release.yml

name: Release

on:
  push:
    branches: [main]
  workflow_dispatch:

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

env:
  CARGO_TERM_COLOR: always

jobs:
  # ─────────────────────────────────────────────────────────────
  # Release PR: Create/update release PR with version bump
  # ─────────────────────────────────────────────────────────────
  release-pr:
    runs-on: ubuntu-latest
    permissions:
      contents: write
      pull-requests: write
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
          persist-credentials: false

      - uses: dtolnay/rust-toolchain@stable

      - name: Create/Update Release PR
        uses: release-plz/action@v0.5
        with:
          command: release-pr
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

  # ─────────────────────────────────────────────────────────────
  # Release: Create git tag and GitHub release when PR is merged
  # ─────────────────────────────────────────────────────────────
  release:
    runs-on: ubuntu-latest
    permissions:
      contents: write
    outputs:
      releases_created: ${{ steps.release-plz.outputs.releases_created }}
      version: ${{ steps.get-version.outputs.version }}
      tag: ${{ steps.get-version.outputs.tag }}
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
          persist-credentials: false

      - uses: dtolnay/rust-toolchain@stable

      - name: Create Release
        id: release-plz
        uses: release-plz/action@v0.5
        with:
          command: release
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

      - name: Extract version from releases output
        id: get-version
        if: steps.release-plz.outputs.releases_created == 'true'
        env:
          RELEASES: ${{ steps.release-plz.outputs.releases }}
        run: |
          # Parse the releases JSON to get tag and version
          # Example: [{"package_name":"mcpmux","tag":"v0.1.0","version":"0.1.0"}]
          TAG=$(echo "$RELEASES" | jq -r '.[0].tag')
          VERSION=$(echo "$RELEASES" | jq -r '.[0].version')
          echo "tag=$TAG" >> $GITHUB_OUTPUT
          echo "version=$VERSION" >> $GITHUB_OUTPUT
          echo "Released tag: $TAG, version: $VERSION"

  # ─────────────────────────────────────────────────────────────
  # Build Release: Build Tauri app when release is created
  # ─────────────────────────────────────────────────────────────
  build-release:
    needs: release
    if: needs.release.outputs.releases_created == 'true'
    strategy:
      fail-fast: false
      matrix:
        include:
          - os: ubuntu-latest
            target: x86_64-unknown-linux-gnu
            artifact: linux
          - os: windows-latest
            target: x86_64-pc-windows-msvc
            artifact: windows
          - os: macos-latest
            target: aarch64-apple-darwin
            artifact: macos-arm
          - os: macos-15
            target: x86_64-apple-darwin
            artifact: macos-intel

    runs-on: ${{ matrix.os }}
    permissions:
      contents: write
    steps:
      - uses: actions/checkout@v4

      - name: Install Linux deps
        if: matrix.os == 'ubuntu-latest'
        uses: ./.github/actions/install-linux-deps
        with:
          verify_glib: 'false'

      - uses: dtolnay/rust-toolchain@stable
        with:
          targets: ${{ matrix.target }}
        env:
          PKG_CONFIG_PATH: /usr/lib/x86_64-linux-gnu/pkgconfig:/usr/lib/pkgconfig:/usr/share/pkgconfig

      - uses: Swatinem/rust-cache@v2
        with:
          key: ${{ matrix.target }}-release
        env:
          PKG_CONFIG_PATH: /usr/lib/x86_64-linux-gnu/pkgconfig:/usr/lib/pkgconfig:/usr/share/pkgconfig

      - uses: pnpm/action-setup@v4
      - uses: actions/setup-node@v4
        with:
          node-version: 20
          cache: 'pnpm'

      - run: pnpm install --frozen-lockfile

      # Import Apple certificate for macOS signing
      - name: Import Apple certificate
        if: matrix.os == 'macos-latest' || matrix.os == 'macos-15'
        env:
          APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }}
          APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
          KEYCHAIN_PASSWORD: ${{ secrets.KEYCHAIN_PASSWORD }}
        run: |
          if [ -n "$APPLE_CERTIFICATE" ]; then
            echo $APPLE_CERTIFICATE | base64 --decode > certificate.p12
            security create-keychain -p "$KEYCHAIN_PASSWORD" build.keychain
            security default-keychain -s build.keychain
            security unlock-keychain -p "$KEYCHAIN_PASSWORD" build.keychain
            security import certificate.p12 -k build.keychain -P "$APPLE_CERTIFICATE_PASSWORD" -T /usr/bin/codesign
            security set-key-partition-list -S apple-tool:,apple:,codesign: -s -k "$KEYCHAIN_PASSWORD" build.keychain
            rm certificate.p12
          fi

      - name: Build Tauri app
        uses: tauri-apps/tauri-action@v0
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
          TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
          PKG_CONFIG_PATH: /usr/lib/x86_64-linux-gnu/pkgconfig:/usr/lib/pkgconfig:/usr/share/pkgconfig
          # macOS signing
          APPLE_SIGNING_IDENTITY: ${{ secrets.APPLE_SIGNING_IDENTITY }}
          APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }}
          APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
          # macOS notarization
          APPLE_ID: ${{ secrets.APPLE_ID }}
          APPLE_PASSWORD: ${{ secrets.APPLE_PASSWORD }}
          APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
        with:
          # Use tagName to find and upload to the existing release created by release-plz
          tagName: ${{ needs.release.outputs.tag }}
          releaseName: 'McpMux v${{ needs.release.outputs.version }}'
          releaseBody: ''  # Release notes already created by release-plz
          releaseDraft: false
          prerelease: false
          updaterJsonKeepUniversal: true