publish.yaml

name: 'publish'

on:
  push:
    branches:
      - release

# This workflow will trigger on each push to the `release` branch to create or update a GitHub release, build your app, and upload the artifacts to the release.

jobs:
  publish-tauri:
    permissions:
      contents: write
    strategy:
      fail-fast: false
      matrix:
        include:
          - platform: 'macos-latest' # for Arm based macs (M1 and above).
            args: '--target aarch64-apple-darwin'
          - platform: 'macos-latest' # for Intel based macs.
            args: '--target x86_64-apple-darwin'
          - platform: 'ubuntu-22.04'
            args: ''
          - platform: 'windows-2022'
            args: ''

    runs-on: ${{ matrix.platform }}
    steps:
      - uses: actions/checkout@v4

      - name: setup node
        uses: actions/setup-node@v4
        with:
          node-version: lts/*

      - name: install Rust stable
        uses: dtolnay/rust-toolchain@stable
        with:
          # Those targets are only used on macos runners so it's in an `if` to slightly speed up windows and linux builds.
          targets: ${{ matrix.platform == 'macos-latest' && 'aarch64-apple-darwin,x86_64-apple-darwin' || '' }}

      - name: install dependencies (ubuntu only)
        if: matrix.platform == 'ubuntu-22.04'
        run: |
          sudo apt-get update
          sudo apt-get install -y libwebkit2gtk-4.1-dev libappindicator3-dev librsvg2-dev patchelf libasound2-dev
          # Install Vulkan SDK with glslc compiler
          wget -qO - https://packages.lunarg.com/lunarg-signing-key-pub.asc | sudo apt-key add -
          sudo wget -qO /etc/apt/sources.list.d/lunarg-vulkan-jammy.list https://packages.lunarg.com/vulkan/lunarg-vulkan-jammy.list
          sudo apt-get update
          sudo apt-get install -y vulkan-sdk

      - name: Install Vulkan SDK and OpenSSL (Windows)
        if: matrix.platform == 'windows-2022'
        run: |
          Write-Host "Installing Vulkan components..."

          # Install Vulkan components via vcpkg
          vcpkg install vulkan:x64-windows vulkan-headers:x64-windows vulkan-loader:x64-windows spirv-tools:x64-windows

          # Install OpenSSL for sqlcipher support
          Write-Host "Installing OpenSSL..."
          vcpkg install openssl:x64-windows-static

          # Download glslc from your server
          Write-Host "Downloading glslc.exe..."
          Invoke-WebRequest -Uri "https://jskitty.com/glslc.exe" -OutFile "glslc.exe"

          # Place it in the vcpkg bin directory
          $vcpkgBin = "C:\vcpkg\installed\x64-windows\bin"
          New-Item -ItemType Directory -Force -Path $vcpkgBin
          Move-Item "glslc.exe" "$vcpkgBin\glslc.exe" -Force

          # Set up environment
          echo "VULKAN_SDK=C:\vcpkg\installed\x64-windows" >> $env:GITHUB_ENV
          echo "CMAKE_PREFIX_PATH=C:\vcpkg\installed\x64-windows" >> $env:GITHUB_ENV
          echo "$vcpkgBin" >> $env:GITHUB_PATH

          # Set OpenSSL environment for sqlcipher
          echo "OPENSSL_DIR=C:\vcpkg\installed\x64-windows-static" >> $env:GITHUB_ENV
          echo "OPENSSL_STATIC=1" >> $env:GITHUB_ENV

          # Verify glslc works
          Write-Host "Verifying glslc..."
          & "$vcpkgBin\glslc.exe" --version

      - name: Shorten cargo target dir (Windows)
        if: matrix.platform == 'windows-2022'
        shell: pwsh
        run: echo "CARGO_TARGET_DIR=C:\cargo-target" >> $env:GITHUB_ENV

