release.yml

name: Release

on:
  workflow_dispatch:
    inputs:
      target:
        description: "Release target"
        required: true
        type: choice
        options:
          - product
          - packages
        default: product
      bump:
        description: "Stable version bump"
        required: true
        type: choice
        options:
          - patch
          - minor
          - major
        default: patch
      packages:
        description: "Package-only aliases: plugin-kit, plugin, util, sdk"
        required: false
        type: string
        default: ""
      tag:
        description: "npm dist-tag for package-only releases"
        required: false
        type: string
        default: latest

jobs:
  stable_native_assets:
    name: Build Stable Native Assets
    if: ${{ inputs.target == 'product' }}
    uses: ./.github/workflows/build-helpers.yml
    permissions:
      contents: read

  stable_candidate:
    name: Publish Stable Candidate
    needs: [stable_native_assets]
    if: ${{ inputs.target == 'product' }}
    runs-on: ubuntu-latest
    permissions:
      contents: write
    outputs:
      version: ${{ steps.publish.outputs.version }}
      state_path: ${{ steps.publish.outputs.state_path }}
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          fetch-depth: 0
          token: ${{ secrets.GITHUB_TOKEN }}
          persist-credentials: false

      - name: Setup Bun
        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
        with:
          bun-version: "1.4.3"

      - name: Download PTY libraries
        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
        with:
          path: packages/local-runtime/.artifacts/pty
          pattern: pty-assets-*
          merge-multiple: true

      - name: Download sandbox assets
        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
        with:
          path: packages/local-runtime/sandbox-assets
          pattern: sandbox-assets-*
          merge-multiple: true

      - name: Download patched SQLite engine
        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
        with:
          name: sqlite-assets-darwin
          path: packages/harness/.artifacts/sqlite

      - name: Download verified watcher assets
        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
        with:
          path: packages/local-runtime/.artifacts/watcher
          pattern: watcher-assets-*
          merge-multiple: true

      - name: Validate product release environment
        run: bun run ./script/release/validate-product-environment.ts
        env:
          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
          APPLE_ID: ${{ secrets.APPLE_ID }}
          APPLE_APP_SPECIFIC_PASSWORD: ${{ secrets.APPLE_APP_SPECIFIC_PASSWORD }}
          APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
          CSC_LINK: ${{ secrets.CSC_LINK }}
          CSC_KEY_PASSWORD: ${{ secrets.CSC_KEY_PASSWORD }}
          CSC_INSTALLER_LINK: ${{ secrets.CSC_INSTALLER_LINK }}
          CSC_INSTALLER_KEY_PASSWORD: ${{ secrets.CSC_INSTALLER_KEY_PASSWORD }}
          WINDOWS_CERTIFICATE: ${{ secrets.WINDOWS_CERTIFICATE }}
          WINDOWS_CERTIFICATE_PASSWORD: ${{ secrets.WINDOWS_CERTIFICATE_PASSWORD }}

      - name: Assert Windows signing continuity
        run: bun run ./script/release/assert-windows-signing-continuity.ts
        env:
          WINDOWS_CERTIFICATE: ${{ secrets.WINDOWS_CERTIFICATE }}
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

      - name: Configure Git
        run: |
          git config user.name "github-actions[bot]"
          git config user.email "github-actions[bot]@users.noreply.github.com"

      - name: Install dependencies
        # Runtime preparation needs every platform package (ast-grep, watcher) in
        # node_modules/.bun, so install all os/cpu variants instead of host-only.
        run: bun install --os='*' --cpu='*'

      - name: Publish npm candidate and draft assets
        id: publish
        shell: bash
        run: |
          GIT_AUTH_HEADER="AUTHORIZATION: basic $(printf 'x-access-token:%s' "$GITHUB_TOKEN" | base64 -w0)"
          GIT_CONFIG_COUNT=1 \
            GIT_CONFIG_KEY_0=http.https://github.com/.extraheader \
            GIT_CONFIG_VALUE_0="$GIT_AUTH_HEADER" \
            bun run ./script/release/stable-start.ts
        env:
          SYNERGY_BUMP: ${{ inputs.bump }}
          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          SYNERGY_REQUIRE_SANDBOX_ASSETS: "1"
          SYNERGY_BUILD_TARGETS: linux-arm64,linux-x64,linux-x64-baseline,linux-arm64-musl,linux-x64-musl,linux-x64-baseline-musl,darwin-arm64,darwin-x64,darwin-x64-baseline,win32-x64,win32-x64-baseline

