desktop-build.yml

name: 'Desktop Build'

on:
  workflow_call:
    inputs:
      version:
        required: true
        type: 'string'
      release_name:
        required: true
        type: 'string'
      tag:
        required: true
        type: 'string'
      electron_bridge:
        required: true
        type: 'boolean'
      publish:
        required: true
        type: 'boolean'
      draft:
        required: true
        type: 'boolean'
      prerelease:
        required: true
        type: 'boolean'

jobs:
  desktop:
    name: '${{ matrix.name }}'
    runs-on: '${{ matrix.os }}'
    timeout-minutes: 120
    permissions:
      contents: 'read'
    strategy:
      fail-fast: false
      matrix:
        include: >-
          ${{ fromJSON(inputs.publish &&
          '[{"name":"macOS Apple Silicon","os":"macos-15","target":"aarch64-apple-darwin","legacy_arch":"arm64"},{"name":"macOS Intel","os":"macos-15-intel","target":"x86_64-apple-darwin","legacy_arch":"x64"},{"name":"Linux x64","os":"ubuntu-22.04","target":"x86_64-unknown-linux-gnu"}]' ||
          '[{"name":"macOS Apple Silicon","os":"macos-15","target":"aarch64-apple-darwin","legacy_arch":"arm64"},{"name":"macOS Intel","os":"macos-15-intel","target":"x86_64-apple-darwin","legacy_arch":"x64"},{"name":"Windows x64","os":"windows-2025","target":"x86_64-pc-windows-msvc"},{"name":"Linux x64","os":"ubuntu-22.04","target":"x86_64-unknown-linux-gnu"}]') }}
    steps:
      - name: 'Check out source'
        uses: 'actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10' # v6.0.3
        with:
          persist-credentials: false

      - name: 'Set up Node.js'
        uses: 'actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e' # v6.4.0
        with:
          node-version-file: '.nvmrc'
          cache: 'npm'

      - name: 'Set up Rust'
        uses: 'dtolnay/rust-toolchain@4cda84d5c5c54efe2404f9d843567869ab1699d4' # stable
        with:
          targets: '${{ matrix.target }}'

      - name: 'Cache Rust dependencies'
        uses: 'Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6' # v2.9.2
        with:
          workspaces: 'packages/desktop-shell/src-tauri -> target'

      - name: 'Install Linux dependencies'
        if: "runner.os == 'Linux'"
        run: |
          sudo apt-get update
          sudo apt-get install -y libwebkit2gtk-4.1-dev libappindicator3-dev librsvg2-dev patchelf libssl-dev libfuse2