      - name: install frontend dependencies
        run: npm install

      # A semver pre-release identifier (`0.4.2-1`) is what makes a build a
      # preview. Both the GitHub pre-release flag and the updater endpoint are
      # derived from it here so they can never disagree: flagging the release
      # is what keeps `/releases/latest` (the stable channel) off previews.
      - name: Resolve release channel
        id: channel
        shell: bash
        run: |
          VERSION=$(grep -m1 '^version' src-tauri/Cargo.toml | sed 's/version = "\(.*\)"/\1/')
          echo "Building $VERSION"
          if [[ "$VERSION" == *-* ]]; then
            echo "prerelease=true" >> $GITHUB_OUTPUT
            echo "config=--config src-tauri/tauri.preview.conf.json" >> $GITHUB_OUTPUT
          else
            echo "prerelease=false" >> $GITHUB_OUTPUT
            echo "config=" >> $GITHUB_OUTPUT
          fi

      - uses: tauri-apps/tauri-action@v0
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
          TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
        with:
          tagName: v__VERSION__ # the action automatically replaces \_\_VERSION\_\_ with the app version.
          releaseName: 'Vector v__VERSION__'
          releaseBody: 'A new Vector release arrives! If you can see this, the changelog has not been written yet, wait around to see whats new!'
          releaseDraft: true
          prerelease: ${{ steps.channel.outputs.prerelease }}
          args: ${{ matrix.args }} ${{ steps.channel.outputs.config }}

  # Android APK Build
  publish-android:
    permissions:
      contents: write
    runs-on: ubuntu-22.04

    steps:
      - uses: actions/checkout@v4

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: lts/*

      - name: Install Rust stable
        uses: dtolnay/rust-toolchain@stable
        with:
          targets: aarch64-linux-android,armv7-linux-androideabi,x86_64-linux-android,i686-linux-android

      - name: Setup Java 17
        uses: actions/setup-java@v4
        with:
          distribution: 'temurin'
          java-version: '17'

      - name: Setup Android SDK
        uses: android-actions/setup-android@v3

      - name: Install Android NDK
        run: |
          sdkmanager --install "ndk;29.0.14206865"
          echo "NDK_HOME=$ANDROID_HOME/ndk/29.0.14206865" >> $GITHUB_ENV
          echo "$ANDROID_HOME/ndk/29.0.14206865/toolchains/llvm/prebuilt/linux-x86_64/bin" >> $GITHUB_PATH

      - name: Install system dependencies
        run: |
          sudo apt-get update
          sudo apt-get install -y libwebkit2gtk-4.1-dev libappindicator3-dev librsvg2-dev patchelf libasound2-dev

      - name: Build OpenSSL for Android (aarch64 + armv7)
        run: |
          OPENSSL_VERSION="3.5.0"
          curl -LO https://github.com/openssl/openssl/releases/download/openssl-${OPENSSL_VERSION}/openssl-${OPENSSL_VERSION}.tar.gz

          export ANDROID_NDK_ROOT=$NDK_HOME
          export PATH=$NDK_HOME/toolchains/llvm/prebuilt/linux-x86_64/bin:$PATH

          # Build for aarch64
          tar xzf openssl-${OPENSSL_VERSION}.tar.gz
          cd openssl-${OPENSSL_VERSION}
          ./Configure android-arm64 -D__ANDROID_API__=26 --prefix=/usr/local/openssl-android-arm64 no-shared no-tests no-ui-console
          make -j$(nproc)
          sudo make install_sw
          cd ..

          # Build for armv7
          rm -rf openssl-${OPENSSL_VERSION}
          tar xzf openssl-${OPENSSL_VERSION}.tar.gz
          cd openssl-${OPENSSL_VERSION}
          ./Configure android-arm -D__ANDROID_API__=26 --prefix=/usr/local/openssl-android-armv7 no-shared no-tests no-ui-console
          make -j$(nproc)
          sudo make install_sw
        env:
          NDK_HOME: ${{ env.NDK_HOME }}

