release.yml

name: release

on:
  workflow_dispatch:
    inputs:
      # draft only: notes are written by hand, the updater only sees published releases
      mode:
        description: What to do with the built installer
        type: choice
        default: draft release
        options:
          - draft release
          - build only
      bump:
        description: Version bump, committed to master once the build passed (ignored for build only)
        type: choice
        default: patch
        options:
          - patch
          - minor
          - major
          - none

permissions:
  contents: write

concurrency:
  group: release
  cancel-in-progress: false

jobs:
  release:
    name: Build installer
    runs-on: windows-latest
    outputs:
      version: ${{ steps.version.outputs.version }}
      # the bump commit the release is tagged on, empty for build only
      commit: ${{ steps.commit.outputs.oid }}

    steps:
      - name: Checkout
        uses: actions/checkout@v7
        with:
          ref: master
          fetch-depth: 0
          lfs: true

      # edits the checkout only, the commit comes after the build
      - name: Bump version
        id: version
        shell: pwsh
        run: |
          $bump = if ("${{ inputs.mode }}" -eq "build only") { "none" } else { "${{ inputs.bump }}" }
          $version = ./.github/scripts/bump-version.ps1 -Bump $bump
          Add-Content $env:GITHUB_OUTPUT "version=$version"
          Add-Content $env:GITHUB_OUTPUT "bumped=$($bump -ne 'none')"

      # fail before the long build if this version is already published, a draft is fine
      - name: Check that the version is not released yet
        if: inputs.mode != 'build only'
        shell: pwsh
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          $isDraft = gh release view "${{ steps.version.outputs.version }}" --json isDraft --jq .isDraft 2>$null
          if ($LASTEXITCODE -eq 0 -and $isDraft -eq "false") {
            throw "Release ${{ steps.version.outputs.version }} is already published. Pick a bump other than none."
          }
          exit 0

      - name: Set up Bun
        uses: oven-sh/setup-bun@v2

      - name: Set up Rust
        uses: dtolnay/rust-toolchain@stable
        with:
          targets: x86_64-pc-windows-msvc

      - name: Cache cargo
        uses: Swatinem/rust-cache@v2

      - name: Install Ninja
        run: choco install ninja --no-progress -y

      - name: Install WiX 6
        shell: pwsh
        run: |
          dotnet tool install --global wix --version 6.0.2
          Add-Content $env:GITHUB_PATH "$env:USERPROFILE\.dotnet\tools"
          wix extension add -g WixToolset.Util.wixext/6.0.2

      - name: Install dependencies
        run: bun install --frozen-lockfile

      - name: Build installer
        run: bun run package

      - name: Upload installer artifact
        uses: actions/upload-artifact@v7
        with:
          name: kute-setup-x86_64-msi-${{ steps.version.outputs.version }}-${{ github.sha }}
          path: target/kute-setup-x86_64.msi
          retention-days: 7

      - name: Upload portable artifact
        uses: actions/upload-artifact@v7
        with:
          name: kute-x86_64-portable-zip-${{ steps.version.outputs.version }}-${{ github.sha }}
          path: target/kute-x86_64-portable.zip
          retention-days: 7

      # via the API so GitHub signs it. if master moved during the build the bump goes on top as long as
      # the version files are unchanged there, expectedHeadOid guards the rest
      - name: Commit the version bump
        id: commit
        if: inputs.mode != 'build only'
        shell: pwsh
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          $head = git rev-parse HEAD
          if ("${{ steps.version.outputs.bumped }}" -ne "True") {
            Add-Content $env:GITHUB_OUTPUT "oid=$head"
            exit 0
          }

          $files = "Cargo.toml", "Cargo.lock", "package.json", "resources/installer_script.wxs"

          git fetch --quiet origin master
          $remote = git rev-parse origin/master
          if ($remote -ne $head) {
            git diff --quiet $head $remote -- $files
            if ($LASTEXITCODE -ne 0) {
              throw "master moved during the build and changed the version files, run the workflow again"
            }
            Write-Host "master moved from $head to $remote during the build, the version files are unchanged there"
            $head = $remote
          }

