Qopy/.github/workflows/build.yml

name: "Nightly Builds"

on:
  push:
    branches:
      - main
  pull_request:
    branches:
      - main
  workflow_dispatch:

jobs:
  prepare:
    runs-on: ubuntu-latest
    outputs:
      version: ${{ steps.get_version.outputs.VERSION }}
    steps:
      - uses: actions/checkout@v4
      - name: Get version
        id: get_version
        run: echo "VERSION=$(node -p "require('./src-tauri/tauri.conf.json').version")" >> $GITHUB_OUTPUT

  build-macos:
    needs: prepare
    strategy:
      matrix:
        include:
          - args: "--target aarch64-apple-darwin"
            arch: "silicon"
          - args: "--target x86_64-apple-darwin"
            arch: "intel"
    runs-on: macos-latest
    env:
      APPLE_ID: ${{ secrets.APPLE_ID }}
      APPLE_ID_PASSWORD: ${{ secrets.APPLE_ID_PASSWORD }}
      TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
    steps:
      - uses: actions/checkout@v4
      - name: Redact Sensitive Information
        run: |
          function redact_output {
            sed -e "s/${{ secrets.REDACT_PATTERN }}/REDACTED/g"
          }
          exec > >(redact_output) 2>&1
      - uses: actions/setup-node@v4
        with:
          node-version: 20
      - uses: dtolnay/rust-toolchain@stable
        with:
          targets: aarch64-apple-darwin,x86_64-apple-darwin
      - uses: swatinem/rust-cache@v2
        with:
          workspaces: "src-tauri -> target"
          cache-directories: "~/.cargo/registry/index/,~/.cargo/registry/cache/,~/.cargo/git/db/"
          shared-key: "macos-rust-cache"
          save-if: "true"
      - uses: actions/cache@v4
        with:
          path: ~/.pnpm-store
          key: ${{ runner.os }}-pnpm-${{ hashFiles('**/pnpm-lock.yaml') }}
          restore-keys: |
            ${{ runner.os }}-pnpm-
      - run: npm install -g pnpm && pnpm install
      - name: Import Apple Developer Certificate
        env:
          APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }}
          APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
          KEYCHAIN_PASSWORD: ${{ secrets.KEYCHAIN_PASSWORD }}
        run: |
          echo $APPLE_CERTIFICATE | base64 --decode > certificate.p12
          security create-keychain -p "$KEYCHAIN_PASSWORD" build.keychain
          security default-keychain -s build.keychain
          security unlock-keychain -p "$KEYCHAIN_PASSWORD" build.keychain
          security import certificate.p12 -k build.keychain -P "$APPLE_CERTIFICATE_PASSWORD" -T /usr/bin/codesign
          security set-key-partition-list -S apple-tool:,apple:,codesign: -s -k "$KEYCHAIN_PASSWORD" build.keychain
          security find-identity -v -p codesigning build.keychain
      - name: Verify Certificate
        run: |
          CERT_INFO=$(security find-identity -v -p codesigning build.keychain | grep "Apple Development")
          CERT_ID=$(echo "$CERT_INFO" | awk -F'"' '{print $2}')
          echo "CERT_ID=$CERT_ID" >> $GITHUB_ENV
          echo "Certificate imported."
      - uses: tauri-apps/tauri-action@v0
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }}
          APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
          TAURI_PRIVATE_KEY: ${{ secrets.TAURI_PRIVATE_KEY }}
          TAURI_KEY_PASSWORD: ${{ secrets.TAURI_KEY_PASSWORD }}
          APPLE_SIGNING_IDENTITY: ${{ env.CERT_ID }}
        with:
          args: ${{ matrix.args }}
      - name: Debug Signing Process
        if: failure()
        run: |
          echo "Attempting manual signing:"
          codesign --force --options runtime --sign "$CERT_ID" --entitlements src-tauri/entitlements.plist src-tauri/target/aarch64-apple-darwin/release/bundle/macos/Qopy.app
          echo "Verifying signature:"
          codesign -dv --verbose=4 src-tauri/target/aarch64-apple-darwin/release/bundle/macos/Qopy.app | sed 's/.*Authority=.*/Authority=REDACTED/'
      - name: Rename and Publish macOS Artifacts
        run: |
          mv src-tauri/target/${{ matrix.args == '--target aarch64-apple-darwin' && 'aarch64-apple-darwin' || 'x86_64-apple-darwin' }}/release/bundle/dmg/*.dmg src-tauri/target/${{ matrix.args == '--target aarch64-apple-darwin' && 'aarch64-apple-darwin' || 'x86_64-apple-darwin' }}/release/bundle/dmg/Qopy-${{ needs.prepare.outputs.version }}_${{ matrix.arch }}.dmg
          mv src-tauri/target/${{ matrix.args == '--target aarch64-apple-darwin' && 'aarch64-apple-darwin' || 'x86_64-apple-darwin' }}/release/bundle/macos/*.app.tar.gz src-tauri/target/${{ matrix.args == '--target aarch64-apple-darwin' && 'aarch64-apple-darwin' || 'x86_64-apple-darwin' }}/release/bundle/macos/Qopy-${{ needs.prepare.outputs.version }}_${{ matrix.arch }}.app.tar.gz
          mv src-tauri/target/${{ matrix.args == '--target aarch64-apple-darwin' && 'aarch64-apple-darwin' || 'x86_64-apple-darwin' }}/release/bundle/macos/*.app.tar.gz.sig src-tauri/target/${{ matrix.args == '--target aarch64-apple-darwin' && 'aarch64-apple-darwin' || 'x86_64-apple-darwin' }}/release/bundle/macos/Qopy-${{ needs.prepare.outputs.version }}_${{ matrix.arch }}.app.tar.gz.sig
      - uses: actions/upload-artifact@v4
        with:
          name: build-macos-dmg-${{ matrix.arch }}
          path: src-tauri/target/${{ matrix.args == '--target aarch64-apple-darwin' && 'aarch64-apple-darwin' || 'x86_64-apple-darwin' }}/release/bundle/dmg/*.dmg
      - uses: actions/upload-artifact@v4
        with:
          name: updater-files-macos-${{ matrix.arch }}
          path: |
            src-tauri/target/${{ matrix.args == '--target aarch64-apple-darwin' && 'aarch64-apple-darwin' || 'x86_64-apple-darwin' }}/release/bundle/macos/*.app.tar.gz
            src-tauri/target/${{ matrix.args == '--target aarch64-apple-darwin' && 'aarch64-apple-darwin' || 'x86_64-apple-darwin' }}/release/bundle/macos/*.app.tar.gz.sig

