Firelink/.github/workflows/release.yml

name: Release

on:
  push:
    tags: ['v*']
  workflow_dispatch:
    inputs:
      publish_release:
        description: 'Publish the GitHub release after all platform QA is certified'
        type: boolean
        default: false
      certified_cross_platform:
        description: 'Confirm Windows, Linux, and macOS clean-machine QA passed'
        type: boolean
        default: false

permissions:
  contents: write

jobs:
  build:
    name: Build ${{ matrix.label }}
    strategy:
      fail-fast: false
      matrix:
        include:
          - label: macOS-arm64
            os: macos-26
            target: aarch64-apple-darwin
            bundles: app,dmg
            artifact: src-tauri/target/aarch64-apple-darwin/release/bundle/dmg/*.dmg
          - label: Windows-x64
            os: windows-latest
            target: x86_64-pc-windows-msvc
            bundles: nsis
            artifact: src-tauri/target/x86_64-pc-windows-msvc/release/bundle/nsis/*.exe
          - label: Linux-x64-AppImage
            os: ubuntu-22.04
            target: x86_64-unknown-linux-gnu
            bundles: appimage
            artifact: src-tauri/target/x86_64-unknown-linux-gnu/release/bundle/appimage/*.AppImage
    runs-on: ${{ matrix.os }}
    steps:
      - uses: actions/checkout@v7
        with:
          submodules: recursive
      - uses: actions/setup-node@v6
        with:
          node-version: 22
          cache: npm
      - uses: dtolnay/rust-toolchain@stable
        with:
          targets: ${{ matrix.target }}
      - name: Install Linux dependencies
        if: runner.os == 'Linux'
        run: |
          sudo apt-get update
          sudo apt-get install -y \
            libwebkit2gtk-4.1-dev \
            libappindicator3-dev \
            librsvg2-dev \
            appstream \
            curl \
            patchelf \
            libdbus-1-dev \
            pkg-config \
            xvfb \
            libtinfo5
      - run: npm ci
      - name: Provision locked engines
        if: runner.os != 'macOS'
        run: node scripts/provision-engines.js --target ${{ matrix.target }}
      - name: Build package
        run: npm run tauri build -- -vv --target ${{ matrix.target }} --bundles ${{ matrix.bundles }}
        env:
          APPIMAGE_EXTRACT_AND_RUN: 1
          FIRELINK_OMIT_ENGINE_DIST_FOR_TAURI_BUNDLE: ${{ runner.os == 'Linux' && '1' || '' }}
      - name: Install pinned appimagetool (Linux only)
        if: runner.os == 'Linux'
        env:
          APPIMAGETOOL_URL: https://github.com/AppImage/appimagetool/releases/download/continuous/appimagetool-x86_64.AppImage
          APPIMAGETOOL_SHA256: a6d71e2b6cd66f8e8d16c37ad164658985e0cf5fcaa950c90a482890cb9d13e0
        run: |
          curl -fsSL "$APPIMAGETOOL_URL" -o "$RUNNER_TEMP/appimagetool"
          echo "$APPIMAGETOOL_SHA256  $RUNNER_TEMP/appimagetool" | sha256sum -c -
          chmod +x "$RUNNER_TEMP/appimagetool"
      - name: Repack AppImage with engines (Linux only)
        if: runner.os == 'Linux'
        run: node scripts/repack-linux-appimage-engines.js --target ${{ matrix.target }} --appimagetool "$RUNNER_TEMP/appimagetool"
      - name: Verify macOS packaged engines and launch
        if: runner.os == 'macOS'
        run: |
          APP="src-tauri/target/${{ matrix.target }}/release/bundle/macos/Firelink.app"
          node scripts/verify-binaries.js --search-root "$APP" --target ${{ matrix.target }}
          node scripts/smoke-packaged-app.js --executable "$APP/Contents/MacOS/firelink"
      - name: Verify Windows installer payload and launch
        if: runner.os == 'Windows'
        shell: pwsh
        run: |
          $installer = Get-ChildItem "src-tauri/target/${{ matrix.target }}/release/bundle/nsis/*.exe" | Select-Object -First 1
          if (-not $installer) { throw "Windows NSIS installer artifact was not produced." }
          $extractRoot = "$env:RUNNER_TEMP/firelink-installer"
          Remove-Item -Recurse -Force $extractRoot -ErrorAction SilentlyContinue
          7z x $installer.FullName "-o$extractRoot" -y
          node scripts/verify-binaries.js --search-root "$extractRoot" --target ${{ matrix.target }}
          $installRoot = "$env:RUNNER_TEMP\FirelinkSmoke"
          Remove-Item -Recurse -Force $installRoot -ErrorAction SilentlyContinue
          $install = Start-Process -FilePath $installer.FullName -ArgumentList @("/S", "/D=$installRoot") -Wait -PassThru
          if ($install.ExitCode -ne 0) { throw "Silent NSIS install failed with exit code $($install.ExitCode)." }
          $exe = $null
          foreach ($attempt in 1..60) {
            $exe = Get-ChildItem $installRoot -Recurse -File -ErrorAction SilentlyContinue | Where-Object { $_.Name -ieq "firelink.exe" } | Sort-Object FullName | Select-Object -First 1
            if ($exe) { break }
            Start-Sleep -Seconds 1
          }
          if (-not $exe) { throw "firelink.exe was not found under $installRoot after silent install." }
          node scripts/smoke-packaged-app.js --executable $exe.FullName --assert-no-visible-child-windows
      - name: Verify Linux AppImage payload and launch
        if: runner.os == 'Linux'
        run: |
          APPIMAGE="$(find src-tauri/target/${{ matrix.target }}/release/bundle/appimage -name '*.AppImage' -print -quit)"
          chmod +x "$APPIMAGE"
          (cd "$RUNNER_TEMP" && "$GITHUB_WORKSPACE/$APPIMAGE" --appimage-extract >/dev/null)
          node scripts/verify-binaries.js --search-root "$RUNNER_TEMP/squashfs-root" --target ${{ matrix.target }}
          xvfb-run -a node scripts/smoke-packaged-app.js --executable "$RUNNER_TEMP/squashfs-root/AppRun"
      - uses: actions/upload-artifact@v7
        with:
          name: Firelink-${{ matrix.label }}-${{ github.ref_name }}
          path: ${{ matrix.artifact }}
          if-no-files-found: error
          retention-days: 3

