release.yml

name: Build and Upload Release Assets

on:
  workflow_run:
    workflows: ["Create draft release"]
    types: [completed]
  release:
    types: [released]

permissions:
  contents: write

jobs:
  build:
    if: github.event_name == 'workflow_run' && github.event.workflow_run.conclusion == 'success'
    strategy:
      fail-fast: false
      matrix:
        include:
          - os: macos-26
            platform: macos
            arch: aarch64
            target: aarch64-apple-darwin
          - os: macos-14
            platform: macos
            arch: x86_64
            target: x86_64-apple-darwin
          - os: windows-latest
            platform: windows
            arch: x86_64
            target: x86_64-pc-windows-msvc
          - os: ubuntu-22.04
            platform: linux
            arch: x86_64
            target: x86_64-unknown-linux-gnu

    runs-on: ${{ matrix.os }}

    steps:
      - name: Resolve release tag
        shell: bash
        run: |
          TAG="${{ github.event.workflow_run.head_branch }}"
          if [ -z "$TAG" ]; then
            echo "::error::Failed to resolve release tag from workflow_run.head_branch"
            exit 1
          fi
          echo "RELEASE_TAG=$TAG" >> "$GITHUB_ENV"
          echo "Resolved release tag: $TAG"

      - name: Checkout code
        uses: actions/checkout@v4
        with:
          ref: ${{ env.RELEASE_TAG }}

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: "22"
          cache: "npm"

      - name: Setup Rust
        uses: dtolnay/rust-toolchain@stable
        with:
          targets: ${{ matrix.target }}

      - name: Rust cache
        uses: swatinem/rust-cache@v2
        with:
          workspaces: src-tauri
          cache-targets: true
          cache-all-crates: true
          key: ${{ matrix.target }}

      - name: Install Linux dependencies
        if: matrix.platform == 'linux'
        run: |
          sudo apt-get update
          sudo apt-get install -y \
            libwebkit2gtk-4.1-dev \
            libappindicator3-dev \
            librsvg2-dev \
            patchelf \
            libssl-dev \
            libgtk-3-dev \
            libsoup-3.0-dev \
            libjavascriptcoregtk-4.1-dev

      - name: Install dependencies
        run: npm ci

      - name: Set version from tag
        shell: bash
        run: |
          VERSION=${RELEASE_TAG#v}
          # MSI requires pure numeric version (no pre-release suffix like -rc.1)
          # Strip pre-release suffix for bundle version on Windows
          BUNDLE_VERSION=$(echo "$VERSION" | sed 's/-.*//')
          echo "VERSION=$VERSION" >> "$GITHUB_ENV"
          echo "BUNDLE_VERSION=$BUNDLE_VERSION" >> "$GITHUB_ENV"

          # Use BUNDLE_VERSION for tauri.conf.json (bundler compatibility, e.g. MSI requires pure numeric version)
          # Use full VERSION (including any -rc.x suffix) for Cargo.toml so it stays aligned with the git tag
          node -e "
            const fs = require('fs');
            const conf = JSON.parse(fs.readFileSync('src-tauri/tauri.conf.json', 'utf8'));
            conf.version = '$BUNDLE_VERSION';
            fs.writeFileSync('src-tauri/tauri.conf.json', JSON.stringify(conf, null, 2) + '\n');
          "
          sed -i.bak "s/^version = \".*\"/version = \"$VERSION\"/" src-tauri/Cargo.toml
          rm -f src-tauri/Cargo.toml.bak
          echo "Tag version: $VERSION, Bundle version: $BUNDLE_VERSION"

      - name: Fetch catalog snapshot for bundling
        shell: bash
        run: |
          mkdir -p src-tauri/bundled-catalog
          CATALOG_BASE="https://tiylabs.github.io/tiycore/catalog"
          curl -sSfL "$CATALOG_BASE/manifest.json" \
            -o src-tauri/bundled-catalog/catalog.manifest.json \
            --retry 3 --max-time 30
          curl -sSfL "$CATALOG_BASE/catalog.json" \
            -o src-tauri/bundled-catalog/catalog.json \
            --retry 3 --max-time 60
          echo "Catalog snapshot bundled:"
          ls -la src-tauri/bundled-catalog/
          cat src-tauri/bundled-catalog/catalog.manifest.json

      - name: Build Tauri app
        uses: tauri-apps/tauri-action@v0
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          # Updater signing key (required for createUpdaterArtifacts)
          TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
          TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
          # Only sign, do NOT notarize via tauri-action (we submit async below)
          APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }}
          APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
          APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
        with:
          tauriScript: npx tauri
          args: --target ${{ matrix.target }}
          releaseId: ""