      - name: 'Validate signing configuration'
        if: 'inputs.publish'
        shell: 'bash'
        env:
          APPLE_API_ISSUER: '${{ secrets.APPLE_API_ISSUER || secrets.APPLE_NOTARY_ISSUER_ID }}'
          APPLE_API_KEY: '${{ secrets.APPLE_API_KEY || secrets.APPLE_NOTARY_KEY_ID }}'
          APPLE_API_KEY_P8_INPUT: '${{ secrets.APPLE_API_KEY_P8_BASE64 || secrets.APPLE_NOTARY_API_KEY_P8_BASE64 }}'
          APPLE_CERTIFICATE_INPUT: '${{ secrets.APPLE_CERTIFICATE || secrets.MAC_CSC_LINK }}'
          APPLE_CERTIFICATE_PASSWORD: '${{ secrets.APPLE_CERTIFICATE_PASSWORD || secrets.MAC_CSC_KEY_PASSWORD }}'
          OPENWORK_UPDATER_PUBLIC_KEY: '${{ secrets.TAURI_SIGNING_PUBLIC_KEY }}'
          TAURI_SIGNING_PRIVATE_KEY: '${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}'
          WINDOWS_CERTIFICATE_INPUT: '${{ secrets.WINDOWS_CERTIFICATE || secrets.WIN_CSC_LINK }}'
          WINDOWS_CERTIFICATE_PASSWORD_INPUT: '${{ secrets.WINDOWS_CERTIFICATE_PASSWORD || secrets.WIN_CSC_KEY_PASSWORD }}'
        run: |
          set -euo pipefail
          if [[ -z "$TAURI_SIGNING_PRIVATE_KEY" || -z "$OPENWORK_UPDATER_PUBLIC_KEY" ]]; then
            echo "::error::Published releases require TAURI_SIGNING_PRIVATE_KEY and TAURI_SIGNING_PUBLIC_KEY."
            exit 1
          fi
          if [[ "$RUNNER_OS" == "macOS" && ( -z "$APPLE_CERTIFICATE_INPUT" || -z "$APPLE_CERTIFICATE_PASSWORD" || -z "$APPLE_API_ISSUER" || -z "$APPLE_API_KEY" || -z "$APPLE_API_KEY_P8_INPUT" ) ]]; then
            echo "::error::Published macOS releases require signing and App Store Connect notarization secrets."
            exit 1
          fi
          if [[ "$RUNNER_OS" == "Windows" && ( -z "$WINDOWS_CERTIFICATE_INPUT" || -z "$WINDOWS_CERTIFICATE_PASSWORD_INPUT" ) ]]; then
            echo "::error::Published Windows releases require an Authenticode certificate and password."
            exit 1
          fi

      - name: 'Install dependencies'
        run: 'npm ci --no-audit --progress=false'

      - name: 'Install desktop tooling'
        run: 'npm ci --prefix packages/desktop-shell --workspaces=false --no-audit --progress=false'

      - name: 'Set desktop version'
        run: 'node packages/desktop-shell/scripts/version.js "${{ inputs.version }}"'

      - name: 'Prepare bundled runtime'
        env:
          OPENWORK_DESKTOP_TARGET: '${{ matrix.target }}'
        run: 'npm run build:runtime --prefix packages/desktop-shell --workspaces=false'

      - name: 'Run desktop tests'
        run: 'npm test --prefix packages/desktop-shell --workspaces=false'

      - name: 'Run desktop release tests'
        run: 'npm run test:release --prefix packages/desktop-shell --workspaces=false'

      - name: 'Configure macOS signing and notarization'
        if: "runner.os == 'macOS' && inputs.publish"
        shell: 'bash'
        env:
          APPLE_API_KEY: '${{ secrets.APPLE_API_KEY || secrets.APPLE_NOTARY_KEY_ID }}'
          APPLE_API_KEY_P8_INPUT: '${{ secrets.APPLE_API_KEY_P8_BASE64 || secrets.APPLE_NOTARY_API_KEY_P8_BASE64 }}'
          APPLE_CERTIFICATE_INPUT: '${{ secrets.APPLE_CERTIFICATE || secrets.MAC_CSC_LINK }}'
          APPLE_CERTIFICATE_PASSWORD: '${{ secrets.APPLE_CERTIFICATE_PASSWORD || secrets.MAC_CSC_KEY_PASSWORD }}'
        run: |
          set -euo pipefail
          certificate_path="$RUNNER_TEMP/openwork-signing.p12"
          if [[ "$APPLE_CERTIFICATE_INPUT" =~ ^https?:// ]]; then
            curl --fail --silent --show-error --location "$APPLE_CERTIFICATE_INPUT" --output "$certificate_path"
          else
            CERTIFICATE_PATH="$certificate_path" node -e "require('node:fs').writeFileSync(process.env.CERTIFICATE_PATH, Buffer.from(process.env.APPLE_CERTIFICATE_INPUT.replace(/^.*base64,/, ''), 'base64'))"
          fi
          keychain="$RUNNER_TEMP/openwork-signing.keychain-db"
          keychain_password="$(openssl rand -hex 32)"
          security create-keychain -p "$keychain_password" "$keychain"
          security set-keychain-settings -lut 21600 "$keychain"
          security unlock-keychain -p "$keychain_password" "$keychain"
          security import "$certificate_path" -P "$APPLE_CERTIFICATE_PASSWORD" -A -t cert -f pkcs12 -k "$keychain"
          security list-keychains -d user -s "$keychain" login.keychain-db
          security set-key-partition-list -S apple-tool:,apple:,codesign: -s -k "$keychain_password" "$keychain"
          identity="$(security find-identity -v -p codesigning "$keychain" | sed -n 's/.*"\(Developer ID Application:.*\)"/\1/p' | head -n 1)"
          if [[ -z "$identity" ]]; then
            echo "::error::Developer ID Application identity was not found."
            exit 1
          fi
          echo "APPLE_SIGNING_IDENTITY=$identity" >> "$GITHUB_ENV"
          key_path="$RUNNER_TEMP/AuthKey_${APPLE_API_KEY}.p8"
          APPLE_KEY_PATH="$key_path" node -e "require('node:fs').writeFileSync(process.env.APPLE_KEY_PATH, Buffer.from(process.env.APPLE_API_KEY_P8_INPUT, 'base64'), { mode: 0o600 })"
          echo "APPLE_API_KEY_PATH=$key_path" >> "$GITHUB_ENV"

