - name: Build and publish
        if: ${{ inputs.publish }}
        timeout-minutes: 150
        uses: tauri-apps/tauri-action@84b9d35b5fc46c1e45415bdb6144030364f7ebc5 # v0.6.2
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
          TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
          APPLE_API_KEY: ${{ matrix.platform == 'macos-latest' && secrets.APPLE_API_KEY || '' }}
          APPLE_API_ISSUER: ${{ matrix.platform == 'macos-latest' && secrets.APPLE_API_ISSUER || '' }}
          APPIMAGE_EXTRACT_AND_RUN: '1'
          NO_STRIP: 'true'
          BUN_TARGET: ${{ matrix.bunTarget }}
          # Bundler-level debug logging on Ubuntu only, so the underlying
          # linuxdeploy/appimagetool stderr surfaces in CI when the AppImage
          # step fails. Tauri propagates this through tracing; the env var
          # alone wouldn't reach linuxdeploy because Tauri invokes it with a
          # fixed argv.
          RUST_LOG: ${{ matrix.platform == 'ubuntu-22.04' && 'tauri_bundler=debug,tauri_cli=debug' || '' }}
        with:
          tagName: ${{ inputs.tag-name }}
          releaseName: 'SocaDB ${{ inputs.tag-name }}'
          releaseBody: ${{ inputs.release-body }}
          # Promoted to non-draft by release.yml's promote job after all legs
          # succeed, so users never see a partial release.
          releaseDraft: true
          prerelease: ${{ inputs.prerelease }}
          args: ${{ matrix.args }} ${{ matrix.publishArgs }}

      - name: Check the agent runtime
        shell: bash
        timeout-minutes: 10
        env:
          BUN_TARGET: ${{ matrix.bunTarget }}
        run: bun scripts/check-runtime.ts

      - name: Check the installer
        if: matrix.platform == 'windows-latest'
        timeout-minutes: 15
        run: bun scripts/check-installer.ts

      - name: Check the AppImage's libraries
        if: matrix.platform == 'ubuntu-22.04'
        timeout-minutes: 10
        run: bun scripts/check-appimage.ts

      - name: Notarize the disk image
        if: ${{ inputs.publish && matrix.platform == 'macos-latest' }}
        timeout-minutes: 150
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          APPLE_API_KEY: ${{ secrets.APPLE_API_KEY }}
          APPLE_API_ISSUER: ${{ secrets.APPLE_API_ISSUER }}
          TAG_NAME: ${{ inputs.tag-name }}
          BUNDLE_DIR: src-tauri/target/${{ matrix.macTarget }}/release/bundle
        run: |
          dmgs=("$BUNDLE_DIR"/dmg/*.dmg)
          if [ "${#dmgs[@]}" -ne 1 ] || [ ! -f "${dmgs[0]}" ]; then
            echo "::error::Expected one disk image in $BUNDLE_DIR/dmg, found: ${dmgs[*]}"
            exit 1
          fi
          ./scripts/macos/notarize-dmg.sh "${dmgs[0]}" "$TAG_NAME"

      - name: Check the signature and notarization
        if: ${{ inputs.publish && matrix.platform == 'macos-latest' }}
        env:
          BUNDLE_DIR: src-tauri/target/${{ matrix.macTarget }}/release/bundle
        run: ./scripts/macos/check-signature.sh "$BUNDLE_DIR/macos/SocaDB.app" "$BUNDLE_DIR"/dmg/*.dmg

      - name: Remove the signing keychain
        if: ${{ always() && inputs.publish && matrix.platform == 'macos-latest' }}
        run: |
          security delete-keychain "$RUNNER_TEMP/macos-signing/signing.keychain-db" || true
          rm -rf "$RUNNER_TEMP/macos-signing"

      - name: Upload AppImage debug artifacts on failure
        if: failure() && matrix.platform == 'ubuntu-22.04'
        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        with:
          name: linux-bundle-debug-${{ inputs.tag-name || github.run_id }}
          # Restrict to the partial AppImage tree and any tool logs. Exclude
          # signed updater outputs and the public release manifest so a
          # rogue verbose log can't ride along.
          path: |
            src-tauri/target/release/bundle/appimage/
            src-tauri/target/release/bundle/deb/
            **/linuxdeploy*.log
            **/appimagetool*.log
            !**/*.sig
            !**/latest.json
          if-no-files-found: ignore
          retention-days: 7