          $additions = @($files | ForEach-Object {
            @{ path = $_; contents = [Convert]::ToBase64String([IO.File]::ReadAllBytes((Resolve-Path $_))) }
          })
          $body = @{
            query = 'mutation($input: CreateCommitOnBranchInput!) { createCommitOnBranch(input: $input) { commit { oid } } }'
            variables = @{
              input = @{
                branch = @{ repositoryNameWithOwner = $env:GITHUB_REPOSITORY; branchName = "master" }
                message = @{ headline = "bump version to ${{ steps.version.outputs.version }}" }
                expectedHeadOid = $head
                fileChanges = @{ additions = $additions }
              }
            }
          } | ConvertTo-Json -Depth 10

          $response = $body | gh api graphql --input -
          if ($LASTEXITCODE -ne 0) {
            throw "Could not commit the version bump: $response"
          }
          $oid = ($response | ConvertFrom-Json).data.createCommitOnBranch.commit.oid
          if (-not $oid) {
            throw "Could not commit the version bump: $response"
          }
          Add-Content $env:GITHUB_OUTPUT "oid=$oid"

      - name: Create GitHub Release
        id: release
        if: inputs.mode != 'build only'
        uses: softprops/action-gh-release@v3
        with:
          tag_name: ${{ steps.version.outputs.version }}
          target_commitish: ${{ steps.commit.outputs.oid }}
          name: ${{ steps.version.outputs.version }}
          draft: true
          generate_release_notes: true
          files: |
            target/kute-setup-x86_64.msi
            target/kute-x86_64-portable.zip

      # exes before the portable zip download assets[0] as the installer, and the api sorts assets by name
      - name: Check that the installer is the first asset
        if: inputs.mode != 'build only'
        shell: pwsh
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          $first = gh api "repos/${{ github.repository }}/releases/${{ steps.release.outputs.id }}" --jq '.assets[0].name'
          if ($first -ne "kute-setup-x86_64.msi") {
            throw "The first release asset is $first, older clients would run it as the installer. Rename the other assets so they sort after kute-setup-x86_64.msi."
          }

  appimage:
    name: Build AppImage
    needs: release
    # the image's glibc is the oldest the AppImage runs on, 24.04 meant 2.39 and shut out ubuntu 22.04 and debian 12
    runs-on: ubuntu-22.04

    steps:
      # the version the windows job bumped and tagged, so both builds carry the same number
      - name: Checkout
        uses: actions/checkout@v7
        with:
          ref: ${{ needs.release.outputs.commit || 'master' }}
          lfs: true

      - name: Set up Bun
        uses: oven-sh/setup-bun@v2

      - name: Set up Rust
        uses: dtolnay/rust-toolchain@stable

      - name: Cache cargo
        uses: Swatinem/rust-cache@v2

      # cef-dll-sys builds its wrapper with CMake and Ninja. apt hung twice for 15+ min on a release run, so only when missing
      - name: Install build tools
        timeout-minutes: 5
        env:
          DEBIAN_FRONTEND: noninteractive
        run: |
          if ! command -v ninja >/dev/null || ! command -v cmake >/dev/null; then
            sudo apt-get update && sudo apt-get install -y ninja-build cmake
          fi
          cmake --version
          ninja --version

      - name: Install dependencies
        run: bun install --frozen-lockfile

      - name: Build AppImage
        run: bun run package:linux

      - name: Upload AppImage artifact
        uses: actions/upload-artifact@v7
        with:
          name: kute-x86_64-appimage-${{ needs.release.outputs.version }}-${{ github.sha }}
          path: target/kute-x86_64.AppImage
          retention-days: 7

      - name: Add the AppImage to the draft release
        if: inputs.mode != 'build only'
        env:
          GH_TOKEN: ${{ github.token }}
        run: gh release upload "${{ needs.release.outputs.version }}" target/kute-x86_64.AppImage --clobber

      # same rule as in the windows job, the AppImage must sort after the installer
      - name: Check that the installer is still the first asset
        if: inputs.mode != 'build only'
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          first=$(gh release view "${{ needs.release.outputs.version }}" --json assets --jq '.assets | map(.name) | sort | .[0]')
          if [ "$first" != "kute-setup-x86_64.msi" ]; then
            echo "The first release asset is $first, older clients would run it as the installer."
            exit 1
          fi