release.yml

name: Release

on:
  push:
    tags: ['v*']

permissions:
  contents: write

concurrency:
  group: release-${{ github.ref }}
  cancel-in-progress: false

jobs:
  macos:
    name: macOS (${{ matrix.arch }})
    runs-on: ${{ matrix.runner }}
    strategy:
      fail-fast: false
      matrix:
        include:
          - { arch: arm64, runner: macos-latest, racket-arch: arm64 }
          - { arch: x64, runner: macos-15-intel, racket-arch: x64 }
    steps:
      - uses: actions/checkout@v4
      - name: Set up Racket CS
        uses: Bogdanp/setup-racket@v1.15
        with:
          architecture: ${{ matrix.racket-arch }}
          distribution: full
          variant: CS
          version: '9.3'
      - name: Install Rivet (catalog)
        run: raco pkg install --auto --no-docs rivet
      - name: Version preflight (VERSION == rivet.rktd == updater == tag)
        run: bash scripts/check-release-version.sh "${{ github.ref_name }}"
      # DMG (human installer) + portable zip + SBOM + notices, launch
      # smoke included. The macOS update feed entry is the portable zip,
      # assembled by scripts/make-update-manifest.sh in the publish job.
      - name: Release (DMG + portable zip)
        run: raco rivet release --without-updates --development
      - name: Family naming + checksums
        run: |
          set -euo pipefail
          VERSION="${GITHUB_REF_NAME#v}"
          ARCH="${{ matrix.arch }}"
          cd dist
          # rivet 0.6.1 names the portable zip in family form already; only
          # the DMG lacks the architecture.
          mv "taskly-${VERSION}-macos.dmg" "taskly-${VERSION}-macos-${ARCH}.dmg"
          mv sbom.cdx.json "taskly-${VERSION}-macos-${ARCH}.sbom.cdx.json"
          mv THIRD_PARTY_NOTICES.txt "taskly-${VERSION}-macos-${ARCH}-THIRD_PARTY_NOTICES.txt"
          for f in taskly-*; do
            case "$f" in
              *.sha256) ;;
              # The sbom/notices/wixpdb bodies stay in the CI artifact only;
              # a sidecar without its body on the release is a dangling
              # reference (the 1.4.0 leftover). Checksum what we upload.
              *.sbom.cdx.json | *-THIRD_PARTY_NOTICES.txt | *.wixpdb) ;;
              *) [ -f "$f" ] || continue; [ -f "$f.sha256" ] || shasum -a 256 "$f" > "$f.sha256";;
            esac
          done
      - uses: actions/upload-artifact@v4
        with:
          name: macos-${{ matrix.arch }}
          path: dist/taskly-*

  windows:
    name: Windows (x64)
    runs-on: windows-latest
    steps:
      - uses: actions/checkout@v4
      - name: Set up Racket CS
        uses: Bogdanp/setup-racket@v1.15
        with:
          architecture: x64
          distribution: full
          variant: CS
          version: '9.3'
      - name: Install Rivet (catalog)
        shell: pwsh
        run: raco pkg install --auto --no-docs rivet
      - name: Install WiX (v5; rivet's MSI toolchain)
        run: dotnet tool install --global wix --version 5.0.2
        shell: bash
      - name: Install crypto (updater dependency)
        run: raco pkg install --auto --no-docs crypto
        shell: pwsh
      - name: Version preflight (VERSION == rivet.rktd == updater == tag)
        shell: bash
        run: bash scripts/check-release-version.sh "${{ github.ref_name }}"
      - name: Release (MSI + portable zip)
        shell: pwsh
        run: raco rivet release --without-updates --development
      - name: Family naming + checksums
        shell: bash
        run: |
          set -euo pipefail
          VERSION="${GITHUB_REF_NAME#v}"
          cd dist
          # rivet 0.6.1 names msi and portable zip in family form already.
          mv sbom.cdx.json "taskly-${VERSION}-windows-x64.sbom.cdx.json"
          mv THIRD_PARTY_NOTICES.txt "taskly-${VERSION}-windows-x64-THIRD_PARTY_NOTICES.txt"
          for f in taskly-*; do
            case "$f" in
              *.sha256) ;;
              # The sbom/notices/wixpdb bodies stay in the CI artifact only;
              # a sidecar without its body on the release is a dangling
              # reference (the 1.4.0 leftover). Checksum what we upload.
              *.sbom.cdx.json | *-THIRD_PARTY_NOTICES.txt | *.wixpdb) ;;
              *) [ -f "$f" ] || continue; [ -f "$f.sha256" ] || sha256sum "$f" > "$f.sha256";;
            esac
          done
      - uses: actions/upload-artifact@v4
        with:
          name: windows
          path: dist/taskly-*

