release-electron.yml

name: Release Electron App

on:
  workflow_dispatch:
  push:
    tags:
      - 'v*'

permissions:
  contents: write

concurrency:
  group: release-electron-${{ github.ref }}
  cancel-in-progress: false

jobs:
  build-electron:
    name: Build ${{ matrix.label }}
    runs-on: ${{ matrix.runs_on }}
    env:
      APPLE_SIGN_CERTIFICATE_P12_BASE64: ${{ secrets.APPLE_SIGN_CERTIFICATE_P12_BASE64 }}
      APPLE_SIGN_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_SIGN_CERTIFICATE_PASSWORD }}
      APPLE_SIGN_IDENTITY: ${{ secrets.APPLE_SIGN_IDENTITY }}
      APPLE_NOTARY_API_KEY_P8_BASE64: ${{ secrets.APPLE_NOTARY_API_KEY_P8_BASE64 }}
      APPLE_API_KEY_ID: ${{ secrets.APPLE_API_KEY_ID }}
      APPLE_API_ISSUER: ${{ secrets.APPLE_API_ISSUER }}
      APPLE_ID: ${{ secrets.APPLE_ID }}
      APPLE_APP_SPECIFIC_PASSWORD: ${{ secrets.APPLE_APP_SPECIFIC_PASSWORD }}
      APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
      STARQUERY_WINDOWS_CERTIFICATE_BASE64: ${{ secrets.STARQUERY_WINDOWS_CERTIFICATE_BASE64 }}
      STARQUERY_WINDOWS_CERTIFICATE_PASSWORD: ${{ secrets.STARQUERY_WINDOWS_CERTIFICATE_PASSWORD }}
      STARQUERY_MSIX_WINDOWS_KIT_VERSION: ${{ vars.STARQUERY_MSIX_WINDOWS_KIT_VERSION }}
      STARQUERY_MSIX_WINDOWS_KIT_PATH: ${{ vars.STARQUERY_MSIX_WINDOWS_KIT_PATH }}
    strategy:
      fail-fast: false
      matrix:
        include:
          - label: macOS Apple Silicon
            runs_on: macos-14
            artifact_name: electron-macos-arm64
          - label: macOS Intel
            runs_on: macos-13
            artifact_name: electron-macos-x64
          - label: Windows
            runs_on: windows-latest
            artifact_name: electron-windows-x64
          - label: Linux
            runs_on: ubuntu-latest
            artifact_name: electron-linux-x64

    steps:
      - name: Check out repository
        uses: actions/checkout@v4

      - name: Set up pnpm
        uses: pnpm/action-setup@v4
        with:
          version: 10.2.1

      - name: Set up Node.js
        uses: actions/setup-node@v4
        with:
          node-version: 24
          cache: pnpm

      - name: Install Linux packaging dependencies
        if: runner.os == 'Linux'
        run: |
          sudo apt-get update
          sudo apt-get install -y fakeroot rpm

      - name: Install workspace dependencies
        run: pnpm install --frozen-lockfile

      - name: Prepare Apple signing certificate
        if: runner.os == 'macOS' && env.APPLE_SIGN_CERTIFICATE_P12_BASE64 != ''
        shell: bash
        run: |
          CERTIFICATE_PATH="$RUNNER_TEMP/starquery-macos-signing.p12"
          KEYCHAIN_PATH="$RUNNER_TEMP/starquery-signing.keychain-db"
          KEYCHAIN_PASSWORD="$(uuidgen)"

          echo "${APPLE_SIGN_CERTIFICATE_P12_BASE64}" | base64 --decode > "$CERTIFICATE_PATH"

          security create-keychain -p "$KEYCHAIN_PASSWORD" "$KEYCHAIN_PATH"
          security set-keychain-settings -lut 21600 "$KEYCHAIN_PATH"
          security unlock-keychain -p "$KEYCHAIN_PASSWORD" "$KEYCHAIN_PATH"
          security import "$CERTIFICATE_PATH" \
            -k "$KEYCHAIN_PATH" \
            -P "${APPLE_SIGN_CERTIFICATE_PASSWORD}" \
            -T /usr/bin/codesign \
            -T /usr/bin/security \
            -T /usr/bin/productbuild
          security set-key-partition-list \
            -S apple-tool:,apple:,codesign: \
            -s \
            -k "$KEYCHAIN_PASSWORD" \
            "$KEYCHAIN_PATH"
          security default-keychain -d user -s "$KEYCHAIN_PATH"
          security list-keychains -d user -s "$KEYCHAIN_PATH" $(security list-keychains -d user | tr -d '"')
          echo "KEYCHAIN_PATH=$KEYCHAIN_PATH" >> "$GITHUB_ENV"