      - name: Submit notarization (async)
        if: matrix.platform == 'macos'
        continue-on-error: true
        run: |
          BUNDLE_DIR="src-tauri/target/${{ matrix.target }}/release/bundle"
          for dmg in "$BUNDLE_DIR"/dmg/*.dmg; do
            [ -f "$dmg" ] || continue
            echo "Submitting $dmg for notarization..."
            xcrun notarytool submit "$dmg" \
              --apple-id "$APPLE_ID" \
              --password "$APPLE_APP_SPECIFIC_PASSWORD" \
              --team-id "$APPLE_TEAM_ID"
          done
        env:
          APPLE_ID: ${{ secrets.APPLE_ID }}
          APPLE_APP_SPECIFIC_PASSWORD: ${{ secrets.APPLE_APP_SPECIFIC_PASSWORD }}
          APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}

      - name: Collect release artifacts
        shell: bash
        run: |
          mkdir -p release-artifacts
          BUNDLE_DIR="src-tauri/target/${{ matrix.target }}/release/bundle"

          if [ "${{ matrix.platform }}" = "macos" ]; then
            cp "$BUNDLE_DIR"/dmg/*.dmg release-artifacts/ 2>/dev/null || true
            # Updater artifacts: Tauri produces generic TiyCode.app.tar.gz — rename to include arch
            ARCH_SUFFIX="${{ matrix.arch }}"
            for f in "$BUNDLE_DIR"/macos/*.app.tar.gz; do
              [ -f "$f" ] || continue
              BASENAME=$(basename "$f")
              # TiyCode.app.tar.gz → TiyCode_${ARCH_SUFFIX}.app.tar.gz
              RENAMED="${BASENAME/.app.tar.gz/_${ARCH_SUFFIX}.app.tar.gz}"
              cp "$f" "release-artifacts/${RENAMED}"
            done
            for f in "$BUNDLE_DIR"/macos/*.app.tar.gz.sig; do
              [ -f "$f" ] || continue
              BASENAME=$(basename "$f")
              RENAMED="${BASENAME/.app.tar.gz.sig/_${ARCH_SUFFIX}.app.tar.gz.sig}"
              cp "$f" "release-artifacts/${RENAMED}"
            done
          elif [ "${{ matrix.platform }}" = "windows" ]; then
            # NSIS installer + updater signature
            cp "$BUNDLE_DIR"/nsis/*-setup.exe release-artifacts/ 2>/dev/null || true
            cp "$BUNDLE_DIR"/nsis/*-setup.exe.sig release-artifacts/ 2>/dev/null || true
            # MSI installer + updater signature
            cp "$BUNDLE_DIR"/msi/*.msi release-artifacts/ 2>/dev/null || true
            cp "$BUNDLE_DIR"/msi/*.msi.sig release-artifacts/ 2>/dev/null || true

            echo "Windows release-artifacts contents after copy:"
            find release-artifacts -maxdepth 1 -type f | sort || true

            if [[ "$VERSION" != *-* ]]; then
              # Tauri v2 createUpdaterArtifacts: true signs installers directly (no .zip wrapping)
              if ! find release-artifacts -maxdepth 1 -type f \( -name '*-setup.exe.sig' -o -name '*.msi.sig' \) | grep -q .; then
                echo "::error::Stable Windows release is missing updater signature artifacts."
                echo "Expected .exe.sig or .msi.sig files, but none were collected."
                exit 1
              fi
            fi
          elif [ "${{ matrix.platform }}" = "linux" ]; then
            cp "$BUNDLE_DIR"/deb/*.deb release-artifacts/ 2>/dev/null || true
            cp "$BUNDLE_DIR"/rpm/*.rpm release-artifacts/ 2>/dev/null || true
            # AppImage + updater signature (critical — fail if missing)
            cp "$BUNDLE_DIR"/appimage/*.AppImage release-artifacts/
            cp "$BUNDLE_DIR"/appimage/*.AppImage.sig release-artifacts/
          fi

          if [ "$BUNDLE_VERSION" != "$VERSION" ]; then
            for artifact in release-artifacts/*; do
              [ -f "$artifact" ] || continue
              renamed_artifact="${artifact//$BUNDLE_VERSION/$VERSION}"
              if [ "$renamed_artifact" != "$artifact" ]; then
                mv "$artifact" "$renamed_artifact"
              fi
            done
          fi

          echo "Collected artifacts:"
          ls -la release-artifacts/

      - name: Upload release assets
        uses: softprops/action-gh-release@v2
        with:
          tag_name: ${{ env.RELEASE_TAG }}
          files: release-artifacts/*
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