      - name: Upload release state
        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        with:
          name: release-state-${{ steps.publish.outputs.version }}
          path: ${{ steps.publish.outputs.state_path }}

  stable_desktop_package:
    name: Build Desktop Artifacts (${{ matrix.platform }})
    needs: [stable_candidate, stable_native_assets]
    if: ${{ inputs.target == 'product' && needs.stable_candidate.result == 'success' && needs.stable_native_assets.result == 'success' }}
    runs-on: ${{ matrix.os }}
    permissions:
      contents: read
    strategy:
      fail-fast: false
      matrix:
        include:
          - os: macos-latest
            platform: darwin
            runtime_targets: darwin-x64,darwin-arm64
            builder_args: --mac pkg dmg zip --x64 --arm64
          - os: windows-latest
            platform: win32
            runtime_targets: win32-x64
            builder_args: --win nsis zip --x64
          - os: ubuntu-latest
            platform: linux
            runtime_targets: linux-x64,linux-arm64
            builder_args: --linux AppImage deb tar.gz --x64 --arm64
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          fetch-depth: 0
          token: ${{ secrets.GITHUB_TOKEN }}
          persist-credentials: false

      - name: Setup Bun
        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
        with:
          bun-version: "1.4.3"

      - name: Install Linux packaging dependencies
        if: ${{ matrix.platform == 'linux' }}
        run: sudo apt-get update && sudo apt-get install -y libarchive-tools rpm

      - name: Install dependencies
        # Runtime preparation needs every platform package (ast-grep, watcher) in
        # node_modules/.bun, so install all os/cpu variants instead of host-only.
        run: bun install --os='*' --cpu='*'

      - name: Download PTY libraries
        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
        with:
          path: packages/local-runtime/.artifacts/pty
          pattern: pty-assets-*
          merge-multiple: true

      - name: Download sandbox assets
        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
        with:
          path: packages/local-runtime/sandbox-assets
          pattern: sandbox-assets-*
          merge-multiple: true

      - name: Download verified watcher assets
        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
        with:
          path: packages/local-runtime/.artifacts/watcher
          pattern: watcher-assets-*
          merge-multiple: true
      - name: Prepare release version
        run: bun run ./script/release/desktop-prepare-version.ts
        env:
          SYNERGY_VERSION: ${{ needs.stable_candidate.outputs.version }}

      - name: Build Synergy runtime for desktop package
        run: bun run ./packages/presets/script/build.ts
        env:
          NODE_OPTIONS: --max-old-space-size=4096
          SYNERGY_VERSION: ${{ needs.stable_candidate.outputs.version }}
          SYNERGY_CHANNEL: stable
          SYNERGY_BUILD_TARGETS: ${{ matrix.runtime_targets }}
          SYNERGY_REQUIRE_SANDBOX_ASSETS: "1"

      - name: Prepare Synergy runtime for desktop package
        run: bun run ./script/release/prepare-desktop-runtime.ts
        env:
          SYNERGY_BUILD_TARGETS: ${{ matrix.runtime_targets }}

      - name: Build desktop main process
        run: bun run --cwd apps/desktop desktop:build

