release.yml

name: Release

on:
  push:
    branches:
      - main

permissions:
  contents: write

jobs:
  metadata:
    runs-on: ubuntu-latest
    outputs:
      version: ${{ steps.release.outputs.version }}
      tag: ${{ steps.release.outputs.tag }}
      prerelease: ${{ steps.release.outputs.prerelease }}

    steps:
      - uses: actions/checkout@v4

      - name: Read release metadata
        id: release
        shell: bash
        run: |
          VERSION="$(node -p "require('./package.json').version")"
          TAG="v${VERSION}"
          PRERELEASE=false
          if [[ "$VERSION" == *alpha* || "$VERSION" == *beta* || "$VERSION" == *rc* ]]; then
            PRERELEASE=true
          fi

          echo "version=${VERSION}" >> "$GITHUB_OUTPUT"
          echo "tag=${TAG}" >> "$GITHUB_OUTPUT"
          echo "prerelease=${PRERELEASE}" >> "$GITHUB_OUTPUT"

  build:
    needs: metadata
    strategy:
      fail-fast: false
      matrix:
        include:
          - os: macos-latest
            cmd: package:mac
          - os: windows-latest
            cmd: package:win

    runs-on: ${{ matrix.os }}

    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-node@v4
        with:
          node-version: 22
          cache: npm

      - run: npm ci

      - name: Build & Package
        run: npm run ${{ matrix.cmd }} -- --publish never
        # Code-signing env can be added here when certificates are configured:
        # CSC_LINK, CSC_KEY_PASSWORD, APPLE_ID, APPLE_APP_SPECIFIC_PASSWORD, APPLE_TEAM_ID

      - name: Upload artifacts
        uses: actions/upload-artifact@v4
        with:
          name: release-${{ matrix.os }}
          path: |
            dist/*.dmg
            dist/*.zip
            dist/*.exe
            dist/latest*.yml
          if-no-files-found: warn

  release:
    needs:
      - metadata
      - build
    runs-on: ubuntu-latest

    steps:
      - uses: actions/checkout@v4

      - uses: actions/download-artifact@v4
        with:
          path: artifacts
          merge-multiple: true

      - name: Generate SHA256 checksums
        run: |
          cd artifacts
          sha256sum *.dmg *.zip *.exe 2>/dev/null > SHA256SUMS.txt || true
          cat SHA256SUMS.txt

      - name: Align release tag to main
        shell: bash
        run: |
          git config user.name "github-actions[bot]"
          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
          git tag -f "${{ needs.metadata.outputs.tag }}" "${GITHUB_SHA}"
          git push --force origin "refs/tags/${{ needs.metadata.outputs.tag }}"

      - name: Create or update GitHub Release
        shell: bash
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          TAG: ${{ needs.metadata.outputs.tag }}
          PRERELEASE: ${{ needs.metadata.outputs.prerelease }}
        run: |
          set -euo pipefail

          mapfile -d '' files < <(find artifacts -maxdepth 1 -type f -print0)
          if [[ "${#files[@]}" -eq 0 ]]; then
            echo "No release artifacts found."
            exit 1
          fi

          if gh release view "${TAG}" >/dev/null 2>&1; then
            edit_args=(--title "${TAG}" --target "${GITHUB_SHA}" --draft=false)

            if [[ "${PRERELEASE}" == "true" ]]; then
              edit_args+=(--prerelease)
            else
              edit_args+=(--prerelease=false --latest)
            fi

            gh release edit "${TAG}" "${edit_args[@]}"
            gh release upload "${TAG}" "${files[@]}" --clobber
          else
            create_args=(--title "${TAG}" --target "${GITHUB_SHA}" --generate-notes)

            if [[ "${PRERELEASE}" == "true" ]]; then
              create_args+=(--prerelease --latest=false)
            else
              create_args+=(--latest)
            fi

            gh release create "${TAG}" "${create_args[@]}" "${files[@]}"
          fi