      - name: Save artifacts for later use
        uses: actions/upload-artifact@v4
        with:
          name: release-${{ matrix.platform }}-${{ matrix.arch }}
          path: release-artifacts/*
          retention-days: 30

  # Publish stable release: generate and upload update manifest when promoted from prerelease
  publish-stable:
    if: github.event_name == 'release' && github.event.action == 'released'
    runs-on: ubuntu-latest
    steps:
      - name: Resolve release tag
        shell: bash
        run: |
          TAG="${{ github.event.release.tag_name }}"
          if [ -z "$TAG" ]; then
            echo "::error::Failed to resolve release tag from release event"
            exit 1
          fi
          echo "RELEASE_TAG=$TAG" >> "$GITHUB_ENV"
          echo "Resolved release tag: $TAG"

      - name: Download updater signatures from release
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          TAG="${RELEASE_TAG}"
          REPO="${{ github.repository }}"
          mkdir -p artifacts

          echo "Downloading .sig files from release ${TAG}..."

          # Only download .sig files (~200 bytes each) — no need for full installers
          gh release download "$TAG" \
            --repo "$REPO" \
            --pattern "*.sig" \
            --dir artifacts \
            --clobber

          # Save full asset name list for the Python script to match against
          gh release view "$TAG" --repo "$REPO" --json assets -q '.assets[].name' \
            > artifacts/asset-list.txt

          echo "Downloaded signatures:"
          find artifacts -type f -name '*.sig' | sort
          echo "Release asset list:"
          cat artifacts/asset-list.txt

      - name: Generate updater manifest (latest.json)
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          TAG="${RELEASE_TAG}"
          VERSION="${TAG#v}"
          REPO="${{ github.repository }}"
          BASE_URL="https://github.com/${REPO}/releases/download/${TAG}"

          # Get release notes from GitHub
          NOTES=$(gh release view "$TAG" --repo "$REPO" --json body -q '.body' 2>/dev/null || echo "")

          export VERSION BASE_URL NOTES

          python3 << 'PYSCRIPT'
          import json, os, datetime, fnmatch, sys

          base_url = os.environ.get("BASE_URL", "")
          version = os.environ.get("VERSION", "")
          notes = os.environ.get("NOTES", "")
          pub_date = datetime.datetime.utcnow().strftime("%Y-%m-%dT%H:%M:%SZ")

          # Load release asset names (for URL construction)
          asset_names = set()
          asset_list_path = "artifacts/asset-list.txt"
          if os.path.isfile(asset_list_path):
              asset_names = {line.strip() for line in open(asset_list_path) if line.strip()}

          def read_sig(pattern):
              """Read .sig content matching pattern from downloaded artifacts."""
              import glob
              matches = sorted(glob.glob(f"artifacts/{pattern}"))
              if matches:
                  return open(matches[0]).read().strip()
              return None

          def find_asset(pattern):
              """Find a release asset name matching the glob pattern."""
              for name in sorted(asset_names):
                  if fnmatch.fnmatch(name, pattern):
                      return name
              return None

          def updater_entry(file_patterns):
              """Return the first updater entry where both the asset and its .sig exist.
              file_patterns should be ordered by preference."""
              for pattern in file_patterns:
                  asset = find_asset(pattern)
                  if asset:
                      sig = read_sig(f"{asset}.sig")
                      if sig:
                          return {"signature": sig, "url": f"{base_url}/{asset}"}
              return None

          platforms = {}

          # macOS aarch64
          entry = updater_entry(["*_aarch64.app.tar.gz"])
          if entry:
              platforms["darwin-aarch64"] = entry

          # macOS x86_64
          entry = updater_entry(["*_x86_64.app.tar.gz"])
          if entry:
              platforms["darwin-x86_64"] = entry

          # Windows x86_64 (Tauri v2: signed NSIS .exe / MSI directly)
          entry = updater_entry(["*-setup.exe", "*_en-US.msi"])
          if entry:
              platforms["windows-x86_64"] = entry

          # Linux x86_64 (Tauri v2: signed AppImage directly)
          entry = updater_entry(["*amd64.AppImage"])
          if entry:
              platforms["linux-x86_64"] = entry