      - name: 'Import Windows signing certificate'
        if: "runner.os == 'Windows' && inputs.publish"
        shell: 'pwsh'
        env:
          WINDOWS_CERTIFICATE_INPUT: '${{ secrets.WINDOWS_CERTIFICATE || secrets.WIN_CSC_LINK }}'
          WINDOWS_CERTIFICATE_PASSWORD_INPUT: '${{ secrets.WINDOWS_CERTIFICATE_PASSWORD || secrets.WIN_CSC_KEY_PASSWORD }}'
        run: |
          $certificatePath = Join-Path $env:RUNNER_TEMP 'openwork-signing.pfx'
          if ($env:WINDOWS_CERTIFICATE_INPUT -match '^https?://') {
            Invoke-WebRequest -Uri $env:WINDOWS_CERTIFICATE_INPUT -OutFile $certificatePath
          } else {
            $encoded = $env:WINDOWS_CERTIFICATE_INPUT -replace '^.*base64,', ''
            [IO.File]::WriteAllBytes($certificatePath, [Convert]::FromBase64String($encoded))
          }
          $password = ConvertTo-SecureString $env:WINDOWS_CERTIFICATE_PASSWORD_INPUT -AsPlainText -Force
          $certificate = Import-PfxCertificate -FilePath $certificatePath -CertStoreLocation Cert:\CurrentUser\My -Password $password
          if (-not $certificate.HasPrivateKey) { throw 'The Windows certificate has no private key.' }
          "WINDOWS_CERTIFICATE_THUMBPRINT=$($certificate.Thumbprint)" | Out-File -FilePath $env:GITHUB_ENV -Append

      - name: 'Sign bundled runtime binaries (macOS)'
        if: "runner.os == 'macOS' && inputs.publish"
        shell: 'bash'
        run: |
          set -euo pipefail
          while IFS= read -r -d '' binary; do
            if ! file "$binary" | grep -q 'Mach-O'; then continue; fi
            args=(--force --sign "$APPLE_SIGNING_IDENTITY" --options runtime --timestamp)
            if [[ "$binary" == */node/bin/node ]]; then
              args+=(--entitlements packages/desktop-shell/src-tauri/NodeEntitlements.plist)
            fi
            codesign "${args[@]}" "$binary"
          done < <(find packages/desktop-shell/runtime/openwork -type f -print0)

      - name: 'Refresh bundled runtime checksums (macOS)'
        if: "runner.os == 'macOS' && inputs.publish"
        run: 'node packages/desktop-shell/scripts/prepare-runtime.js --refresh-checksums'

      - name: 'Verify bundled runtime'
        run: 'npm run smoke:runtime --prefix packages/desktop-shell --workspaces=false'

