guara/.gitea/workflows/release.yml

name: Release

# Triggered when a v* tag is pushed: creates the Gitea Release entry with notes
# from CHANGELOG.md, builds the CLI (Linux x86_64 and aarch64) and the desktop
# app (Linux aarch64, Linux x86_64, and Windows via cargo-xwin cross-compilation),
# and generates the latest.json manifest read by the desktop updater.
#
# No macOS: Tauri requires Apple's SDK and code-signing hardware/account, which
# this Linux ARM64 runner does not have.
#
# Required repository/user secrets: GUARA_TAURI_SIGNING_PRIVATE_KEY and
# GUARA_TAURI_SIGNING_PRIVATE_KEY_PASSWORD (sign updater bundles). Unprefixed
# secret names remain supported as fallback.
on:
  push:
    tags: ['v*']

env:
  CARGO_TERM_COLOR: always
  CARGO_HOME: /opt/hostedtoolcache/cargo
  RUSTUP_HOME: /opt/hostedtoolcache/rustup
  NPM_CONFIG_CACHE: /opt/hostedtoolcache/npm-cache
  XWIN_CACHE_DIR: /opt/hostedtoolcache/xwin-cache

jobs:
  release:
    name: Create release
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
        with:
          fetch-depth: 0
      - name: Release
        env:
          TAG: ${{ gitea.ref_name }}
          TOKEN: ${{ gitea.token }}
          API: ${{ gitea.server_url }}/api/v1/repos/${{ gitea.repository }}
        run: |
          # Re-running the workflow does not recreate an existing release.
          if curl -fsS -H "Authorization: token $TOKEN" "$API/releases/tags/$TAG" >/dev/null 2>&1; then
            echo "release $TAG already exists"; exit 0
          fi
          scripts/release-notes.sh "$TAG" > notes.md
          pre=false; case "$TAG" in *-*) pre=true ;; esac
          jq -n --arg tag "$TAG" --arg name "Guará ${TAG#v}" --rawfile body notes.md --argjson pre "$pre" \
            '{tag_name:$tag, name:$name, body:$body, prerelease:$pre}' > release.json
          curl -fsS -X POST "$API/releases" -H "Authorization: token $TOKEN" \
            -H 'Content-Type: application/json' -d @release.json >/dev/null

  cli:
    name: CLI (${{ matrix.platform }})
    needs: release
    runs-on: ubuntu-latest
    env:
      CARGO_TARGET_DIR: /opt/hostedtoolcache/cargo-target/guara-release-cli-${{ matrix.platform }}
    strategy:
      fail-fast: false
      matrix:
        include:
          - { platform: linux-aarch64, target: aarch64-unknown-linux-gnu, apt: "" }
          - { platform: linux-x86_64, target: x86_64-unknown-linux-gnu, apt: "gcc-x86-64-linux-gnu" }
    steps:
      - uses: actions/checkout@v7
      - uses: dtolnay/rust-toolchain@stable
        with:
          targets: ${{ matrix.target }}
      - name: Platform cross-linker
        if: ${{ matrix.apt != '' }}
        run: scripts/apt-install.sh /opt/hostedtoolcache/apt-cache/cli-x86_64 ${{ matrix.apt }}
      - name: Build and package
        run: scripts/package-cli.sh "${{ gitea.ref_name }}" "${{ matrix.platform }}" "${{ matrix.target }}" | tee packages.txt
      - name: Upload to release
        env:
          TOKEN: ${{ gitea.token }}
          API: ${{ gitea.server_url }}/api/v1/repos/${{ gitea.repository }}
        run: scripts/release-upload.sh "${{ gitea.ref_name }}" $(cat packages.txt)