          # Validate all expected platforms are present
          expected = {"darwin-aarch64", "darwin-x86_64", "windows-x86_64", "linux-x86_64"}
          missing = expected - set(platforms.keys())
          if missing:
              print(f"::error::Missing updater platforms: {sorted(missing)}")
              print(f"Available assets: {sorted(asset_names)}")
              print(f"Downloaded sigs: {sorted(os.listdir('artifacts'))}")
              sys.exit(1)

          manifest = {
              "version": version,
              "notes": notes,
              "pub_date": pub_date,
              "platforms": platforms,
          }

          with open("latest.json", "w") as out:
              json.dump(manifest, out, indent=2, ensure_ascii=False)

          print("Generated latest.json:")
          print(json.dumps(manifest, indent=2, ensure_ascii=False))
          print(f"\nPlatforms: {sorted(platforms.keys())}")
          PYSCRIPT

      - name: Upload latest.json to release
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          TAG="${RELEASE_TAG}"
          gh release upload "$TAG" latest.json \
            --repo "${{ github.repository }}" \
            --clobber

  # Update Homebrew Cask when release is published
  update-homebrew:
    if: github.event_name == 'release' && github.event.action == 'released'
    runs-on: ubuntu-latest
    steps:
      - name: Resolve release tag
        shell: bash
        run: |
          TAG="${{ github.event.release.tag_name }}"
          if [ -z "$TAG" ]; then
            echo "::error::Failed to resolve release tag from release event"
            exit 1
          fi
          echo "RELEASE_TAG=$TAG" >> "$GITHUB_ENV"
          echo "VERSION=${TAG#v}" >> "$GITHUB_ENV"
          echo "Resolved release tag: $TAG"

      - name: Download macOS DMGs and compute SHA256
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          VERSION="${VERSION}"

          DMG_ARM="TiyCode_${VERSION}_aarch64.dmg"
          DMG_X64="TiyCode_${VERSION}_x64.dmg"

          gh release download "$RELEASE_TAG" \
            --repo "${{ github.repository }}" \
            --pattern "$DMG_ARM" \
            --pattern "$DMG_X64" \
            --dir .

          # Compute SHA256
          SHA256_ARM64=$(sha256sum "$DMG_ARM" | awk '{print $1}')
          SHA256_X64=$(sha256sum "$DMG_X64" | awk '{print $1}')

          echo "SHA256_ARM64=$SHA256_ARM64" >> "$GITHUB_ENV"
          echo "SHA256_X64=$SHA256_X64" >> "$GITHUB_ENV"

          echo "aarch64 sha256: $SHA256_ARM64"
          echo "x64 sha256: $SHA256_X64"

      - name: Generate Cask file
        run: |
          cat > tiycode.rb << 'CASK'
          cask "tiycode" do
            version "__VERSION__"

            on_arm do
              url "https://github.com/tiylabs/tiycode/releases/download/#{version}/TiyCode_#{version}_aarch64.dmg"
              sha256 "__SHA256_ARM64__"
            end

            on_intel do
              url "https://github.com/tiylabs/tiycode/releases/download/#{version}/TiyCode_#{version}_x64.dmg"
              sha256 "__SHA256_X64__"
            end

            name "TiyCode"
            desc "Open-source, flexible, convenient cross-platform vibe-coding agent"
            homepage "https://tiy.ai"

            livecheck do
              url :url
              strategy :github_latest
            end

            auto_updates true
            depends_on macos: ">= :catalina"

            app "TiyCode.app"

            zap trash: [
              "~/Library/Application Support/ai.tiy.tiycode",
              "~/Library/Caches/ai.tiy.tiycode",
              "~/Library/HTTPStorages/ai.tiy.tiycode",
              "~/Library/Logs/TiyAgents",
              "~/Library/Preferences/ai.tiy.tiycode.plist",
              "~/Library/Saved Application State/ai.tiy.tiycode.savedState",
              "~/Library/WebKit/ai.tiy.tiycode",
            ]
          end
          CASK

          sed -i \
            -e "s/__VERSION__/$VERSION/" \
            -e "s/__SHA256_ARM64__/$SHA256_ARM64/" \
            -e "s/__SHA256_X64__/$SHA256_X64/" \
            tiycode.rb

          echo "Generated Cask:"
          cat tiycode.rb

      - name: Push to Homebrew tap
        uses: dmnemec/copy_file_to_another_repo_action@main
        env:
          API_TOKEN_GITHUB: ${{ secrets.PAT_TOKEN }}
        with:
          source_file: tiycode.rb
          destination_repo: tiylabs/homebrew-tap
          destination_folder: Casks
          destination_branch: master
          user_email: github-actions[bot]@users.noreply.github.com
          user_name: github-actions[bot]
          commit_message: "Update TiyCode to ${{ env.VERSION }}"