      - name: 'Configure platform signing'
        shell: 'bash'
        env:
          IS_PUBLISH: '${{ inputs.publish }}'
          OPENWORK_UPDATER_PUBLIC_KEY: "${{ inputs.publish && secrets.TAURI_SIGNING_PUBLIC_KEY || '' }}"
        run: |
          node --input-type=module -e "import fs from 'node:fs'; const publish = process.env.IS_PUBLISH === 'true'; const thumbprint = process.env.WINDOWS_CERTIFICATE_THUMBPRINT; const config = { bundle: { createUpdaterArtifacts: publish, ...(thumbprint ? { windows: { certificateThumbprint: thumbprint } } : {}) }, ...(publish ? { plugins: { updater: { pubkey: process.env.OPENWORK_UPDATER_PUBLIC_KEY } } } : {}) }; fs.writeFileSync('packages/desktop-shell/src-tauri/release.conf.json', JSON.stringify(config));"

      - name: 'Build desktop artifacts'
        uses: 'tauri-apps/tauri-action@1deb371b0cd8bd54025b384f1cd735e725c4060f' # v1.0.0
        env:
          APPLE_API_ISSUER: "${{ runner.os == 'macOS' && inputs.publish && (secrets.APPLE_API_ISSUER || secrets.APPLE_NOTARY_ISSUER_ID) || '' }}"
          APPLE_API_KEY: "${{ runner.os == 'macOS' && inputs.publish && (secrets.APPLE_API_KEY || secrets.APPLE_NOTARY_KEY_ID) || '' }}"
          APPLE_CERTIFICATE_PASSWORD: "${{ runner.os == 'macOS' && inputs.publish && (secrets.APPLE_CERTIFICATE_PASSWORD || secrets.MAC_CSC_KEY_PASSWORD) || '' }}"
          TAURI_SIGNING_PRIVATE_KEY: "${{ inputs.publish && secrets.TAURI_SIGNING_PRIVATE_KEY || '' }}"
          TAURI_SIGNING_PRIVATE_KEY_PASSWORD: "${{ inputs.publish && secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD || '' }}"
        with:
          projectPath: 'packages/desktop-shell'
          args: '--config src-tauri/release.conf.json --target ${{ matrix.target }}'
          uploadUpdaterJson: false
          uploadUpdaterSignatures: false
          updaterJsonPreferNsis: true
          uploadWorkflowArtifacts: false

      - name: 'Verify macOS signature'
        if: "runner.os == 'macOS' && inputs.publish"
        shell: 'bash'
        run: |
          set -euo pipefail
          app="$(find packages/desktop-shell/src-tauri/target/${{ matrix.target }}/release/bundle/macos -maxdepth 1 -name '*.app' -print -quit)"
          codesign --verify --deep --strict --verbose=2 "$app"
          spctl --assess --type execute --verbose=2 "$app"

      - name: 'Verify Windows signature'
        if: "runner.os == 'Windows' && inputs.publish"
        shell: 'pwsh'
        run: |
          $installer = Get-ChildItem packages/desktop-shell/src-tauri/target/${{ matrix.target }}/release/bundle/nsis/*.exe | Select-Object -First 1
          $signature = Get-AuthenticodeSignature $installer.FullName
          if ($signature.Status -ne 'Valid') { throw "Invalid Authenticode signature: $($signature.Status)" }

      - name: 'Create Electron bridge archive'
        if: "runner.os == 'macOS' && inputs.electron_bridge"
        shell: 'bash'
        env:
          LEGACY_ARCH: '${{ matrix.legacy_arch }}'
          RELEASE_VERSION: '${{ inputs.version }}'
        run: |
          set -euo pipefail
          app="$(find packages/desktop-shell/src-tauri/target/${{ matrix.target }}/release/bundle/macos -maxdepth 1 -name 'OpenWork.app' -print -quit)"
          if [[ -z "$app" ]]; then
            echo '::error::The OpenWork macOS app bundle was not produced.'
            exit 1
          fi
          destination="packages/desktop-shell/src-tauri/target/${{ matrix.target }}/release/bundle/electron-bridge"
          mkdir -p "$destination"
          ditto -c -k --sequesterRsrc --keepParent "$app" "$destination/OpenWork_${RELEASE_VERSION}_${LEGACY_ARCH}.zip"

