release.yml

# Build the Windows MSI installer(s) and the Linux tarball, publishing them to
# a GitHub Release on every version tag (e.g. `git tag v1.0.0 && git push
# --tags`). Windows builds both x64 and ARM64; `fail-fast: false` means an
# ARM64 hiccup never blocks the x64 release, and the Linux job is fully
# independent of the MSI legs. End users go to the Releases page and download
# the artifact for their platform (`...-x86_64.msi`, `...-aarch64.msi`, or
# `...-x86_64-linux.tar.gz`).

name: release

# Run JavaScript actions on Node 24; Node 20 is deprecated on GitHub-hosted
# runners (forced to Node 24 from 2026-06-16).
env:
  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: 'true'

on:
  push:
    tags:
      - 'v*'
  # Also allow manual dry-runs from the Actions tab — useful for verifying the
  # pipeline (incl. the ARM64 cross-build) without cutting a real release.
  workflow_dispatch:

permissions:
  contents: write  # needed to upload assets to the release

jobs:
  windows-msi:
    name: Build ${{ matrix.arch }} MSI
    runs-on: windows-latest
    strategy:
      fail-fast: false
      matrix:
        include:
          - target: x86_64-pc-windows-msvc
            arch: x64
          - target: aarch64-pc-windows-msvc
            arch: arm64
    steps:
      - uses: actions/checkout@v4

      - name: Install Rust (${{ matrix.target }})
        uses: dtolnay/rust-toolchain@stable
        with:
          targets: ${{ matrix.target }}

      # WiX 3 ships on the GitHub-hosted Windows runner image (ARM64 MSI support
      # needs WiX >= 3.14 — print the version so a dry-run can confirm).
      - name: Verify WiX toolset on PATH
        shell: pwsh
        run: |
          candle.exe -? | Select-Object -First 1
          light.exe -? | Select-Object -First 1

      - name: Install cargo-wix
        shell: pwsh
        run: cargo install cargo-wix --locked

      - name: Cache cargo build
        uses: Swatinem/rust-cache@v2
        with:
          key: ${{ matrix.arch }}  # keep x64 and arm64 caches separate
          # Restore-only. Saving the multi-GB target/ tar on the Windows runner
          # intermittently fails and reds the release leg even though the MSI
          # built + uploaded fine (e.g. v0.3.14 arm64). A post-action can't be
          # made non-fatal, so we just never write a new cache here — builds
          # still restore from existing caches; releases just don't update them.
          save-if: false

      # Decode the optional code-signing certificate. When the
      # `WINDOWS_CERT_BASE64` secret is unset (open-source fork with no cert),
      # the step writes an empty `pfx` output and the sign steps skip via
      # `if: steps.cert.outputs.pfx != ''`.
      - name: Stage code-signing cert
        id: cert
        shell: pwsh
        env:
          WINDOWS_CERT_BASE64: ${{ secrets.WINDOWS_CERT_BASE64 }}
        run: |
          if ([string]::IsNullOrEmpty($env:WINDOWS_CERT_BASE64)) {
            Write-Host "WINDOWS_CERT_BASE64 not set — MSI will be unsigned"
            exit 0
          }
          $pfx = Join-Path $env:RUNNER_TEMP 'codesign.pfx'
          [IO.File]::WriteAllBytes($pfx, [Convert]::FromBase64String($env:WINDOWS_CERT_BASE64))
          "pfx=$pfx" | Out-File -Append -FilePath $env:GITHUB_OUTPUT

      - name: Build release binary (${{ matrix.target }})
        shell: pwsh
        run: cargo build --release --target ${{ matrix.target }}

      # Locate signtool.exe once — the Windows SDK version on the hosted runner
      # changes, so find the newest x64 bin dir dynamically (the x64 signtool
      # signs binaries of any target architecture).
      - name: Find signtool
        id: signtool
        if: steps.cert.outputs.pfx != ''
        shell: pwsh
        run: |
          $sdk = Join-Path ${env:ProgramFiles(x86)} 'Windows Kits\10\bin'
          $st = Get-ChildItem -Path $sdk -Filter 'signtool.exe' -Recurse `
            | Where-Object { $_.FullName -match '\\x64\\' } `
            | Sort-Object FullName -Descending `
            | Select-Object -First 1
          if ($null -eq $st) { throw "signtool.exe not found under $sdk" }
          "path=$($st.FullName)" | Out-File -Append -FilePath $env:GITHUB_OUTPUT

