release.yml

name: Release

on:
  push:
    tags:
      - 'v*'

permissions: {}

# Release paths never touch the Actions cache; enforced regardless of per-step settings.
cache-mode: none

# Each platform runs `publish --dry-run`; `release` runs `--from-dry-run`.
# Jobs with secrets install with `--mode=skip-build`, so no dependency scripts
# run there. Only `build-windows` (Azure), `attest` (Sigstore) and `release`
# (the releaser app's token) can request OIDC tokens; `attest` runs no
# repository or dependency code.

jobs:
  test:
    name: Test
    permissions:
      contents: read
    uses: ./.github/workflows/ci.yml

  build:
    name: Build (${{ matrix.os }}, ${{ matrix.arch }})
    strategy:
      fail-fast: false
      matrix:
        os:
          - macos-latest-large
          - ubuntu-latest
        arch:
          - x64
        include:
          - os: macos-latest-xlarge
            arch: arm64
          - os: ubuntu-24.04-arm
            arch: arm64
    runs-on: ${{ matrix.os }}
    permissions:
      contents: read
    environment: release
    steps:
      - run: git config --global core.autocrlf input
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - name: Setup Node.js
        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
        with:
          node-version-file: .nvmrc
          package-manager-cache: false
      - name: Install dependencies
        run: yarn install --immutable --mode=skip-build
      - name: Install packaging tools (Linux)
        if: runner.os == 'Linux'
        run: sudo apt-get update && sudo apt-get install -y rpm squashfs-tools
      - name: Load certificates (macOS)
        if: runner.os == 'macOS'
        env:
          MACOS_CERT_P12: ${{ secrets.MACOS_CERT_P12 }}
          MACOS_CERT_PASSWORD: ${{ secrets.MACOS_CERT_PASSWORD }}
        run: bash packages/app/build/add-macos-cert.sh
      - name: Build (macOS)
        if: runner.os == 'macOS'
        env:
          APPLE_SIGNING_IDENTITY: 'Developer ID Application: OpenJS Foundation, Inc. (UY52UFTVTM)'
          APPLE_ID: ${{ secrets.APPLE_ID }}
          APPLE_ID_PASSWORD: ${{ secrets.APPLE_ID_PASSWORD }}
        run: yarn workspace electron-fiddle run publish --arch=${{ matrix.arch }} --dry-run # zizmor: ignore[use-trusted-publishing]
      - name: Check the app is notarized (macOS)
        if: runner.os == 'macOS'
        run: |
          for app in packages/app/out/*/"Electron Fiddle.app"; do
            xcrun stapler validate "$app"
          done
      - name: Check the privacy helper is signed (macOS)
        if: runner.os == 'macOS'
        run: |
          for app in packages/app/out/*/"Electron Fiddle.app"; do
            packages/app/native/disclaim/check-packaged.sh "$app" --release
          done
      - name: Build (Linux)
        if: runner.os == 'Linux'
        run: yarn workspace electron-fiddle run publish --arch=${{ matrix.arch }} --dry-run # zizmor: ignore[use-trusted-publishing]
      - name: Check that the e2e driver is not packaged
        run: node tools/release-check-asar.mjs packages/app/out
      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        with:
          name: build-artifacts-${{ matrix.os }}-${{ matrix.arch }}
          path: packages/app/out
      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        if: ${{ matrix.os == 'ubuntu-latest' && matrix.arch == 'x64' }}
        with:
          name: vite-source-maps
          path: packages/app/.vite
          include-hidden-files: true

  build-windows:
    name: Build (windows-latest, ${{ matrix.arch }})
    strategy:
      fail-fast: false
      matrix:
        arch:
          - x64
    runs-on: windows-latest
    permissions:
      contents: read
      # For the Azure OIDC login. Only this job can request ID tokens.
      id-token: write
    environment: release
    steps:
      - run: git config --global core.autocrlf input
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - name: Setup Node.js
        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
        with:
          node-version-file: .nvmrc
          package-manager-cache: false
      - name: Install dependencies
        run: yarn install --immutable --mode=skip-build
      - name: Azure login
        uses: azure/login@a641126d1b8aa4d1fa005f4f92df94a3a4c4c906 # v3.1.0
        with:
          client-id: ${{ secrets.AZURE_CLIENT_ID }}
          tenant-id: ${{ secrets.AZURE_TENANT_ID }}
          subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
      - name: Install Azure Trusted Signing client
        shell: pwsh
        run: |
          $clientDir = Join-Path $env:RUNNER_TEMP 'trusted-signing'
          nuget install Microsoft.Trusted.Signing.Client -Version 1.0.95 -x -OutputDirectory $clientDir
          $dlib = Join-Path $clientDir 'Microsoft.Trusted.Signing.Client\bin\x64\Azure.CodeSigning.Dlib.dll'
          if (-not (Test-Path $dlib)) { throw "Azure.CodeSigning.Dlib.dll not found at $dlib" }