      - name: 'Smoke packaged application (macOS)'
        if: "runner.os == 'macOS'"
        shell: 'bash'
        working-directory: 'packages/desktop-shell'
        run: |
          set -euo pipefail
          executable="$(find src-tauri/target/${{ matrix.target }}/release/bundle/macos -path '*.app/Contents/MacOS/*' -type f -perm -111 -print -quit)"
          npm run smoke:packaged -- "$executable"

      - name: 'Smoke packaged application (Windows)'
        if: "runner.os == 'Windows'"
        shell: 'pwsh'
        working-directory: 'packages/desktop-shell'
        run: |
          $executable = Get-ChildItem src-tauri/target/${{ matrix.target }}/release/openwork-desktop.exe | Select-Object -First 1
          npm run smoke:packaged -- $executable.FullName

      - name: 'Smoke packaged application (Linux)'
        if: "runner.os == 'Linux'"
        shell: 'bash'
        working-directory: 'packages/desktop-shell'
        run: 'xvfb-run -a npm run smoke:packaged -- src-tauri/target/${{ matrix.target }}/release/openwork-desktop'

      - name: 'Collect verified artifacts'
        shell: 'bash'
        env:
          LEGACY_ARCH: '${{ matrix.legacy_arch }}'
          RELEASE_VERSION: '${{ inputs.version }}'
        run: |
          set -euo pipefail
          destination="$RUNNER_TEMP/openwork-desktop-artifacts"
          mkdir -p "$destination"
          bundle_root="packages/desktop-shell/src-tauri/target/${{ matrix.target }}/release/bundle"
          while IFS= read -r -d '' artifact; do
            name="$(basename "$artifact")"
            if [[ "$RUNNER_OS" == 'macOS' ]]; then
              case "$name" in
                *.app.tar.gz.sig) name="${name%.app.tar.gz.sig}-${{ matrix.target }}.app.tar.gz.sig" ;;
                *.app.tar.gz) name="${name%.app.tar.gz}-${{ matrix.target }}.app.tar.gz" ;;
                *.dmg) name="OpenWork_${RELEASE_VERSION}_${LEGACY_ARCH}.dmg" ;;
                OpenWork_*.zip) ;;
                *) continue ;;
              esac
            elif [[ "$RUNNER_OS" == 'Windows' ]]; then
              case "$name" in *-setup.exe|*-setup.exe.sig) ;; *) continue ;; esac
            else
              case "$name" in *.AppImage|*.AppImage.sig|*.deb|*.deb.sig) ;; *) continue ;; esac
            fi
            cp "$artifact" "$destination/${name// /-}"
          done < <(find "$bundle_root" -mindepth 2 -maxdepth 2 -type f \( -name '*.dmg' -o -name '*.AppImage' -o -name '*.deb' -o -name '*.exe' -o -name '*.zip' -o -name '*.app.tar.gz' -o -name '*.sig' \) -print0)
          if [[ -z "$(find "$destination" -type f -print -quit)" ]]; then
            echo '::error::No desktop artifacts were produced.'
            exit 1
          fi

      - name: 'Upload verified artifacts'
        uses: 'actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02' # v4
        with:
          name: 'openwork-desktop-${{ matrix.target }}'
          path: '${{ runner.temp }}/openwork-desktop-artifacts/*'
          if-no-files-found: 'error'
          retention-days: 14

  publish:
    name: 'Publish verified release'
    if: 'inputs.publish'
    needs: 'desktop'
    runs-on: 'ubuntu-latest'
    steps:
      - name: 'Check out source'
        uses: 'actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10' # v6.0.3
        with:
          persist-credentials: false

