guara/.github/workflows/release.yml

name: Release

# Publica uma release pública ao empurrar uma tag vX.Y.Z (ex.: git tag v0.1.0 && git push --tags)
on:
  push:
    tags: ["v*.*.*"]

permissions:
  contents: write

env:
  CARGO_TERM_COLOR: always

jobs:
  create-release:
    name: Cria a release
    runs-on: ubuntu-24.04
    outputs:
      release_id: ${{ steps.rel.outputs.result }}
    steps:
      - uses: actions/checkout@v7
      - name: Notas da versão (do CHANGELOG)
        id: notes
        run: |
          v="${GITHUB_REF_NAME#v}"
          v="${v%%-*}"
          awk -v v="$v" '$0 ~ "^## \\[" v "\\]" {f=1; next} /^## \[/ {f=0} f' CHANGELOG.md > notes.md
          [ -s notes.md ] || echo "Veja o CHANGELOG." > notes.md
      - uses: actions/github-script@v9
        id: rel
        with:
          script: |
            const fs = require('fs');
            const tag = context.ref.replace('refs/tags/', '');
            const r = await github.rest.repos.createRelease({
              owner: context.repo.owner, repo: context.repo.repo, tag_name: tag,
              name: `Guará ${tag}`, body: fs.readFileSync('notes.md', 'utf8'),
              draft: true, prerelease: tag.includes('-'),
            });
            return r.data.id;

  cli:
    name: CLI (${{ matrix.name }})
    needs: create-release
    runs-on: ${{ matrix.os }}
    strategy:
      fail-fast: false
      matrix:
        include:
          - { name: linux-x86_64, os: ubuntu-24.04, target: x86_64-unknown-linux-gnu }
          - { name: linux-aarch64, os: ubuntu-24.04-arm, target: aarch64-unknown-linux-gnu }
          - { name: macos-aarch64, os: macos-latest, target: aarch64-apple-darwin }
          - { name: macos-x86_64, os: macos-latest, target: x86_64-apple-darwin }
          - { name: windows-x86_64, os: windows-latest, target: x86_64-pc-windows-msvc }
    steps:
      - uses: actions/checkout@v7
      - uses: dtolnay/rust-toolchain@stable
        with:
          targets: ${{ matrix.target }}
      - uses: Swatinem/rust-cache@v2
      - run: cargo build --release --locked -p guara-cli --target ${{ matrix.target }}
      - name: Empacota
        shell: bash
        run: |
          name="guara-${GITHUB_REF_NAME}-${{ matrix.name }}"
          mkdir "$name"
          if [ "$RUNNER_OS" = "Windows" ]; then
            cp target/${{ matrix.target }}/release/guara.exe "$name/"
          else
            cp target/${{ matrix.target }}/release/guara "$name/"
          fi
          cp README.md LICENSE-MIT LICENSE-APACHE "$name/"
          if [ "$RUNNER_OS" = "Windows" ]; then
            7z a "$name.zip" "$name" >/dev/null; asset="$name.zip"
          else
            tar czf "$name.tar.gz" "$name"; asset="$name.tar.gz"
          fi
          if command -v sha256sum >/dev/null; then sha256sum "$asset" > "$asset.sha256"; else shasum -a 256 "$asset" > "$asset.sha256"; fi
          echo "ASSET=$asset" >> "$GITHUB_ENV"
      - name: Envia para a release
        shell: bash
        env:
          GH_TOKEN: ${{ github.token }}
        run: gh release upload "$GITHUB_REF_NAME" "$ASSET" "$ASSET.sha256" --clobber

  gui:
    name: App desktop (${{ matrix.name }})
    needs: create-release
    runs-on: ${{ matrix.os }}
    # Os segredos de assinatura do atualizador ficam no ambiente "release", que só aceita tags v*.
    environment: release
    strategy:
      fail-fast: false
      matrix:
        include:
          - { name: linux-x86_64, os: ubuntu-24.04, args: "" }
          - { name: macos-aarch64, os: macos-latest, args: "--target aarch64-apple-darwin" }
          - { name: macos-x86_64, os: macos-latest, args: "--target x86_64-apple-darwin" }
          - { name: windows-x86_64, os: windows-latest, args: "" }
    steps:
      - uses: actions/checkout@v7
      - uses: dtolnay/rust-toolchain@stable
        with:
          targets: ${{ contains(matrix.args, 'apple') && 'aarch64-apple-darwin,x86_64-apple-darwin' || '' }}
      - uses: Swatinem/rust-cache@v2
        with:
          workspaces: apps/gui/src-tauri
      - uses: actions/setup-node@v7
        with:
          node-version: 22
      - name: Cache dos pacotes do Tauri (.deb)
        if: runner.os == 'Linux'
        uses: actions/cache@v6
        with:
          path: ~/apt-cache
          key: apt-tauri-${{ runner.os }}-${{ runner.arch }}-${{ env.ImageVersion }}-${{ hashFiles('scripts/apt-install.sh') }}
      - name: Dependências do Tauri (Linux)
        if: runner.os == 'Linux'
        timeout-minutes: 25
        run: scripts/apt-install.sh ~/apt-cache libwebkit2gtk-4.1-dev libayatana-appindicator3-dev librsvg2-dev patchelf
      - name: Gera os ícones
        run: npx --yes @tauri-apps/cli@2 icon apps/gui/src-tauri/icons/source.png -o apps/gui/src-tauri/icons
      # A chave privada de atualização fica só nos segredos do repositório. Ela assina os pacotes
      # que o app baixa sozinho; a chave pública correspondente está em tauri.conf.json.
      - uses: tauri-apps/tauri-action@v1
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
          TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
        with:
          projectPath: apps/gui/src-tauri
          releaseId: ${{ needs.create-release.outputs.release_id }}
          args: ${{ matrix.args }}
          # o latest.json é montado no job de publicação, de uma vez só (scripts/make-latest-json.py)
          uploadUpdaterJson: false

  publish:
    name: Publica a release
    needs: [create-release, cli, gui]
    runs-on: ubuntu-24.04
    steps:
      - uses: actions/checkout@v7
      - name: Notas da versão (do CHANGELOG)
        run: |
          v="${GITHUB_REF_NAME#v}"
          v="${v%%-*}"
          awk -v v="$v" '$0 ~ "^## \\[" v "\\]" {f=1; next} /^## \[/ {f=0} f' CHANGELOG.md > notes.md
          [ -s notes.md ] || echo "Veja o CHANGELOG." > notes.md
      - uses: actions/github-script@v9
        with:
          script: |
            const fs = require('fs');
            await github.rest.repos.updateRelease({
              owner: context.repo.owner, repo: context.repo.repo,
              release_id: ${{ needs.create-release.outputs.release_id }},
              name: `Guará ${context.ref.replace('refs/tags/', '')}`,
              body: fs.readFileSync('notes.md', 'utf8'),
              draft: false,
            });
      # Depois de publicada (rascunho não é visível por tag), monta e sobe o latest.json.
      - name: latest.json do atualizador do app
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          GH_REPO: ${{ github.repository }}
        run: |
          python3 scripts/make-latest-json.py "$GITHUB_REF_NAME" notes.md latest.json
          gh release upload "$GITHUB_REF_NAME" latest.json --clobber