  build-windows:
    needs: prepare
    strategy:
      matrix:
        include:
          - args: "--target x86_64-pc-windows-msvc"
            arch: "x64"
            target: "x86_64-pc-windows-msvc"
          - args: "--target aarch64-pc-windows-msvc"
            arch: "arm64"
            target: "aarch64-pc-windows-msvc"
    runs-on: windows-latest
    env:
      TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: 20
      - uses: dtolnay/rust-toolchain@stable
        with:
          targets: x86_64-pc-windows-msvc,aarch64-pc-windows-msvc
      - uses: swatinem/rust-cache@v2
        with:
          workspaces: "src-tauri -> target"
          cache-directories: "~/.cargo/registry/index/,~/.cargo/registry/cache/,~/.cargo/git/db/"
          shared-key: "windows-rust-cache"
          save-if: "true"
      - uses: actions/cache@v4
        with:
          path: ~/.pnpm-store
          key: ${{ runner.os }}-pnpm-${{ hashFiles('**/pnpm-lock.yaml') }}
          restore-keys: |
            ${{ runner.os }}-pnpm-
      - run: npm install -g pnpm && pnpm install
      - uses: tauri-apps/tauri-action@v0
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
      - name: List Build Directories
        shell: pwsh
        run: |
          Write-Output "Checking build directories..."
          Get-ChildItem -Path "src-tauri/target" -Recurse -Directory | Where-Object { $_.Name -eq "msi" } | ForEach-Object {
            Write-Output "Found MSI directory: $($_.FullName)"
            Get-ChildItem -Path $_.FullName -Filter "*.msi" | ForEach-Object {
              Write-Output "Found MSI file: $($_.FullName)"
            }
          }

      - name: Rename Windows Artifacts
        shell: pwsh
        run: |
          $targetPath = "src-tauri/target/${{ matrix.target }}/release/bundle/msi"
          $version = "${{ needs.prepare.outputs.version }}"
          $arch = "${{ matrix.arch }}"
          
          Write-Output "Looking for MSI files in: $targetPath"
          
          if (!(Test-Path $targetPath)) {
            Write-Error "Target path does not exist: $targetPath"
            Write-Output "Available directories:"
            Get-ChildItem -Path "src-tauri/target" -Recurse -Directory | Format-Table -Property FullName
            exit 1
          }
          
          $msiFiles = Get-ChildItem -Path "$targetPath/*.msi" -ErrorAction SilentlyContinue
          if ($null -eq $msiFiles) {
            Write-Error "No MSI files found in: $targetPath"
            exit 1
          }
          
          foreach ($file in $msiFiles) {
            $newName = "Qopy-${version}_${arch}.msi"
            Write-Output "Renaming $($file.Name) to $newName"
            Rename-Item -Path $file.FullName -NewName $newName -ErrorAction Stop
          }