      - name: Sign searchbox.exe
        if: steps.cert.outputs.pfx != ''
        shell: pwsh
        env:
          WINDOWS_CERT_PASSWORD: ${{ secrets.WINDOWS_CERT_PASSWORD }}
        run: |
          & "${{ steps.signtool.outputs.path }}" sign `
            /f "${{ steps.cert.outputs.pfx }}" `
            /p "$env:WINDOWS_CERT_PASSWORD" `
            /tr http://timestamp.digicert.com /td sha256 /fd sha256 `
            target\${{ matrix.target }}\release\searchbox.exe

      - name: Build MSI
        shell: pwsh
        # We already built (and possibly signed) searchbox.exe above —
        # -SkipBuild reuses it rather than recompiling (which would unsign it).
        run: .\wix\build.ps1 -SkipBuild -Target ${{ matrix.target }}

      - name: Locate MSI artifact
        id: find_msi
        shell: pwsh
        run: |
          $msi = Get-ChildItem -Path target\wix -Filter '*.msi' | Select-Object -First 1
          if ($null -eq $msi) { throw "No MSI produced under target\wix" }
          "path=$($msi.FullName)" | Out-File -Append -FilePath $env:GITHUB_OUTPUT
          "name=$($msi.Name)"     | Out-File -Append -FilePath $env:GITHUB_OUTPUT

      - name: Sign MSI
        if: steps.cert.outputs.pfx != ''
        shell: pwsh
        env:
          WINDOWS_CERT_PASSWORD: ${{ secrets.WINDOWS_CERT_PASSWORD }}
        run: |
          & "${{ steps.signtool.outputs.path }}" sign `
            /f "${{ steps.cert.outputs.pfx }}" `
            /p "$env:WINDOWS_CERT_PASSWORD" `
            /tr http://timestamp.digicert.com /td sha256 /fd sha256 `
            "${{ steps.find_msi.outputs.path }}"

      - name: Scrub cert from runner
        if: always() && steps.cert.outputs.pfx != ''
        shell: pwsh
        run: Remove-Item -Force -ErrorAction SilentlyContinue "${{ steps.cert.outputs.pfx }}"

      - name: Upload MSI to workflow artifacts
        uses: actions/upload-artifact@v4
        with:
          name: searchbox-msi-${{ matrix.arch }}
          path: ${{ steps.find_msi.outputs.path }}
          if-no-files-found: error

      # Publish a `<msi>.sha256` sidecar next to each MSI. The in-app updater
      # downloads it and verifies the MSI's hash before launching the installer.
      - name: Compute MSI checksum
        id: sha
        shell: pwsh
        run: |
          $msi = "${{ steps.find_msi.outputs.path }}"
          $hash = (Get-FileHash $msi -Algorithm SHA256).Hash.ToLower()
          $name = Split-Path $msi -Leaf
          $sumfile = "$msi.sha256"
          "$hash  $name" | Out-File -FilePath $sumfile -Encoding ascii -NoNewline
          "path=$sumfile" | Out-File -Append -FilePath $env:GITHUB_OUTPUT
          Write-Host "SHA256($name) = $hash"

      # Only publish to a Release when the trigger was a tag push.
      # workflow_dispatch runs skip this so manual dry-runs don't make junk
      # releases. Both matrix legs attach to the same release (files appended).
      - name: Attach MSI to GitHub Release
        if: startsWith(github.ref, 'refs/tags/v')
        uses: softprops/action-gh-release@v2
        with:
          files: |
            ${{ steps.find_msi.outputs.path }}
            ${{ steps.sha.outputs.path }}
          draft: false
          generate_release_notes: true
          fail_on_unmatched_files: true

