release.yml

# Need to write to repo contents to upload the app to GitHub Release
# See: https://www.electronforge.io/config/publishers/github#authentication
permissions:
  contents: write

name: Release app
on:
  workflow_dispatch:
  push:
    branches: [v0.1.0, release/**]
jobs:
  build:
    environment: release
    permissions:
      contents: write
    strategy:
      # Uncomment max-parallel to prevent race condition (where multiple releases are
      # created concurrently). Typically though, we'll create a release manually ahead of time
      # which prevents the race.
      # max-parallel: 1
      matrix:
        # See https://github.com/SFARPak/dyad/issues/96
        os:
          [
            { name: "windows", image: "windows-latest" },
            { name: "linux", image: "ubuntu-22.04" },
            { name: "macos-intel", image: "macos-13" },
            { name: "macos", image: "macos-latest" },
          ]
    runs-on: ${{ matrix.os.image }}
    steps:
      - name: Github checkout
        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
      - name: Use Node.js
        uses: actions/setup-node@cdca7365b2dadb8aad0a33bc7601856ffabcc48e # v4.3.0
        with:
          node-version: 20
      - name: Clean up
        run: |
          rm -rf node_modules
          npm cache clean --force
        shell: bash
      - run: npm ci --include=optional || npm install --include=optional
      - run: npm rebuild @rollup/rollup-linux-x64-gnu || true
        if: contains(matrix.os.name, 'linux')
      - run: npm rebuild @rollup/rollup-darwin-x64 || true
        if: contains(matrix.os.name, 'macos-intel')
      - run: npm rebuild @rollup/rollup-darwin-arm64 || true
        if: contains(matrix.os.name, 'macos')
      - run: npm rebuild @rollup/rollup-win32-x64-msvc || true
        if: contains(matrix.os.name, 'windows')
      # Publish (all platforms)
      - name: Publish app
        env:
          NODE_OPTIONS: "--max-old-space-size=4096"
          SM_CODE_SIGNING_CERT_SHA1_HASH: ${{ secrets.SM_CODE_SIGNING_CERT_SHA1_HASH }}
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
          APPLE_ID: ${{ secrets.APPLE_ID }}
          APPLE_PASSWORD: ${{ secrets.APPLE_PASSWORD }}
        run: |
          set -e
          echo "=== Running publish (npm run publish) ==="
          DEBUG=electron-forge:* npm run publish 2>&1 | tee publish.log
        shell: bash

      - name: Wait for GitHub to register release uploads
        # Some publishers upload files asynchronously; wait and then list assets
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          set -e
          VERSION=$(node -e "console.log(require('./package.json').version)")
          TAG="v${VERSION}"
          echo "Waiting for GitHub to register release ${TAG} assets..."
          # Poll releases/tags endpoint for up to 90s (9 attempts)
          attempts=0
          max=9
          sleep_interval=10
          while [ $attempts -lt $max ]; do
            echo "Attempt $((attempts+1))/${max}..."
            # Use the tag endpoint to retrieve the release by tag
            resp=$(curl -s -H "Authorization: token ${GITHUB_TOKEN}" -H "Accept: application/vnd.github.v3+json" "https://api.github.com/repos/${{ github.repository }}/releases/tags/${TAG}" || true)
            if echo "$resp" | grep -q "\"message\": \"Not Found\""; then
              echo "Release ${TAG} not found yet."
            else
              echo "Release found; printing release summary:"
              echo "$resp" | jq -r '. | {name: .name, tag_name: .tag_name, draft: .draft, published_at: .published_at, html_url: .html_url, assets_count: .assets | length}'
              echo "Assets list (name | size | url):"
              echo "$resp" | jq -r '.assets[] | "\(.name) | \(.size) | \(.browser_download_url)"' || true
              assets_count=$(echo "$resp" | jq '.assets | length')
              if [ "$assets_count" -gt 0 ]; then
                echo "Assets are present (count=$assets_count)"
                break
              else
                echo "No assets yet; will retry."
              fi
            fi
            attempts=$((attempts+1))
            sleep $sleep_interval
          done
          if [ $attempts -eq $max ]; then
            echo "Warning: Assets did not appear within the expected time. The verify job may fail."
          fi
        shell: bash

  verify-assets:
    name: Verify Release Assets
    needs: build
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: read
      actions: read
      id-token: write
    steps:
      - name: Github checkout
        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
      - name: Use Node.js
        uses: actions/setup-node@cdca7365b2dadb8aad0a33bc7601856ffabcc48e # v4.3.0
        with:
          node-version: 20
      - name: Verify all release assets are uploaded
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          echo "Running release asset verification..."
          node scripts/verify-release-assets.js
        shell: bash