  gui:
    name: Desktop app (${{ matrix.platform }})
    needs: release
    runs-on: ubuntu-latest
    env:
      CARGO_TARGET_DIR: /opt/hostedtoolcache/cargo-target/guara-release-gui-${{ matrix.platform }}
      TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.GUARA_TAURI_SIGNING_PRIVATE_KEY || secrets.TAURI_SIGNING_PRIVATE_KEY }}
      TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.GUARA_TAURI_SIGNING_PRIVATE_KEY_PASSWORD || secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
    strategy:
      fail-fast: false
      matrix:
        platform: [linux-aarch64, linux-x86_64, windows]
    steps:
      - uses: actions/checkout@v7
      - uses: dtolnay/rust-toolchain@stable
      - uses: actions/setup-node@v7
        with:
          node-version: 22
      - name: Tauri dependencies (Linux aarch64)
        if: matrix.platform == 'linux-aarch64'
        timeout-minutes: 25
        run: scripts/apt-install.sh /opt/hostedtoolcache/apt-cache/tauri-native libwebkit2gtk-4.1-dev libayatana-appindicator3-dev librsvg2-dev patchelf
      - name: Tauri dependencies (Linux x86_64)
        if: matrix.platform == 'linux-x86_64'
        timeout-minutes: 25
        run: |
          if [ "$(uname -m)" = aarch64 ]; then
            dpkg --add-architecture amd64
            . /etc/os-release
            if [ "${ID:-}" = ubuntu ]; then
              if [ -f /etc/apt/sources.list.d/ubuntu.sources ]; then
                grep -q '^Architectures:' /etc/apt/sources.list.d/ubuntu.sources || sed -i '/^Types: deb/a Architectures: arm64' /etc/apt/sources.list.d/ubuntu.sources
                printf 'Types: deb\nURIs: http://archive.ubuntu.com/ubuntu/\nSuites: %s %s-updates %s-security\nComponents: main universe\nArchitectures: amd64\nSigned-By: /usr/share/keyrings/ubuntu-archive-keyring.gpg\n' "$VERSION_CODENAME" "$VERSION_CODENAME" "$VERSION_CODENAME" >/etc/apt/sources.list.d/amd64.sources
              elif [ -f /etc/apt/sources.list ]; then
                sed -i 's/^deb http/deb [arch=arm64] http/' /etc/apt/sources.list
                printf 'deb [arch=amd64] http://archive.ubuntu.com/ubuntu/ %s main universe\ndeb [arch=amd64] http://archive.ubuntu.com/ubuntu/ %s-updates main universe\ndeb [arch=amd64] http://archive.ubuntu.com/ubuntu/ %s-security main universe\n' "$VERSION_CODENAME" "$VERSION_CODENAME" "$VERSION_CODENAME" >/etc/apt/sources.list.d/amd64.list
              fi
            fi
            scripts/apt-install.sh /opt/hostedtoolcache/apt-cache/tauri-amd64 gcc-x86-64-linux-gnu g++-x86-64-linux-gnu pkg-config patchelf file squashfs-tools qemu-user libglib2.0-bin libwebkit2gtk-4.1-dev:amd64 libayatana-appindicator3-dev:amd64 librsvg2-dev:amd64
          else
            scripts/apt-install.sh /opt/hostedtoolcache/apt-cache/tauri-native libwebkit2gtk-4.1-dev libayatana-appindicator3-dev librsvg2-dev patchelf
          fi
      - name: Cross-compilation tools (Windows)
        if: matrix.platform == 'windows'
        run: |
          scripts/apt-install.sh /opt/hostedtoolcache/apt-cache/tauri-win nsis lld llvm clang
          command -v cargo-xwin >/dev/null || cargo install cargo-xwin --locked
      - name: Build and package
        run: scripts/build-gui.sh "${{ matrix.platform }}"
      - name: Upload to release
        env:
          TOKEN: ${{ gitea.token }}
          API: ${{ gitea.server_url }}/api/v1/repos/${{ gitea.repository }}
        run: scripts/release-upload.sh "${{ gitea.ref_name }}" dist-gui/*

  updater:
    name: Build latest.json
    needs: gui
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
      - name: latest.json
        env:
          TAG: ${{ gitea.ref_name }}
          TOKEN: ${{ gitea.token }}
          API: ${{ gitea.server_url }}/api/v1/repos/${{ gitea.repository }}
        run: |
          scripts/release-notes.sh "$TAG" > notes.md
          python3 scripts/make-latest-json.py "$TAG" notes.md latest.json
      - name: Upload to release
        env:
          TOKEN: ${{ gitea.token }}
          API: ${{ gitea.server_url }}/api/v1/repos/${{ gitea.repository }}
        run: scripts/release-upload.sh "${{ gitea.ref_name }}" latest.json