          # Trusted Signing needs signtool.exe from Windows SDK 10.0.22621.755 or
          # later; pick the newest SDK installed on the runner.
          $signtool = Get-ChildItem "${env:ProgramFiles(x86)}\Windows Kits\10\bin\10.*\x64\signtool.exe" |
            Sort-Object { [version]$_.Directory.Parent.Name } -Descending |
            Select-Object -First 1
          if (-not $signtool) { throw 'No Windows SDK signtool.exe found' }
          Write-Host "Using signtool: $($signtool.FullName)"

          "AZURE_CODE_SIGNING_DLIB=$dlib" >> $env:GITHUB_ENV
          "WINDOWS_SIGNTOOL_PATH=$($signtool.FullName)" >> $env:GITHUB_ENV
      - name: Build (Windows)
        env:
          # The DLIB and signtool paths come from the previous step. The values
          # below are not secrets; the endpoint must match the account's region.
          AZURE_CODE_SIGNING_ENDPOINT: https://eus.codesigning.azure.net
          AZURE_CODE_SIGNING_ACCOUNT_NAME: OpenJS-CodeSigning
          AZURE_CODE_SIGNING_CERTIFICATE_PROFILE_NAME: Electron
        run: yarn workspace electron-fiddle run publish --arch=${{ matrix.arch }} --dry-run # zizmor: ignore[use-trusted-publishing]
      - name: Check that the e2e driver is not packaged
        run: node tools/release-check-asar.mjs packages/app/out
      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        with:
          name: build-artifacts-windows-latest-${{ matrix.arch }}
          path: packages/app/out

  attest:
    name: Attest build provenance
    runs-on: ubuntu-latest
    needs:
      - build
      - build-windows
    permissions:
      id-token: write
      attestations: write
    steps:
      - name: Download all artifacts
        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
        with:
          path: out
          pattern: build-artifacts-*
          merge-multiple: true
      - uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4.2.2
        with:
          subject-path: |
            out/make/**/*.zip
            out/make/**/*.exe
            out/make/**/*.nupkg
            out/make/**/RELEASES
            out/make/**/*.msix
            out/make/**/*.deb
            out/make/**/*.rpm
            out/make/**/*.AppImage

  release:
    name: Release
    runs-on: ubuntu-latest
    needs:
      - test
      - build
      - build-windows
      - attest
    environment: release
    permissions:
      contents: read
      # For the releaser app's token, which creates the draft release.
      id-token: write
    steps:
      - run: git config --global core.autocrlf input
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - name: Setup Node.js
        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
        with:
          node-version-file: .nvmrc
          package-manager-cache: false
      - name: Install dependencies
        run: yarn install --immutable --mode=skip-build
      - name: Download all artifacts
        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
        with:
          path: packages/app/out
          pattern: build-artifacts-*
          merge-multiple: true
      - name: Get GitHub app token
        id: secret-service
        uses: electron/secret-service-action@23b9042f797e34674f0fe2c91608f57f9661ccf2 # v1.1.0
      - name: Publish to GitHub
        env:
          GITHUB_TOKEN: ${{ fromJSON(steps.secret-service.outputs.secrets).GITHUB_TOKEN }}
        run: yarn workspace electron-fiddle run publish --from-dry-run # zizmor: ignore[use-trusted-publishing]

  notify-sentry-deploy:
    name: Notify Sentry Deploy
    runs-on: ubuntu-latest
    needs: release
    permissions:
      contents: read
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          fetch-depth: 0
          persist-credentials: false
      - name: Download source maps artifact
        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
        with:
          name: vite-source-maps
          path: packages/app/.vite
      # No `v` prefix: the release name is the one the app reports to Sentry.
      - name: Read version
        id: version
        run: echo "version=$(node -p "require('./packages/app/package.json').version")" >> "$GITHUB_OUTPUT"
      # Frame URLs: the renderer is served from app://main/, so its maps match
      # `~/assets/...`; main and preload frames read app:///.vite/build/....
      - uses: getsentry/action-release@e6703d0b00208e0b3687ba660d18ab5af7892821 # v3.7.2
        env:
          SENTRY_AUTH_TOKEN: ${{ secrets.SENTRY_AUTH_TOKEN }}
          SENTRY_ORG: electronjs
          SENTRY_PROJECT: electron-fiddle
        with:
          release: Electron-Fiddle@${{ steps.version.outputs.version }}
          sourcemaps: ./packages/app/.vite/renderer/main_window
          url_prefix: '~/'
      - uses: getsentry/action-release@e6703d0b00208e0b3687ba660d18ab5af7892821 # v3.7.2
        env:
          SENTRY_AUTH_TOKEN: ${{ secrets.SENTRY_AUTH_TOKEN }}
          SENTRY_ORG: electronjs
          SENTRY_PROJECT: electron-fiddle
        with:
          environment: production
          release: Electron-Fiddle@${{ steps.version.outputs.version }}
          set_commits: skip
          sourcemaps: ./packages/app/.vite/build
          url_prefix: '~/.vite/build'