release.yml

name: Release

on:
  push:
    branches: [main]
  workflow_dispatch:

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

env:
  CARGO_TERM_COLOR: always

jobs:
  # ─────────────────────────────────────────────────────────────
  # Changesets: Version management and release PR
  # ─────────────────────────────────────────────────────────────
  changesets:
    runs-on: ubuntu-latest
    permissions:
      contents: write
      pull-requests: write
    outputs:
      published: ${{ steps.changesets.outputs.published }}
      publishedPackages: ${{ steps.changesets.outputs.publishedPackages }}
      version: ${{ steps.get-version.outputs.version }}
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - uses: pnpm/action-setup@v4
      - uses: actions/setup-node@v4
        with:
          node-version: 20
          cache: 'pnpm'

      - run: pnpm install --frozen-lockfile

      - name: Create Release PR or Publish
        id: changesets
        uses: changesets/action@v1
        with:
          title: 'chore: version packages'
          commit: 'chore: version packages'
          version: pnpm changeset version
          publish: pnpm run publish
          createGithubReleases: true
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

      - name: Get version from package.json
        id: get-version
        if: steps.changesets.outputs.published == 'true'
        run: |
          VERSION=$(node -p "require('./apps/desktop/package.json').version")
          echo "version=$VERSION" >> $GITHUB_OUTPUT

  # ─────────────────────────────────────────────────────────────
  # Build and Release: Triggered when changesets publishes
  # ─────────────────────────────────────────────────────────────
  build-release:
    needs: changesets
    if: needs.changesets.outputs.published == 'true'
    strategy:
      fail-fast: false
      matrix:
        include:
          - os: ubuntu-latest
            target: x86_64-unknown-linux-gnu
            artifact: linux
          - os: windows-latest
            target: x86_64-pc-windows-msvc
            artifact: windows
          - os: macos-latest
            target: aarch64-apple-darwin
            artifact: macos-arm
          - os: macos-13
            target: x86_64-apple-darwin
            artifact: macos-intel

    runs-on: ${{ matrix.os }}
    permissions:
      contents: write
    steps:
      - uses: actions/checkout@v4

      - name: Install Linux deps
        if: matrix.os == 'ubuntu-latest'
        uses: ./.github/actions/install-linux-deps
        with:
          verify_glib: 'false'

      - uses: dtolnay/rust-toolchain@stable
        with:
          targets: ${{ matrix.target }}
        env:
          PKG_CONFIG_PATH: /usr/lib/x86_64-linux-gnu/pkgconfig:/usr/lib/pkgconfig:/usr/share/pkgconfig

      - uses: Swatinem/rust-cache@v2
        with:
          key: ${{ matrix.target }}-release
        env:
          PKG_CONFIG_PATH: /usr/lib/x86_64-linux-gnu/pkgconfig:/usr/lib/pkgconfig:/usr/share/pkgconfig

      - uses: pnpm/action-setup@v4
      - uses: actions/setup-node@v4
        with:
          node-version: 20
          cache: 'pnpm'

      - run: pnpm install --frozen-lockfile

      # Import Apple certificate for macOS signing
      - name: Import Apple certificate
        if: matrix.os == 'macos-latest' || matrix.os == 'macos-13'
        env:
          APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }}
          APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
          KEYCHAIN_PASSWORD: ${{ secrets.KEYCHAIN_PASSWORD }}
        run: |
          if [ -n "$APPLE_CERTIFICATE" ]; then
            echo $APPLE_CERTIFICATE | base64 --decode > certificate.p12
            security create-keychain -p "$KEYCHAIN_PASSWORD" build.keychain
            security default-keychain -s build.keychain
            security unlock-keychain -p "$KEYCHAIN_PASSWORD" build.keychain
            security import certificate.p12 -k build.keychain -P "$APPLE_CERTIFICATE_PASSWORD" -T /usr/bin/codesign
            security set-key-partition-list -S apple-tool:,apple:,codesign: -s -k "$KEYCHAIN_PASSWORD" build.keychain
            rm certificate.p12
          fi

      - name: Build Tauri app
        uses: tauri-apps/tauri-action@v0
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
          TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
          PKG_CONFIG_PATH: /usr/lib/x86_64-linux-gnu/pkgconfig:/usr/lib/pkgconfig:/usr/share/pkgconfig
          # macOS signing
          APPLE_SIGNING_IDENTITY: ${{ secrets.APPLE_SIGNING_IDENTITY }}
          APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }}
          APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
          # macOS notarization
          APPLE_ID: ${{ secrets.APPLE_ID }}
          APPLE_PASSWORD: ${{ secrets.APPLE_PASSWORD }}
          APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
        with:
          tagName: v${{ needs.changesets.outputs.version }}
          releaseName: 'McpMux v${{ needs.changesets.outputs.version }}'
          releaseBody: ''
          releaseDraft: false
          prerelease: false
          updaterJsonKeepUniversal: true

  # ─────────────────────────────────────────────────────────────
  # Nightly: Build on every push (no release)
  # ─────────────────────────────────────────────────────────────
  nightly:
    if: "github.event_name == 'push' && !contains(github.event.head_commit.message, 'chore: version packages')"
    strategy:
      fail-fast: false
      matrix:
        include:
          - os: ubuntu-latest
            target: x86_64-unknown-linux-gnu
          - os: windows-latest
            target: x86_64-pc-windows-msvc
          - os: macos-latest
            target: aarch64-apple-darwin
    runs-on: ${{ matrix.os }}
    steps:
      - uses: actions/checkout@v4

      - name: Install Linux deps
        if: matrix.os == 'ubuntu-latest'
        uses: ./.github/actions/install-linux-deps
        with:
          verify_glib: 'false'

      - uses: dtolnay/rust-toolchain@stable
        with:
          targets: ${{ matrix.target }}
        env:
          PKG_CONFIG_PATH: /usr/lib/x86_64-linux-gnu/pkgconfig:/usr/lib/pkgconfig:/usr/share/pkgconfig

      - uses: Swatinem/rust-cache@v2
        with:
          key: ${{ matrix.target }}-nightly
        env:
          PKG_CONFIG_PATH: /usr/lib/x86_64-linux-gnu/pkgconfig:/usr/lib/pkgconfig:/usr/share/pkgconfig

      - uses: pnpm/action-setup@v4
      - uses: actions/setup-node@v4
        with:
          node-version: 20
          cache: 'pnpm'

      - run: pnpm install --frozen-lockfile
      - run: pnpm build
        env:
          TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
          PKG_CONFIG_PATH: /usr/lib/x86_64-linux-gnu/pkgconfig:/usr/lib/pkgconfig:/usr/share/pkgconfig

      - name: Upload artifacts
        uses: actions/upload-artifact@v4
        with:
          name: build-${{ matrix.target }}
          path: |
            target/release/bundle/**/*
          retention-days: 7