      - name: Prepare Apple notarization API key
        if: runner.os == 'macOS' && env.APPLE_NOTARY_API_KEY_P8_BASE64 != ''
        shell: bash
        run: |
          API_KEY_PATH="$RUNNER_TEMP/AuthKey_${APPLE_API_KEY_ID}.p8"
          echo "${APPLE_NOTARY_API_KEY_P8_BASE64}" | base64 --decode > "$API_KEY_PATH"
          echo "APPLE_API_KEY=$API_KEY_PATH" >> "$GITHUB_ENV"

      - name: Prepare optional Windows code-signing certificate
        if: runner.os == 'Windows' && env.STARQUERY_WINDOWS_CERTIFICATE_BASE64 != ''
        shell: pwsh
        run: |
          $certificatePath = Join-Path $env:RUNNER_TEMP 'starquery-windows-signing.pfx'
          [System.IO.File]::WriteAllBytes(
            $certificatePath,
            [System.Convert]::FromBase64String($env:STARQUERY_WINDOWS_CERTIFICATE_BASE64)
          )
          "WINDOWS_CERTIFICATE_FILE=$certificatePath" | Out-File -FilePath $env:GITHUB_ENV -Encoding utf8 -Append

      - name: Detect Windows SDK for MSIX
        if: runner.os == 'Windows' && env.STARQUERY_MSIX_WINDOWS_KIT_PATH == '' && env.STARQUERY_MSIX_WINDOWS_KIT_VERSION == ''
        shell: pwsh
        run: |
          $windowsKitBinRoot = 'C:\Program Files (x86)\Windows Kits\10\bin'
          $candidates = Get-ChildItem $windowsKitBinRoot -Directory |
            Where-Object { Test-Path (Join-Path $_.FullName 'x64\makeappx.exe') } |
            Sort-Object Name -Descending

          if (-not $candidates -or $candidates.Count -eq 0) {
            throw "No usable Windows SDK with makeappx.exe found under $windowsKitBinRoot"
          }

          $selectedVersion = $candidates[0].Name
          "STARQUERY_MSIX_WINDOWS_KIT_VERSION=$selectedVersion" | Out-File -FilePath $env:GITHUB_ENV -Encoding utf8 -Append
          Write-Host "Using Windows SDK version $selectedVersion for MSIX packaging"

      - name: Build Electron distributables
        if: runner.os != 'Windows'
        env:
          STARQUERY_MAC_SIGN: ${{ runner.os == 'macOS' && env.APPLE_SIGN_CERTIFICATE_P12_BASE64 != '' && 'true' || 'false' }}
          STARQUERY_MAC_NOTARIZE: ${{ runner.os == 'macOS' && ((env.APPLE_NOTARY_API_KEY_P8_BASE64 != '' && env.APPLE_API_KEY_ID != '' && env.APPLE_API_ISSUER != '') || (env.APPLE_ID != '' && env.APPLE_APP_SPECIFIC_PASSWORD != '' && env.APPLE_TEAM_ID != '')) && 'true' || 'false' }}
          STARQUERY_MAC_BUNDLE_ID: ${{ vars.STARQUERY_MAC_BUNDLE_ID }}
          STARQUERY_MAC_APP_CATEGORY: ${{ vars.STARQUERY_MAC_APP_CATEGORY }}
          APPLE_SIGN_IDENTITY: ${{ env.APPLE_SIGN_IDENTITY }}
          APPLE_API_KEY_ID: ${{ env.APPLE_API_KEY_ID }}
          APPLE_API_ISSUER: ${{ env.APPLE_API_ISSUER }}
          APPLE_ID: ${{ env.APPLE_ID }}
          APPLE_APP_SPECIFIC_PASSWORD: ${{ env.APPLE_APP_SPECIFIC_PASSWORD }}
          APPLE_TEAM_ID: ${{ env.APPLE_TEAM_ID }}
          STARQUERY_MSIX_PUBLISHER: ${{ vars.STARQUERY_MSIX_PUBLISHER }}
          STARQUERY_MSIX_PUBLISHER_DISPLAY_NAME: ${{ vars.STARQUERY_MSIX_PUBLISHER_DISPLAY_NAME }}
          STARQUERY_MSIX_IDENTITY_NAME: ${{ vars.STARQUERY_MSIX_IDENTITY_NAME }}
          STARQUERY_MSIX_PACKAGE_DISPLAY_NAME: ${{ vars.STARQUERY_MSIX_PACKAGE_DISPLAY_NAME }}
          STARQUERY_MSIX_APP_DISPLAY_NAME: ${{ vars.STARQUERY_MSIX_APP_DISPLAY_NAME }}
          STARQUERY_MSIX_BACKGROUND_COLOR: ${{ vars.STARQUERY_MSIX_BACKGROUND_COLOR }}
          STARQUERY_MSIX_MIN_OS_VERSION: ${{ vars.STARQUERY_MSIX_MIN_OS_VERSION }}
          STARQUERY_MSIX_MAX_OS_VERSION_TESTED: ${{ vars.STARQUERY_MSIX_MAX_OS_VERSION_TESTED }}
          STARQUERY_MSIX_SIGN: ${{ vars.STARQUERY_MSIX_SIGN }}
          WINDOWS_CERTIFICATE_PASSWORD: ${{ env.STARQUERY_WINDOWS_CERTIFICATE_PASSWORD }}
        run: pnpm --dir packages/electron make

