Firelink/.github/workflows/release.yml

name: Release

on:
  push:
    tags: ['v*']
  workflow_dispatch:
    inputs:
      publish_release:
        description: 'Publish the GitHub release after all platform QA is certified'
        type: boolean
        default: false
      certified_cross_platform:
        description: 'Confirm Windows, Linux, and macOS clean-machine QA passed'
        type: boolean
        default: false

permissions:
  contents: write

jobs:
  build:
    name: Build ${{ matrix.label }}
    strategy:
      fail-fast: false
      matrix:
        include:
          - label: macOS-arm64
            os: macos-latest
            target: aarch64-apple-darwin
            bundles: app,dmg
            artifact: src-tauri/target/aarch64-apple-darwin/release/bundle/dmg/*.dmg
          - label: Windows-x64
            os: windows-latest
            target: x86_64-pc-windows-msvc
            bundles: nsis
            artifact: src-tauri/target/x86_64-pc-windows-msvc/release/bundle/nsis/*.exe
          - label: Linux-x64-AppImage
            os: ubuntu-22.04
            target: x86_64-unknown-linux-gnu
            bundles: appimage
            artifact: src-tauri/target/x86_64-unknown-linux-gnu/release/bundle/appimage/*.AppImage
    runs-on: ${{ matrix.os }}
    steps:
      - uses: actions/checkout@v6
        with:
          submodules: recursive
      - uses: actions/setup-node@v6
        with:
          node-version: 22
          cache: npm
      - uses: dtolnay/rust-toolchain@stable
        with:
          targets: ${{ matrix.target }}
      - name: Install Linux dependencies
        if: runner.os == 'Linux'
        run: |
          sudo apt-get update
          sudo apt-get install -y \
            libwebkit2gtk-4.1-dev \
            libappindicator3-dev \
            librsvg2-dev \
            patchelf \
            libdbus-1-dev \
            pkg-config \
            xvfb \
            libtinfo5
      - run: npm ci
      - name: Provision locked engines
        if: runner.os != 'macOS'
        run: node scripts/provision-engines.js --target ${{ matrix.target }}
      - name: Hide _internal from linuxdeploy (Linux only)
        if: runner.os == 'Linux'
        run: |
          # Patch tauri.conf.json's beforeBuildCommand to delete _internal from engine-dist 
          # AFTER stage-engines.js verifies it, but BEFORE tauri builds the bundle.
          # This hides it from linuxdeploy. We will repack it into the AppImage later.
          sed -i 's/npm run build/rm -rf src-tauri\/engine-dist\/${{ matrix.target }}\/_internal \&\& npm run build/' src-tauri/tauri.conf.json
      - name: Build package
        run: npm run tauri build -- -vv --target ${{ matrix.target }} --bundles ${{ matrix.bundles }}
        env:
          APPIMAGE_EXTRACT_AND_RUN: 1
      - name: Repack AppImage with _internal (Linux only)
        if: runner.os == 'Linux'
        run: |
          APPDIR="src-tauri/target/${{ matrix.target }}/release/bundle/appimage/Firelink.AppDir"
          # Copy _internal directly from provisioned-engines into the AppDir
          cp -r src-tauri/provisioned-engines/${{ matrix.target }}/_internal "$APPDIR/usr/lib/Firelink/engine-dist/${{ matrix.target }}/_internal"
          
          # Download appimagetool
          wget -qO appimagetool https://github.com/AppImage/AppImageKit/releases/download/continuous/appimagetool-x86_64.AppImage
          chmod +x appimagetool
          
          # Find the original AppImage name to overwrite
          APPIMAGE=$(ls src-tauri/target/${{ matrix.target }}/release/bundle/appimage/*.AppImage | head -n 1)
          
          # Repack the AppImage
          env APPIMAGE_EXTRACT_AND_RUN=1 ARCH=x86_64 ./appimagetool "$APPDIR" "$APPIMAGE"
      - name: Verify macOS packaged engines and launch
        if: runner.os == 'macOS'
        run: |
          APP="src-tauri/target/${{ matrix.target }}/release/bundle/macos/Firelink.app"
          node scripts/verify-binaries.js --search-root "$APP" --target ${{ matrix.target }}
          node scripts/smoke-packaged-app.js --executable "$APP/Contents/MacOS/firelink"
      - name: Verify Windows installer payload
        if: runner.os == 'Windows'
        shell: pwsh
        run: |
          $installer = Get-ChildItem "src-tauri/target/${{ matrix.target }}/release/bundle/nsis/*.exe" | Select-Object -First 1
          7z x $installer.FullName "-o$env:RUNNER_TEMP/firelink-installer" -y
          node scripts/verify-binaries.js --search-root "$env:RUNNER_TEMP/firelink-installer" --target ${{ matrix.target }}
      - name: Verify Linux AppImage payload and launch
        if: runner.os == 'Linux'
        run: |
          APPIMAGE="$(find src-tauri/target/${{ matrix.target }}/release/bundle/appimage -name '*.AppImage' -print -quit)"
          chmod +x "$APPIMAGE"
          (cd "$RUNNER_TEMP" && "$GITHUB_WORKSPACE/$APPIMAGE" --appimage-extract >/dev/null)
          node scripts/verify-binaries.js --search-root "$RUNNER_TEMP/squashfs-root" --target ${{ matrix.target }}
          xvfb-run -a node scripts/smoke-packaged-app.js --executable "$RUNNER_TEMP/squashfs-root/AppRun"
      - uses: actions/upload-artifact@v4
        with:
          name: Firelink-${{ matrix.label }}-${{ github.ref_name }}
          path: ${{ matrix.artifact }}
          if-no-files-found: error

  publish:
    name: Publish GitHub release
    if: >-
      github.event_name == 'workflow_dispatch' &&
      startsWith(github.ref, 'refs/tags/v') &&
      inputs.publish_release &&
      inputs.certified_cross_platform
    needs: build
    runs-on: ubuntu-22.04
    steps:
      - uses: actions/download-artifact@v4
        with:
          path: release-assets
          merge-multiple: true
      - name: Generate checksums
        run: |
          cd release-assets
          find . -type f -print0 | sort -z | xargs -0 sha256sum > SHA256SUMS
      - uses: softprops/action-gh-release@v2
        with:
          files: release-assets/**
          generate_release_notes: true