      - name: 'Download verified artifacts'
        uses: 'actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093' # v4
        with:
          pattern: 'openwork-desktop-*'
          path: 'release-assets'
          merge-multiple: true

      - name: 'Generate updater manifest and checksums'
        shell: 'bash'
        env:
          ELECTRON_BRIDGE: '${{ inputs.electron_bridge }}'
          RELEASE_TAG: '${{ inputs.tag }}'
          RELEASE_VERSION: '${{ inputs.version }}'
        run: |
          set -euo pipefail
          node .github/scripts/create-desktop-update-manifest.mjs --assets release-assets --repository "$GITHUB_REPOSITORY" --tag "$RELEASE_TAG" --version "$RELEASE_VERSION" --output release-assets/latest.json
          if [[ "$ELECTRON_BRIDGE" == 'true' ]]; then
            for manifest in macos:latest-mac.yml windows:latest.yml linux:latest-linux.yml; do
              platform="${manifest%%:*}"
              output="${manifest#*:}"
              if [[ "$platform" == 'windows' ]] && ! compgen -G 'release-assets/*-setup.exe' >/dev/null; then
                continue
              fi
              node .github/scripts/create-electron-bridge-manifest.mjs --assets release-assets --platform "$platform" --version "$RELEASE_VERSION" --output "release-assets/$output"
            done
          fi
          (cd release-assets && sha256sum -- * > SHA256SUMS.txt)

      - name: 'Create GitHub release'
        env:
          GH_TOKEN: '${{ github.token }}'
          ELECTRON_BRIDGE: '${{ inputs.electron_bridge }}'
          RELEASE_DRAFT: '${{ inputs.draft }}'
          RELEASE_NAME: '${{ inputs.release_name }}'
          RELEASE_PRERELEASE: '${{ inputs.prerelease }}'
          RELEASE_TAG: '${{ inputs.tag }}'
        run: |
          set -euo pipefail
          args=("$RELEASE_TAG" release-assets/* --target "$GITHUB_SHA" --title "$RELEASE_NAME" --generate-notes)
          if [[ "$RELEASE_DRAFT" == 'false' && "$RELEASE_PRERELEASE" == 'false' && "$ELECTRON_BRIDGE" == 'true' ]]; then args+=(--latest); else args+=(--latest=false); fi
          if [[ "$RELEASE_DRAFT" == 'true' ]]; then args+=(--draft); fi
          if [[ "$RELEASE_PRERELEASE" == 'true' ]]; then args+=(--prerelease); fi
          gh release create "${args[@]}"

      - name: 'Update stable updater feed'
        if: 'inputs.draft == false && inputs.prerelease == false'
        env:
          GH_TOKEN: '${{ github.token }}'
          RELEASE_VERSION: '${{ inputs.version }}'
        run: |
          set -euo pipefail
          if gh release view desktop-latest >/dev/null 2>&1; then
            directory="$(mktemp -d)"
            trap 'rm -rf "$directory"' EXIT
            gh release download desktop-latest --dir "$directory" --pattern 'latest.json'
            current="$(jq -r '.version' "$directory/latest.json")"
            if [[ ! "$current" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
              echo "::error::Current Desktop stable feed has an invalid version: $current"
              exit 1
            fi
            newest="$(printf '%s\n%s\n' "$RELEASE_VERSION" "$current" | sort -V | tail -n 1)"
            if [[ "$current" != "$RELEASE_VERSION" && "$newest" == "$current" ]]; then
              echo "::notice::Desktop $RELEASE_VERSION will not replace newer stable feed $current."
              exit 0
            fi
            gh release upload desktop-latest release-assets/latest.json --clobber
          else
            gh release create desktop-latest release-assets/latest.json --title 'OpenWork Desktop latest' --notes 'Stable desktop updater feed.' --latest=false
          fi