      - name: Package desktop artifact
        shell: bash
        run: |
          BUILDER_ARGS=(${{ matrix.builder_args }})
          case "${WIN_CSC_LINK:-}" in
            *[![:space:]]*) WIN_CSC_CONFIGURED=1 ;;
            *) WIN_CSC_CONFIGURED=0 ;;
          esac
          if [ "${{ matrix.platform }}" = "win32" ] && [ "${WIN_CSC_CONFIGURED}" = "1" ]; then
            BUILDER_ARGS+=(--config.forceCodeSigning=true)
          fi
          if [ -z "${CSC_LINK:-}" ]; then
            unset CSC_LINK
            unset CSC_KEY_PASSWORD
            if [ "${{ matrix.platform }}" = "darwin" ]; then
              BUILDER_ARGS+=(--config.mac.identity=null)
            fi
          fi
          if [ -z "${APPLE_ID:-}" ]; then
            unset APPLE_ID
            unset APPLE_APP_SPECIFIC_PASSWORD
            unset APPLE_TEAM_ID
          fi
          cd apps/desktop
          bunx electron-builder "${BUILDER_ARGS[@]}" --publish=never
        env:
          APPLE_ID: ${{ secrets.APPLE_ID }}
          APPLE_APP_SPECIFIC_PASSWORD: ${{ secrets.APPLE_APP_SPECIFIC_PASSWORD }}
          APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
          CSC_LINK: ${{ matrix.platform == 'darwin' && secrets.CSC_LINK || '' }}
          CSC_KEY_PASSWORD: ${{ matrix.platform == 'darwin' && secrets.CSC_KEY_PASSWORD || '' }}
          CSC_INSTALLER_LINK: ${{ matrix.platform == 'darwin' && secrets.CSC_INSTALLER_LINK || '' }}
          CSC_INSTALLER_KEY_PASSWORD: ${{ matrix.platform == 'darwin' && secrets.CSC_INSTALLER_KEY_PASSWORD || '' }}
          CSC_IDENTITY_AUTO_DISCOVERY: ${{ matrix.platform == 'darwin' && 'true' || 'false' }}
          WIN_CSC_LINK: ${{ matrix.platform == 'win32' && secrets.WINDOWS_CERTIFICATE || '' }}
          WIN_CSC_KEY_PASSWORD: ${{ matrix.platform == 'win32' && secrets.WINDOWS_CERTIFICATE_PASSWORD || '' }}
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

      - name: Verify Windows Authenticode signature
        if: ${{ matrix.platform == 'win32' }}
        shell: pwsh
        env:
          WIN_CSC_LINK: ${{ secrets.WINDOWS_CERTIFICATE }}
        run: |
          if ([string]::IsNullOrWhiteSpace($env:WIN_CSC_LINK)) {
            Write-Host "Windows signing not configured; skipping Authenticode signature verification"
            exit 0
          }
          $installer = Get-ChildItem apps/desktop/release/Synergy-win32-x64-*.exe | Select-Object -First 1
          if (-not $installer) { throw "Windows installer was not produced" }
          $signature = Get-AuthenticodeSignature $installer.FullName
          if ($signature.Status -ne 'Valid') {
            throw "Windows installer Authenticode signature is not valid: $($signature.Status)"
          }

      - name: Record portable Desktop application identities
        run: bun script/release/desktop-app-receipt.ts
        env:
          SYNERGY_VERSION: ${{ needs.stable_candidate.outputs.version }}
          APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
          WINDOWS_CERTIFICATE: ${{ secrets.WINDOWS_CERTIFICATE }}

      - name: Upload desktop artifact bundle
        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        with:
          name: desktop-artifacts-${{ matrix.platform }}
          path: |
            apps/desktop/release/*.AppImage
            apps/desktop/release/*.blockmap
            apps/desktop/release/*.deb
            apps/desktop/release/*.dmg
            apps/desktop/release/*.pkg
            apps/desktop/release/*.exe
            apps/desktop/release/*.tar.gz
            apps/desktop/release/*.yml
            apps/desktop/release/*.zip
            apps/desktop/release/synergy-desktop-app-*.json

  stable_desktop_publish:
    name: Upload Desktop Artifacts
    needs: [stable_candidate, stable_desktop_package]
    if: ${{ inputs.target == 'product' && needs.stable_candidate.result == 'success' && needs.stable_desktop_package.result == 'success' }}
    runs-on: ubuntu-latest
    permissions:
      contents: write
    env:
      RELEASE_VERSION: ${{ needs.stable_candidate.outputs.version }}
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - name: Setup Bun
        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
        with:
          bun-version: "1.4.3"