  linux:
    name: Linux (${{ matrix.arch }})
    runs-on: ${{ matrix.runner }}
    strategy:
      fail-fast: false
      matrix:
        include:
          - { arch: x64, runner: ubuntu-latest, racket-arch: x64 }
          - { arch: arm64, runner: ubuntu-24.04-arm, racket-arch: arm64 }
    steps:
      - uses: actions/checkout@v4
      - name: Set up embeddable Racket CS
        uses: turinglambdaai/rivet/.github/actions/setup-embed-racket@main
      # Installed after the embeddable runtime so the catalog dependency
      # closure (cext-lib, crypto-lib, keel) resolves against the minimal
      # build — it ships no packages of its own. db backs taskly's storage;
      # crypto backs the updater's signing.
      - name: Install Rivet (catalog) and backend packages
        run: |
          raco pkg install --auto --no-docs rivet
          raco pkg install --auto --no-docs db crypto
      - name: Install GTK4, rpm and packaging tooling
        run: |
          sudo apt-get update
          sudo apt-get install --yes \
            libgtk-4-dev libadwaita-1-dev libjson-glib-dev libsecret-1-dev \
            libglib2.0-dev cmake ninja-build pkg-config file \
            rpm desktop-file-utils
      - name: Version preflight (VERSION == rivet.rktd == updater == tag)
        run: bash scripts/check-release-version.sh "${{ github.ref_name }}"
      # tar.gz (the update-feed payload) + deb + rpm + AppImage + portable
      # zip + SBOM, launch smoke included. The AppImage carries its own
      # GTK4 dependency closure; APPIMAGE_EXTRACT_AND_RUN lets
      # appimagetool run on the runner.
      - name: Release (tar.gz + deb + rpm + AppImage + portable zip)
        env:
          APPIMAGE_EXTRACT_AND_RUN: '1'
        run: raco rivet release --without-updates --development
      - name: Family naming + checksums
        run: |
          set -euo pipefail
          VERSION="${GITHUB_REF_NAME#v}"
          ARCH="${{ matrix.arch }}"
          cd dist
          mv sbom.cdx.json "taskly-${VERSION}-linux-${ARCH}.sbom.cdx.json"
          mv THIRD_PARTY_NOTICES.txt "taskly-${VERSION}-linux-${ARCH}-THIRD_PARTY_NOTICES.txt"
          for f in taskly-*; do
            case "$f" in
              *.sha256) ;;
              # The sbom/notices/wixpdb bodies stay in the CI artifact only;
              # a sidecar without its body on the release is a dangling
              # reference (the 1.4.0 leftover). Checksum what we upload.
              *.sbom.cdx.json | *-THIRD_PARTY_NOTICES.txt | *.wixpdb) ;;
              *) [ -f "$f" ] || continue; [ -f "$f.sha256" ] || sha256sum "$f" > "$f.sha256" ;;
            esac
          done
      - uses: actions/upload-artifact@v4
        with:
          name: linux-${{ matrix.arch }}
          path: dist/taskly-*

  publish:
    name: Publish
    needs: [macos, windows, linux]
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Set up Racket CS
        uses: Bogdanp/setup-racket@v1.15
        with:
          architecture: x64
          distribution: full
          variant: CS
          version: '9.3'
      - name: Install Rivet (catalog)
        run: raco pkg install --auto --no-docs rivet
      - uses: actions/download-artifact@v4
        with:
          path: artifacts
      - name: Gather + sign the update feed + publish
        env:
          GH_TOKEN: ${{ github.token }}
          UPDATE_ED25519_PRIVATE_KEY: ${{ secrets.UPDATE_ED25519_PRIVATE_KEY }}
        run: |
          set -euo pipefail
          VERSION="${GITHUB_REF_NAME#v}"
          mkdir -p dist
          mv artifacts/macos-arm64/* artifacts/macos-x64/* artifacts/windows/* \
             artifacts/linux-x64/* artifacts/linux-arm64/* dist/
          # The portable zips are the update feed (macOS/Windows hosts swap
          # them in place; Linux updates through the tar.gz). Missing
          # secret → warn and publish without a manifest.
          if [[ -n "${UPDATE_ED25519_PRIVATE_KEY:-}" ]]; then
            KEY_PEM="$RUNNER_TEMP/update-signing-key.pem"
            printf '%s\n' "$UPDATE_ED25519_PRIVATE_KEY" > "$KEY_PEM"
            scripts/make-update-manifest.sh "$GITHUB_REF_NAME" dist "$KEY_PEM"
          else
            echo "::warning::UPDATE_ED25519_PRIVATE_KEY not set — release ships without an update manifest"
          fi
          awk -v header="## [${VERSION}]" '
            index($0, header) == 1 {on=1; next}
            on && /^## / {exit}
            on {print}
          ' CHANGELOG.md > /tmp/notes.md
          cd dist
          for f in *.sha256; do [ -s "$f" ] || rm -f "$f"; done
          cat *.sha256 > SHA256SUMS
          gh release create "$GITHUB_REF_NAME" \
            --title "Taskly ${VERSION}" \
            --notes-file /tmp/notes.md \
            *.zip *.tar.gz *.dmg *.msi *.deb *.rpm *.AppImage \
            *.sha256 SHA256SUMS update-manifest.json