release.yml

name: Release
on:
  push:
    branches:
      - main
  workflow_dispatch:
permissions:
  contents: write
jobs:
  create-tag:
    runs-on: ubuntu-latest
    outputs:
      new_tag: ${{ steps.get_version.outputs.new_tag }}
      new_version: ${{ steps.get_version.outputs.new_version }}
    steps:
      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
      - name: Get version from package.json
        id: get_version
        run: |
          VERSION=$(node -p "require('./package.json').version")
          echo "new_version=$VERSION" >> $GITHUB_OUTPUT
          echo "new_tag=v$VERSION" >> $GITHUB_OUTPUT
          
      - name: Create and push tag
        run: |
          git config user.name "github-actions[bot]"
          git config user.email "github-actions[bot]@users.noreply.github.com"
          git tag -a "v${{ steps.get_version.outputs.new_version }}" -m "Release v${{ steps.get_version.outputs.new_version }}" || echo "Tag already exists"
          git push origin "v${{ steps.get_version.outputs.new_version }}" || echo "Tag already pushed"

  build-and-release:
    needs: create-tag
    strategy:
      matrix:
        os: [macos-latest, ubuntu-22.04, windows-latest]
    runs-on: ${{ matrix.os }}
    steps:
      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
        with:
          persist-credentials: false
      
      - name: Install Rust
        uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable
        with:
          toolchain: stable
        
      - name: Install dependencies (Ubuntu only)
        if: startsWith(matrix.os, 'ubuntu')
        run: |
          sudo apt-get update
          sudo apt-get install -y libwebkit2gtk-4.1-dev build-essential curl wget file libssl-dev libgtk-3-dev libayatana-appindicator3-dev librsvg2-dev

      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
        with:
          node-version: '22'
          
      - run: npm ci
        
      - name: Sanitize Tauri Signing Key
        shell: bash
        env:
          RAW_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
        run: |
          CLEAN_KEY=$(echo -n "$RAW_KEY" | python3 -c "import sys, urllib.parse; k = sys.stdin.read().strip(); k = k[:-1] if k.endswith('%') else k; k = urllib.parse.unquote(k) if '%' in k else k; print(k, end='')")
          echo "::add-mask::$CLEAN_KEY"
          echo "TAURI_SIGNING_PRIVATE_KEY<<EOF" >> $GITHUB_ENV
          echo "$CLEAN_KEY" >> $GITHUB_ENV
          echo "EOF" >> $GITHUB_ENV

      - name: Build and Upload Tauri App
        uses: tauri-apps/tauri-action@fce9c6108b31ea247710505d3aaaa893ee6768d4 # v0
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          TAURI_SIGNING_PRIVATE_KEY: ${{ env.TAURI_SIGNING_PRIVATE_KEY }}
          TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
        with:
          tagName: ${{ needs.create-tag.outputs.new_tag }}
          releaseName: 'PaperCache ${{ needs.create-tag.outputs.new_tag }}'
          releaseBody: 'See the assets to download this version and install.'
          releaseDraft: false
          prerelease: false
          updaterJsonPreferNsis: true

  update-homebrew:
    needs: [create-tag, build-and-release]
    runs-on: macos-latest
    steps:
      - name: Checkout Homebrew Tap
        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
        with:
          repository: VariableThe/homebrew-tap
          token: ${{ secrets.HOMEBREW_TAP_TOKEN }}
          path: homebrew-tap

      - name: Download macOS App
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          VERSION=${{ needs.create-tag.outputs.new_version }}
          gh release download v$VERSION --pattern "*aarch64.app.tar.gz" --repo $GITHUB_REPOSITORY
          
          # Calculate SHA256 of the downloaded archive
          APP_FILE=$(ls *aarch64.app.tar.gz | head -n 1)
          SHA256=$(shasum -a 256 "$APP_FILE" | awk '{ print $1 }')
          
          # Update the rb file
          cd homebrew-tap
          sed -i '' "s/url .*/url \"https:\/\/github.com\/VariableThe\/PaperCache\/releases\/download\/v$VERSION\/$APP_FILE\"/" Casks/papercache.rb
          sed -i '' "s/version \".*\"/version \"$VERSION\"/" Casks/papercache.rb
          sed -i '' "s/sha256 arm: * \".*\"/sha256 arm:   \"$SHA256\"/" Casks/papercache.rb
          
          # Commit and Push
          git config user.name "github-actions[bot]"
          git config user.email "github-actions[bot]@users.noreply.github.com"
          git add Casks/papercache.rb
          git commit -m "Bump PaperCache to $VERSION" || echo "No changes to commit"
          git push