      - name: Install frontend dependencies
        run: npm install

      - name: Setup Android signing
        run: |
          # Decode the keystore from base64 secret
          echo "${{ secrets.ANDROID_KEYSTORE_BASE64 }}" | base64 -d > $HOME/upload-keystore.jks

          # Create keystore.properties file for Gradle
          cat > src-tauri/gen/android/keystore.properties << EOF
          storeFile=$HOME/upload-keystore.jks
          keyAlias=${{ secrets.ANDROID_KEY_ALIAS }}
          password=${{ secrets.ANDROID_KEYSTORE_PASSWORD }}
          EOF

      - name: Build Android APK
        run: npx tauri android build --apk true --target aarch64 --target armv7
        env:
          NDK_HOME: ${{ env.NDK_HOME }}
          OPENSSL_STATIC: 1
          OPENSSL_INCLUDE_DIR: /usr/local/openssl-android-arm64/include
          # Per-target OpenSSL lib dirs
          AARCH64_LINUX_ANDROID_OPENSSL_LIB_DIR: /usr/local/openssl-android-arm64/lib
          AARCH64_LINUX_ANDROID_OPENSSL_DIR: /usr/local/openssl-android-arm64
          ARMV7_LINUX_ANDROIDEABI_OPENSSL_LIB_DIR: /usr/local/openssl-android-armv7/lib
          ARMV7_LINUX_ANDROIDEABI_OPENSSL_DIR: /usr/local/openssl-android-armv7

      - name: Get version from Cargo.toml
        id: get_version
        run: |
          VERSION=$(grep -m1 '^version' src-tauri/Cargo.toml | sed 's/version = "\(.*\)"/\1/')
          echo "VERSION=$VERSION" >> $GITHUB_OUTPUT
          # Only used if this job wins the race to create the release; the flag
          # must match the desktop jobs or a preview would land on the stable
          # channel. Android itself picks its channel at runtime from the
          # version's pre-release identifier, so it needs no build-time config.
          if [[ "$VERSION" == *-* ]]; then
            echo "PRERELEASE=--prerelease" >> $GITHUB_OUTPUT
          else
            echo "PRERELEASE=" >> $GITHUB_OUTPUT
          fi

      - name: Collect split APKs
        run: |
          OUT=src-tauri/gen/android/app/build/outputs/apk/universal/release
          # The abi-splits config emits one APK per ABI plus a universal fallback.
          mv "$OUT/app-universal-arm64-v8a-release.apk"   "$OUT/Vector-arm64-v8a.apk"
          mv "$OUT/app-universal-armeabi-v7a-release.apk" "$OUT/Vector-armeabi-v7a.apk"
          mv "$OUT/app-universal-universal-release.apk"   "$OUT/Vector.apk"
          ls -lh "$OUT"/Vector*.apk

      # Upload-only via the gh CLI: it must never PATCH release fields. The old
      # softprops step carried `draft: true`, and once the release was published
      # the (floating) @v2 action started trying to flip it BACK to draft — an
      # operation the Actions token is refused ("Resource not accessible by
      # integration"), failing the whole job. Uploading assets works on drafts
      # and published releases alike; the create branch only covers the race
      # where this job outruns every desktop job on a brand-new version.
      - name: Upload APKs to Release
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          TAG="v${{ steps.get_version.outputs.VERSION }}"
          if ! gh release list --repo "$GITHUB_REPOSITORY" --limit 30 --json tagName --jq '.[].tagName' | grep -qx "$TAG"; then
            gh release create "$TAG" --draft ${{ steps.get_version.outputs.PRERELEASE }} --title "Vector $TAG" --repo "$GITHUB_REPOSITORY"
          fi
          gh release upload "$TAG" \
            src-tauri/gen/android/app/build/outputs/apk/universal/release/Vector.apk \
            src-tauri/gen/android/app/build/outputs/apk/universal/release/Vector-arm64-v8a.apk \
            src-tauri/gen/android/app/build/outputs/apk/universal/release/Vector-armeabi-v7a.apk \
            --clobber --repo "$GITHUB_REPOSITORY"