release.yml

name: Release

# A v* tag builds every download, installs each one on a clean system to prove it works, and
# publishes them as that tag's GitHub release. Run by hand on a branch, it builds and tests the
# same files without publishing (`gh workflow run release.yml --ref BRANCH`); they are kept as the
# run's `release-all` artifact.
#
# macOS, Windows, and Linux x86_64 skip compilation when CI already built that commit. The
# programs are packaged and signed here. Linux aarch64 is built here; CI does not cover it.
on:
  push:
    tags:
      - "v*"
  workflow_dispatch:
    inputs:
      publish:
        description: Publish a GitHub release. Only when run on a v* tag.
        type: boolean
        default: false

permissions:
  contents: read
  actions: read

env:
  CARGO_TERM_COLOR: always

jobs:
  macos:
    runs-on: macos-latest
    steps:
      - uses: actions/checkout@v5
      - name: Name the files
        run: packaging/ci-label.sh >> "$GITHUB_ENV"
      - name: Reuse binaries built by CI
        id: reuse
        env:
          GH_TOKEN: ${{ github.token }}
        run: packaging/ci/reuse-binaries.sh macos
      - uses: ./.github/actions/setup-rust
        if: steps.reuse.outputs.found != 'true'
        with:
          cache-key: release
      - name: Build release
        if: steps.reuse.outputs.found != 'true'
        env:
          TINYCLIENT_TELEGRAM_API_ID: ${{ secrets.TINYCLIENT_TELEGRAM_API_ID }}
          TINYCLIENT_TELEGRAM_API_HASH: ${{ secrets.TINYCLIENT_TELEGRAM_API_HASH }}
        run: |
          cargo build --release \
            -p tinyclient --features tinyclient/gui \
            -p chatd -p mediad -p login
      - name: Bundle tinyclient.app
        run: packaging/bundle.sh --no-build
      - name: Zip and disk image
        run: |
          mkdir -p dist
          ditto -c -k --keepParent target/release/tinyclient.app "dist/tinyclient-$LABEL-macos.zip"
          packaging/dmg.sh "dist/tinyclient-$LABEL-macos.dmg"
      # Mounted as a user would: the Applications link is there, the app's ad hoc signature holds,
      # and every program in it runs.
      - name: Smoke test the disk image
        run: |
          mnt=$(mktemp -d)
          hdiutil attach -nobrowse -readonly -mountpoint "$mnt" "dist/tinyclient-$LABEL-macos.dmg"
          test "$(readlink "$mnt/Applications")" = /Applications
          codesign --verify --deep --strict --verbose=2 "$mnt/tinyclient.app"
          codesign -dv "$mnt/tinyclient.app" 2>&1 | grep -q 'Signature=adhoc'
          for program in tinyclient chatd mediad tinyclient-login; do
            out=$("$mnt/tinyclient.app/Contents/MacOS/$program" --version)
            echo "$out"
            test "$out" = "$program $VERSION"
          done
          hdiutil detach "$mnt"
      - uses: actions/upload-artifact@v6
        with:
          name: release-macos
          path: dist/*

  linux:
    strategy:
      fail-fast: false
      matrix:
        include:
          # The oldest supported Ubuntu: the packages need the glibc they were built against or newer.
          - arch: x86_64
            runner: ubuntu-22.04
            artifact: linux-x86_64
          - arch: aarch64
            runner: ubuntu-22.04-arm
            artifact: linux-aarch64
    runs-on: ${{ matrix.runner }}
    steps:
      - uses: actions/checkout@v5
      - name: Name the files
        run: packaging/ci-label.sh >> "$GITHUB_ENV"
      - name: Reuse binaries built by CI
        id: reuse
        env:
          GH_TOKEN: ${{ github.token }}
        run: packaging/ci/reuse-binaries.sh ${{ matrix.artifact }}
      # Packaging reads the linked libraries even when the programs themselves came from CI.
      - name: Install packaging dependencies
        if: steps.reuse.outputs.found == 'true'
        run: packaging/ci/apt.sh
      - uses: ./.github/actions/setup-rust
        if: steps.reuse.outputs.found != 'true'
        with:
          cache-key: release
      - name: Build release
        if: steps.reuse.outputs.found != 'true'
        env:
          TINYCLIENT_TELEGRAM_API_ID: ${{ secrets.TINYCLIENT_TELEGRAM_API_ID }}
          TINYCLIENT_TELEGRAM_API_HASH: ${{ secrets.TINYCLIENT_TELEGRAM_API_HASH }}
        run: |
          cargo build --release \
            -p tinyclient --features tinyclient/gui \
            -p chatd -p mediad -p login
      - name: Package .deb, .rpm, AppImage and .tar.gz
        run: |
          eval "$(packaging/linux/tools.sh)"
          packaging/linux.sh --no-build "$LABEL"
      - uses: actions/upload-artifact@v6
        with:
          name: release-linux-${{ matrix.arch }}
          path: dist/*