      - uses: actions/upload-artifact@v4
        with:
          name: windows-${{ matrix.arch }}-binaries
          path: |
            src-tauri/target/${{ matrix.target }}/release/bundle/msi/*.msi
            src-tauri/target/${{ matrix.target }}/release/bundle/msi/*.msi.sig

  build-ubuntu:
    needs: prepare
    strategy:
      matrix:
        include:
          - target: "x86_64-unknown-linux-gnu"
            arch: "x64"
          - target: "aarch64-unknown-linux-gnu"
            arch: "arm64"
    runs-on: ubuntu-latest
    env:
      TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: 20
      - uses: dtolnay/rust-toolchain@stable
        with:
          targets: ${{ matrix.target }}
      - uses: swatinem/rust-cache@v2
        with:
          workspaces: "src-tauri -> target"
          cache-directories: "~/.cargo/registry/index/,~/.cargo/registry/cache/,~/.cargo/git/db/"
          shared-key: "ubuntu-rust-cache"
          save-if: "true"
      - uses: actions/cache@v4
        with:
          path: ~/.pnpm-store
          key: ${{ runner.os }}-pnpm-${{ hashFiles('**/pnpm-lock.yaml') }}
          restore-keys: |
            ${{ runner.os }}-pnpm-
      - name: Install dependencies
        run: |
          sudo dpkg --add-architecture arm64
          # Update sources.list to use jammy (22.04)
          sudo sed -i 's/noble/jammy/g' /etc/apt/sources.list
          sudo apt update
          sudo apt install -y libwebkit2gtk-4.1-dev build-essential curl wget file libssl-dev libayatana-appindicator3-dev librsvg2-dev libasound2-dev rpm
          sudo apt install -y gcc-aarch64-linux-gnu g++-aarch64-linux-gnu
          
          if [ "${{ matrix.target }}" = "aarch64-unknown-linux-gnu" ]; then
            # Install ARM64 dependencies from jammy
            sudo apt install -y \
              libwebkit2gtk-4.1-dev:arm64 \
              libssl-dev:arm64 \
              libayatana-appindicator3-dev:arm64 \
              librsvg2-dev:arm64 \
              libasound2-dev:arm64
            
            # Set up cross-compilation environment
            echo "PKG_CONFIG_ALLOW_CROSS=1" >> $GITHUB_ENV
            echo "PKG_CONFIG_PATH=/usr/lib/aarch64-linux-gnu/pkgconfig" >> $GITHUB_ENV
            echo "CARGO_TARGET_AARCH64_UNKNOWN_LINUX_GNU_LINKER=aarch64-linux-gnu-gcc" >> $GITHUB_ENV
          fi
      - run: npm install -g pnpm && pnpm install
      - uses: tauri-apps/tauri-action@v0
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        with:
          args: --target ${{ matrix.target }}
      - name: Rename Linux Artifacts
        run: |
          mv src-tauri/target/${{ matrix.target }}/release/bundle/deb/*.deb src-tauri/target/${{ matrix.target }}/release/bundle/deb/Qopy-${{ needs.prepare.outputs.version }}_${{ matrix.arch }}.deb
          mv src-tauri/target/${{ matrix.target }}/release/bundle/appimage/*.AppImage src-tauri/target/${{ matrix.target }}/release/bundle/appimage/Qopy-${{ needs.prepare.outputs.version }}_${{ matrix.arch }}.AppImage
          mv src-tauri/target/${{ matrix.target }}/release/bundle/appimage/*.AppImage.sig src-tauri/target/${{ matrix.target }}/release/bundle/appimage/Qopy-${{ needs.prepare.outputs.version }}_${{ matrix.arch }}.AppImage.sig
          mv src-tauri/target/${{ matrix.target }}/release/bundle/rpm/*.rpm src-tauri/target/${{ matrix.target }}/release/bundle/rpm/Qopy-${{ needs.prepare.outputs.version }}_${{ matrix.arch }}.rpm
      - uses: actions/upload-artifact@v4
        with:
          name: linux-${{ matrix.arch }}-binaries
          path: |
            src-tauri/target/${{ matrix.target }}/release/bundle/deb/*.deb
            src-tauri/target/${{ matrix.target }}/release/bundle/appimage/*.AppImage
            src-tauri/target/${{ matrix.target }}/release/bundle/appimage/*.AppImage.sig
            src-tauri/target/${{ matrix.target }}/release/bundle/rpm/*.rpm