release.yml

name: release

on:
  push:
    tags:
      - 'v*'
  workflow_dispatch:

permissions:
  contents: write

jobs:
  build:
    strategy:
      fail-fast: false
      matrix:
        include:
          - os: macos-latest
            platform: mac
          - os: windows-latest
            platform: win
          - os: ubuntu-22.04
            platform: linux
    runs-on: ${{ matrix.os }}
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Setup Node 20
        uses: actions/setup-node@v4
        with:
          node-version: 20

      - name: Install dependencies
        id: install
        run: npm ci
        continue-on-error: true

      - name: Install dependencies (fallback)
        if: steps.install.outcome == 'failure'
        run: npm install

      - name: Fetch ffmpeg (mac/linux)
        if: matrix.platform == 'mac' || matrix.platform == 'linux'
        run: bash scripts/fetch-ffmpeg.sh

      - name: Fetch ffmpeg (win)
        if: matrix.platform == 'win'
        shell: powershell
        run: powershell -ExecutionPolicy Bypass -File scripts/fetch-ffmpeg.ps1

      - name: Build app bundles
        run: npx electron-vite build

      - name: Resolve signing secrets
        if: matrix.platform == 'mac'
        env:
          P12_B64: ${{ secrets.CSC_MAC_P12 }}
          P12_PASS: ${{ secrets.CSC_MAC_PASSWORD }}
          APPLE_ID_S: ${{ secrets.APPLE_ID }}
          APPLE_PW_S: ${{ secrets.APPLE_APP_SPECIFIC_PASSWORD }}
          APPLE_TEAM_S: ${{ secrets.APPLE_TEAM_ID }}
        run: |
          if [ -n "$P12_B64" ]; then
            # electron-builder 25.x imports the P12 into a temp keychain secured
            # with a random password, but then calls set-key-partition-list with
            # the P12 password. macOS 26.6+ runner images now validate that
            # password, so the import always dies with SecKeychainUnlock
            # (electron-userland/electron-builder#10101). Import the cert
            # ourselves and hand electron-builder just the identity instead.
            KC="$RUNNER_TEMP/sign.keychain-db"
            KC_PASS=$(openssl rand -hex 32)
            security create-keychain -p "$KC_PASS" "$KC"
            security unlock-keychain -p "$KC_PASS" "$KC"
            security set-keychain-settings -lut 21600 "$KC"
            printf '%s' "$P12_B64" | base64 --decode > "$RUNNER_TEMP/cert.p12"
            security import "$RUNNER_TEMP/cert.p12" -k "$KC" -P "$P12_PASS" -T /usr/bin/codesign -T /usr/bin/productbuild
            rm -f "$RUNNER_TEMP/cert.p12"
            security set-key-partition-list -S apple-tool:,apple: -s -k "$KC_PASS" "$KC"
            security list-keychains -d user -s "$KC" $(security list-keychains -d user | tr -d '"')
            security default-keychain -s "$KC"
            ID_NAME=$(security find-identity -v -p codesigning "$KC" | awk -F'"' '/Developer ID Application/{print $2; exit}')
            if [ -z "$ID_NAME" ]; then
              echo "::error::No valid Developer ID Application identity in CSC_MAC_P12"
              exit 1
            fi
            echo "CSC_NAME=${ID_NAME#Developer ID Application: }" >> "$GITHUB_ENV"
            echo "Developer ID signing enabled: $ID_NAME"
          else
            echo "CSC_MAC_P12 secret not set — falling back to ad-hoc signing"
          fi
          if [ "${{ vars.ENABLE_NOTARIZATION }}" = "true" ] && [ -n "$APPLE_ID_S" ]; then
            echo "APPLE_ID=$APPLE_ID_S" >> "$GITHUB_ENV"
            echo "APPLE_APP_SPECIFIC_PASSWORD=$APPLE_PW_S" >> "$GITHUB_ENV"
            echo "APPLE_TEAM_ID=$APPLE_TEAM_S" >> "$GITHUB_ENV"
            echo "Notarization enabled"
          else
            echo "Notarization disabled (requires ENABLE_NOTARIZATION variable = true, active membership, and APPLE secrets)"
          fi

      - name: Package (release)
        if: startsWith(github.ref, 'refs/tags/v')
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: npx electron-builder --${{ matrix.platform }} --publish always

      - name: Package (on demand)
        if: github.event_name == 'workflow_dispatch'
        run: npx electron-builder --${{ matrix.platform }} --publish never

      - name: Upload artifacts
        if: github.event_name == 'workflow_dispatch'
        uses: actions/upload-artifact@v4
        with:
          name: stemkit-${{ matrix.platform }}
          path: |
            release/*.dmg
            release/*.exe
            release/*.zip
            release/*.AppImage
            release/*.deb
          if-no-files-found: error

  # regression gate: run the app's self-test (fresh install/bootstrap, both
  # engines on CPU, GPU plumbing) on clean runners before a release is
  # trusted. The electron-builder step above only creates a DRAFT — a red
  # run here means do not publish it
  smoke-windows:
    needs: build
    if: startsWith(github.ref, 'refs/tags/v')
    uses: ./.github/workflows/windows-smoke.yml
    secrets: inherit

  smoke-linux:
    needs: build
    if: startsWith(github.ref, 'refs/tags/v')
    uses: ./.github/workflows/linux-smoke.yml
    secrets: inherit

  smoke-macos:
    needs: build
    if: startsWith(github.ref, 'refs/tags/v')
    uses: ./.github/workflows/macos-smoke.yml
    secrets: inherit