  publish:
    name: Publish GitHub release
    if: >-
      github.event_name == 'workflow_dispatch' &&
      startsWith(github.ref, 'refs/tags/v') &&
      inputs.publish_release &&
      inputs.certified_cross_platform
    needs: build
    runs-on: ubuntu-22.04
    steps:
      - uses: actions/checkout@v7
      - uses: actions/download-artifact@v8
        with:
          path: release-assets
          merge-multiple: true
      - name: Extract changelog release notes
        shell: bash
        run: |
          VERSION="${GITHUB_REF_NAME#v}"
          awk '/^## \['"$VERSION"'\]/{flag=1; next} /^## \[/{if(flag) exit} flag' CHANGELOG.md > release_notes.md
          test -s release_notes.md
      - name: Normalize release asset names
        shell: bash
        run: |
          VERSION="${GITHUB_REF_NAME#v}"
          rename_asset() {
            local pattern="$1"
            local destination="$2"
            local source
            source="$(find release-assets -maxdepth 1 -type f -name "$pattern" -print -quit)"
            if [[ -z "$source" ]]; then
              echo "::error::Missing release asset matching $pattern"
              exit 1
            fi
            mv "$source" "release-assets/$destination"
          }

          rename_asset '*.dmg' "Firelink_${VERSION}_macOS-ARM64.dmg"
          rename_asset '*.AppImage' "Firelink_${VERSION}_Linux-x64.AppImage"
          rename_asset '*.exe' "Firelink_${VERSION}_Windows-x64-setup.exe"
      - name: Generate checksums
        run: |
          cd release-assets
          find . -type f ! -name SHA256SUMS -print0 | sort -z | xargs -0 sha256sum > SHA256SUMS
      - uses: softprops/action-gh-release@v3
        with:
          files: release-assets/**
          body_path: release_notes.md