      - name: Package Electron app
        if: runner.os == 'Windows'
        run: pnpm --dir packages/electron exec electron-forge package

      - name: Build Windows Squirrel distributable
        if: runner.os == 'Windows'
        env:
          STARQUERY_MSIX_PUBLISHER: ${{ vars.STARQUERY_MSIX_PUBLISHER }}
          STARQUERY_MSIX_PUBLISHER_DISPLAY_NAME: ${{ vars.STARQUERY_MSIX_PUBLISHER_DISPLAY_NAME }}
          STARQUERY_MSIX_IDENTITY_NAME: ${{ vars.STARQUERY_MSIX_IDENTITY_NAME }}
          STARQUERY_MSIX_PACKAGE_DISPLAY_NAME: ${{ vars.STARQUERY_MSIX_PACKAGE_DISPLAY_NAME }}
          STARQUERY_MSIX_APP_DISPLAY_NAME: ${{ vars.STARQUERY_MSIX_APP_DISPLAY_NAME }}
          STARQUERY_MSIX_BACKGROUND_COLOR: ${{ vars.STARQUERY_MSIX_BACKGROUND_COLOR }}
          STARQUERY_MSIX_MIN_OS_VERSION: ${{ vars.STARQUERY_MSIX_MIN_OS_VERSION }}
          STARQUERY_MSIX_MAX_OS_VERSION_TESTED: ${{ vars.STARQUERY_MSIX_MAX_OS_VERSION_TESTED }}
          STARQUERY_MSIX_SIGN: ${{ vars.STARQUERY_MSIX_SIGN }}
          WINDOWS_CERTIFICATE_PASSWORD: ${{ env.STARQUERY_WINDOWS_CERTIFICATE_PASSWORD }}
        run: pnpm --dir packages/electron exec electron-forge make --skip-package --targets=@electron-forge/maker-squirrel

      - name: Build Windows MSIX distributable
        if: runner.os == 'Windows'
        env:
          STARQUERY_MSIX_PUBLISHER: ${{ vars.STARQUERY_MSIX_PUBLISHER }}
          STARQUERY_MSIX_PUBLISHER_DISPLAY_NAME: ${{ vars.STARQUERY_MSIX_PUBLISHER_DISPLAY_NAME }}
          STARQUERY_MSIX_IDENTITY_NAME: ${{ vars.STARQUERY_MSIX_IDENTITY_NAME }}
          STARQUERY_MSIX_PACKAGE_DISPLAY_NAME: ${{ vars.STARQUERY_MSIX_PACKAGE_DISPLAY_NAME }}
          STARQUERY_MSIX_APP_DISPLAY_NAME: ${{ vars.STARQUERY_MSIX_APP_DISPLAY_NAME }}
          STARQUERY_MSIX_BACKGROUND_COLOR: ${{ vars.STARQUERY_MSIX_BACKGROUND_COLOR }}
          STARQUERY_MSIX_MIN_OS_VERSION: ${{ vars.STARQUERY_MSIX_MIN_OS_VERSION }}
          STARQUERY_MSIX_MAX_OS_VERSION_TESTED: ${{ vars.STARQUERY_MSIX_MAX_OS_VERSION_TESTED }}
          STARQUERY_MSIX_SIGN: ${{ vars.STARQUERY_MSIX_SIGN }}
          WINDOWS_CERTIFICATE_PASSWORD: ${{ env.STARQUERY_WINDOWS_CERTIFICATE_PASSWORD }}
        run: pnpm --dir packages/electron exec electron-forge make --skip-package --targets=@electron-forge/maker-msix

      - name: Upload workflow artifacts
        uses: actions/upload-artifact@v4
        with:
          name: ${{ matrix.artifact_name }}
          path: packages/electron/out/make/**/*
          if-no-files-found: error

      - name: Upload release assets
        if: github.event_name == 'release' || startsWith(github.ref, 'refs/tags/')
        uses: softprops/action-gh-release@v2
        with:
          files: packages/electron/out/make/**/*
          fail_on_unmatched_files: true