  # ── Native Linux tarball (x86_64) ──
  # Deliberately a sibling job with no `needs:` edge — a Linux failure can
  # never red or block the Windows MSI legs. The tarball name must never end
  # in `.msi` (the in-app updater and the winget pipeline both select assets
  # by that suffix).
  linux-tarball:
    name: Build x86_64 Linux tarball
    runs-on: ubuntu-latest
    env:
      # Keep in lockstep with the Windows bundle — wix/build.ps1 pins the
      # same $MeiliVersion for the MSI.
      MEILI_VERSION: v1.11.3
    steps:
      - uses: actions/checkout@v4

      - name: Install Rust
        uses: dtolnay/rust-toolchain@stable

      - name: Cache cargo build
        uses: Swatinem/rust-cache@v2
        with:
          key: linux-x64

      - name: Build release binary
        run: cargo build --release --locked

      - name: Download Meilisearch sidecar (pinned)
        run: |
          curl -fsSL --retry 3 -o meilisearch \
            "https://github.com/meilisearch/meilisearch/releases/download/${MEILI_VERSION}/meilisearch-linux-amd64"
          chmod +x meilisearch
          ./meilisearch --version

      - name: Assemble tarball
        id: tar
        run: |
          VERSION="${GITHUB_REF_NAME#v}"
          if [ "${GITHUB_REF_TYPE}" != "tag" ]; then VERSION="dryrun"; fi
          PKG="SearchBox-${VERSION}-x86_64-linux"
          mkdir -p "${PKG}"
          cp target/release/searchbox "${PKG}/"
          cp meilisearch "${PKG}/"
          cp LICENSE "${PKG}/LICENSE.txt"
          cat > "${PKG}/README.txt" <<'EOF'
          SearchBox — your local document search engine
          https://mysearchbox.org

          Quick start
            1. ./searchbox
            2. Open http://127.0.0.1:8080 in your browser
            3. Create your account, point it at a folder, search.

          Notes
            - The bundled `meilisearch` binary is found automatically as long
              as it stays next to `searchbox`.
            - Your data lives in ~/.local/share/searchbox (or $XDG_DATA_HOME).
            - Stop with Ctrl-C (or SIGTERM) — the search sidecar is shut down
              with it.
            - Updates: download the newest tarball from
              https://github.com/SourceBox-LLC/SearchBox/releases
          EOF
          tar -czf "${PKG}.tar.gz" "${PKG}"
          sha256sum "${PKG}.tar.gz" > "${PKG}.tar.gz.sha256"
          echo "tarball=${PKG}.tar.gz" >> "$GITHUB_OUTPUT"
          echo "sha=${PKG}.tar.gz.sha256" >> "$GITHUB_OUTPUT"

      # Boot the packaged binary against the packaged sidecar and prove the
      # server answers — a 30-second end-to-end smoke test on the exact bytes
      # being shipped.
      - name: Smoke test
        run: |
          PKG_DIR="$(basename "${{ steps.tar.outputs.tarball }}" .tar.gz)"
          export SEARCHBOX_BASE_DIR="$RUNNER_TEMP/searchbox-smoke"
          mkdir -p "$SEARCHBOX_BASE_DIR"
          "./${PKG_DIR}/searchbox" &
          APP_PID=$!
          for i in $(seq 1 30); do
            if curl -fsS -o /dev/null http://127.0.0.1:8080/login; then break; fi
            sleep 1
          done
          curl -fsS -o /dev/null http://127.0.0.1:8080/login
          kill -TERM "$APP_PID"
          wait "$APP_PID"

      - name: Upload tarball to workflow artifacts
        uses: actions/upload-artifact@v4
        with:
          name: searchbox-linux-x64
          path: |
            ${{ steps.tar.outputs.tarball }}
            ${{ steps.tar.outputs.sha }}
          if-no-files-found: error

      - name: Attach tarball to GitHub Release
        if: startsWith(github.ref, 'refs/tags/v')
        uses: softprops/action-gh-release@v2
        with:
          files: |
            ${{ steps.tar.outputs.tarball }}
            ${{ steps.tar.outputs.sha }}
          draft: false
          generate_release_notes: true
          fail_on_unmatched_files: true