      - name: Install dependencies
        run: bun install

      - name: Download desktop artifacts
        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
        with:
          path: desktop-release-input
          pattern: desktop-artifacts-*
          merge-multiple: true

      - name: Generate checksums
        shell: bash
        run: |
          mkdir -p desktop-release
          find desktop-release-input -maxdepth 2 -type f -exec cp {} desktop-release/ \;
          SYNERGY_VERSION="${RELEASE_VERSION}" bun run --cwd apps/desktop script/checksums.ts "${GITHUB_WORKSPACE}/desktop-release"

      - name: Upload desktop assets to draft release
        shell: bash
        run: gh release upload "v${RELEASE_VERSION}" desktop-release/* --clobber
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

      - name: Publish Desktop application package
        run: bun script/release/publish-desktop-app.ts desktop-release
        env:
          SYNERGY_VERSION: ${{ needs.stable_candidate.outputs.version }}
          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}

  stable_finalize:
    name: Finalize Stable Release
    needs: [stable_candidate, stable_desktop_publish]
    if: ${{ inputs.target == 'product' && always() && needs.stable_candidate.result == 'success' && needs.stable_desktop_publish.result == 'success' }}
    runs-on: ubuntu-latest
    permissions:
      contents: write
      pull-requests: write
    env:
      RELEASE_VERSION: ${{ needs.stable_candidate.outputs.version }}
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          fetch-depth: 0
          token: ${{ secrets.GITHUB_TOKEN }}
          persist-credentials: false

      - name: Configure Git
        run: |
          git config user.name "github-actions[bot]"
          git config user.email "github-actions[bot]@users.noreply.github.com"

      - name: Setup Bun
        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
        with:
          bun-version: "1.4.3"

      - name: Install dependencies
        run: bun install

      - name: Download release state
        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
        with:
          name: release-state-${{ env.RELEASE_VERSION }}
          path: .release

      - name: Promote latest and finalize GitHub release
        run: bun run ./script/release/stable-complete.ts
        env:
          SYNERGY_VERSION: ${{ env.RELEASE_VERSION }}
          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

      - name: Sync main branch with dev
        run: |
          REPO="${{ github.repository }}"
          gh pr create \
            --base main \
            --head dev \
            --title "chore: sync main with dev (v${{ env.RELEASE_VERSION }})" \
            --body "Automated sync from dev after release v${{ env.RELEASE_VERSION }}." \
            --repo "$REPO" || true
          PR_NUMBER=$(gh pr list --base main --head dev --state open --json number --jq '.[0].number' --repo "$REPO")
          if [ -n "$PR_NUMBER" ]; then
            gh pr merge "$PR_NUMBER" --merge --admin --delete-branch=false --repo "$REPO"
          fi
        env:
          GH_TOKEN: ${{ secrets.SYNC_PAT }}

  package_release:
    name: Publish Package-Only Release
    if: ${{ inputs.target == 'packages' }}
    runs-on: ubuntu-latest
    permissions:
      contents: write
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          fetch-depth: 0
          token: ${{ secrets.GITHUB_TOKEN }}
          persist-credentials: false

      - name: Setup Bun
        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
        with:
          bun-version: "1.4.3"

      - name: Configure Git
        run: |
          git config user.name "github-actions[bot]"
          git config user.email "github-actions[bot]@users.noreply.github.com"

      - name: Install dependencies
        run: bun install

      - name: Publish selected packages
        shell: bash
        run: |
          GIT_AUTH_HEADER="AUTHORIZATION: basic $(printf 'x-access-token:%s' "$GITHUB_TOKEN" | base64 -w0)"
          GIT_CONFIG_COUNT=1 \
            GIT_CONFIG_KEY_0=http.https://github.com/.extraheader \
            GIT_CONFIG_VALUE_0="$GIT_AUTH_HEADER" \
            bun run ./script/release/package-only.ts
        env:
          SYNERGY_BUMP: ${{ inputs.bump }}
          SYNERGY_RELEASE_PACKAGES: ${{ inputs.packages }}
          SYNERGY_NPM_TAG: ${{ inputs.tag }}
          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}