  # Each Linux package installed on clean systems that never saw the build: the package manager
  # must find every library from the package's own dependencies, or the programs do not start.
  linux-smoke:
    needs: linux
    strategy:
      fail-fast: false
      matrix:
        include:
          - arch: x86_64
            runner: ubuntu-24.04
            image: ubuntu:24.04
            kind: deb-full
          - arch: x86_64
            runner: ubuntu-24.04
            image: debian:12
            kind: deb
          - arch: x86_64
            runner: ubuntu-24.04
            image: fedora:latest
            kind: rpm
          - arch: x86_64
            runner: ubuntu-24.04
            image: opensuse/tumbleweed
            kind: rpm
          - arch: aarch64
            runner: ubuntu-24.04-arm
            image: ubuntu:24.04
            kind: deb-full
          - arch: aarch64
            runner: ubuntu-24.04-arm
            image: debian:12
            kind: deb
          - arch: aarch64
            runner: ubuntu-24.04-arm
            image: fedora:latest
            kind: rpm
          - arch: aarch64
            runner: ubuntu-24.04-arm
            image: opensuse/tumbleweed
            kind: rpm
    runs-on: ${{ matrix.runner }}
    steps:
      - uses: actions/checkout@v5
      - name: Name the files
        run: packaging/ci-label.sh >> "$GITHUB_ENV"
      - uses: actions/download-artifact@v7
        with:
          name: release-linux-${{ matrix.arch }}
          path: dist
      - name: Install on ${{ matrix.image }}
        run: docker run --rm -v "$PWD:/w" -w /w -e LABEL -e VERSION -e ARCH=${{ matrix.arch }} ${{ matrix.image }} packaging/linux/smoke.sh ${{ matrix.kind }}

  windows:
    runs-on: windows-latest
    steps:
      - uses: actions/checkout@v5
      - name: Name the files
        shell: bash
        run: packaging/ci-label.sh >> "$GITHUB_ENV"
      - name: Reuse binaries built by CI
        id: reuse
        shell: bash
        env:
          GH_TOKEN: ${{ github.token }}
        run: packaging/ci/reuse-binaries.sh windows
      - uses: ./.github/actions/setup-rust
        if: steps.reuse.outputs.found != 'true'
        with:
          cache-key: release
      - name: Build release
        if: steps.reuse.outputs.found != 'true'
        env:
          TINYCLIENT_TELEGRAM_API_ID: ${{ secrets.TINYCLIENT_TELEGRAM_API_ID }}
          TINYCLIENT_TELEGRAM_API_HASH: ${{ secrets.TINYCLIENT_TELEGRAM_API_HASH }}
        run: |
          cargo build --release `
            -p tinyclient --features tinyclient/gui `
            -p chatd -p mediad -p login
      - name: Install Inno Setup
        shell: pwsh
        run: |
          if (-not (Get-Command iscc.exe -ErrorAction SilentlyContinue) -and -not (Test-Path "${env:ProgramFiles(x86)}\Inno Setup 6\ISCC.exe")) {
            choco install innosetup -y --no-progress
          }
      - name: Installer and portable zip
        shell: pwsh
        run: packaging/windows.ps1 -NoBuild -Label $env:LABEL
      - name: Smoke test the installer and the zip
        shell: pwsh
        run: packaging/windows/smoke.ps1 -Label $env:LABEL -Version $env:VERSION
      - uses: actions/upload-artifact@v6
        with:
          name: release-windows
          path: dist/*

  publish:
    needs: [macos, linux, linux-smoke, windows]
    runs-on: ubuntu-latest
    permissions:
      contents: write
    steps:
      - uses: actions/checkout@v5
      - name: Name the files
        run: packaging/ci-label.sh >> "$GITHUB_ENV"
      - uses: actions/download-artifact@v7
        with:
          pattern: release-*
          path: dist
          merge-multiple: true
      # Each package also goes up without the version in its name, so a fixed address
      # (releases/latest/download/tinyclient-macos.dmg, which tinyclient.io/download/macos points
      # at) always serves the newest one. SHA256SUMS covers both names.
      - name: Unversioned copies and checksums
        working-directory: dist
        run: |
          for f in "tinyclient-$LABEL-"*; do
            cp "$f" "tinyclient-${f#"tinyclient-$LABEL-"}"
          done
          sha256sum tinyclient-* > SHA256SUMS
          sha256sum -c SHA256SUMS
          ls -l
      - uses: actions/upload-artifact@v6
        with:
          name: release-all
          path: dist/*
      - id: release
        uses: softprops/action-gh-release@v3
        if: github.ref_type == 'tag' && (github.event_name == 'push' || inputs.publish)
        with:
          files: dist/*
      # The release lands in the community's #releases channel once the webhook's URL sits in
      # the DISCORD_WEBHOOK_URL secret (an admin sets it). Nothing posts while it is unset, and
      # a Discord hiccup does not fail a published release.
      - name: Post the release to Discord
        if: steps.release.outputs.url != ''
        continue-on-error: true
        env:
          DISCORD_WEBHOOK_URL: ${{ secrets.DISCORD_WEBHOOK_URL }}
          RELEASE_URL: ${{ steps.release.outputs.url }}
        run: |
          [ -n "$DISCORD_WEBHOOK_URL" ] || exit 0
          payload=$(jq -n --arg content "**tinyclient $VERSION is out.** Download: $RELEASE_URL Checksums are in SHA256SUMS on the release page." '{content: $content}')
          curl -fsS -H "Content-Type: application/json" -d "$payload" "$DISCORD_WEBHOOK_URL"