openidea/.github/workflows/release.yml

name: Release
on:
  push:
    tags: ["v*"]
  workflow_dispatch:
    inputs:
      tag:
        description: "Tag to release (e.g. v0.1.0); must already exist"
        required: true

permissions:
  contents: write

concurrency:
  group: release-${{ github.event.inputs.tag || github.ref_name }}

env:
  CARGO_TERM_COLOR: always
  CARGO_INCREMENTAL: 0
  TAG: ${{ github.event.inputs.tag || github.ref_name }}
  COMMUNITY_PLUGINS_INDEX: https://github.com/l0ng-ai/openidea-plugins/releases/download/index/index.json

jobs:
  # Creates (or reuses) one draft release that every platform build uploads into.
  create-release:
    runs-on: ubuntu-latest
    outputs:
      release_id: ${{ steps.release.outputs.id }}
      official_plugin_keys: ${{ steps.plugin-keys.outputs.keys }}
    steps:
      - uses: actions/checkout@v5
        with: { ref: "${{ env.TAG }}" }
      - name: Tag matches app version
        run: |
          app="v$(jq -r .version src-tauri/tauri.conf.json)"
          if [ "$app" != "$TAG" ]; then
            echo "::error::tag $TAG does not match tauri.conf.json version $app"
            exit 1
          fi
      # A shipped plugin API is frozen: its WIT must be the snapshot api_frozen.rs checks later
      # versions against (plugins/README.md, "Evolving the plugin API").
      - name: Plugin API snapshot matches wit/
        run: |
          api() { sed -n 's/^package openidea:plugin@\(.*\);$/\1/p' "$1/plugin.wit"; }
          snapshot=sdk/rust/openidea-plugin/tests/api/released
          if [ "$(api wit)" != "$(api "$snapshot")" ]; then
            echo "::error::plugin API $(api wit) ships without a snapshot ($snapshot is $(api "$snapshot")): copy wit/*.wit to $snapshot/"
            exit 1
          fi
      # The official plugins' public key (from PLUGIN_SIGNING_KEY, the seed
      # `openidea-plugin keygen` writes), built into the app: their packages
      # must carry its signature whatever the marketplace index lists. Without
      # the secret the app takes the index's word, as development builds do.
      - id: plugin-keys
        env:
          SIGNING_KEY: ${{ secrets.PLUGIN_SIGNING_KEY }}
        run: |
          if [ -n "$SIGNING_KEY" ]; then
            seed="$(printf %s "$SIGNING_KEY" | base64 -d | od -An -tx1 | tr -d ' \n')"
            key="$(printf '302e020100300506032b657004220420%s' "$seed" | xxd -r -p |
              openssl pkey -inform DER -pubout -outform DER | tail -c 32 | base64)"
            echo "keys=$key" >> "$GITHUB_OUTPUT"
          fi
      - id: release
        uses: actions/github-script@v8
        with:
          script: |
            const tag = process.env.TAG;
            const { owner, repo } = context.repo;
            const releases = await github.paginate(github.rest.repos.listReleases, { owner, repo });
            const existing = releases.find((r) => r.tag_name === tag);
            if (existing) {
              if (!existing.draft) core.setFailed(`release ${tag} is already published`);
              core.setOutput("id", existing.id);
              return;
            }
            const { data } = await github.rest.repos.createRelease({
              owner, repo, tag_name: tag, name: `OpenIDEA ${tag}`,
              draft: true, prerelease: tag.includes("-"), generate_release_notes: true,
            });
            core.setOutput("id", data.id);

  build:
    needs: create-release
    name: Build (${{ matrix.name }})
    env:
      OPENIDEA_OFFICIAL_PLUGIN_KEYS: ${{ needs.create-release.outputs.official_plugin_keys }}
    strategy:
      fail-fast: false
      matrix:
        include:
          - name: macOS arm64
            os: macos-latest
            target: aarch64-apple-darwin
          - name: macOS x64
            os: macos-latest
            target: x86_64-apple-darwin
          - name: Linux x64
            os: ubuntu-22.04
            target: x86_64-unknown-linux-gnu
          - name: Linux arm64
            os: ubuntu-22.04-arm
            target: aarch64-unknown-linux-gnu
          - name: Windows arm64
            os: windows-11-arm
            target: aarch64-pc-windows-msvc
          - name: Windows x64
            os: windows-latest
            target: x86_64-pc-windows-msvc
    runs-on: ${{ matrix.os }}
    steps:
      - uses: actions/checkout@v5
        with: { ref: "${{ env.TAG }}" }
      - uses: pnpm/action-setup@v5
        with: { version: 11 }
      - uses: actions/setup-node@v5
        with: { node-version: 22, cache: pnpm }
      - uses: dtolnay/rust-toolchain@stable
        with: { targets: "${{ matrix.target }}" }
      - uses: Swatinem/rust-cache@v2
        with: { key: "${{ matrix.target }}" }
      - name: Linux deps
        if: runner.os == 'Linux'
        run: |
          sudo apt-get update
          sudo apt-get install -y libwebkit2gtk-4.1-dev libayatana-appindicator3-dev librsvg2-dev libxdo-dev libssl-dev patchelf
      - run: pnpm install --frozen-lockfile
      # Signing is optional: only secrets that are set get exported, so forks and
      # unconfigured repos produce unsigned builds instead of failing.
      - name: Signing env
        shell: bash
        env:
          APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }}
          APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
          APPLE_SIGNING_IDENTITY: ${{ secrets.APPLE_SIGNING_IDENTITY }}
          APPLE_ID: ${{ secrets.APPLE_ID }}
          APPLE_PASSWORD: ${{ secrets.APPLE_PASSWORD }}
          APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
          TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
          TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
        run: |
          for v in APPLE_CERTIFICATE APPLE_CERTIFICATE_PASSWORD APPLE_SIGNING_IDENTITY APPLE_ID \
                   APPLE_PASSWORD APPLE_TEAM_ID TAURI_SIGNING_PRIVATE_KEY TAURI_SIGNING_PRIVATE_KEY_PASSWORD; do
            [ -n "${!v}" ] && { echo "$v<<__EOF__"; echo "${!v}"; echo "__EOF__"; } >> "$GITHUB_ENV"
          done
          true
      - uses: tauri-apps/tauri-action@v0
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        with:
          releaseId: ${{ needs.create-release.outputs.release_id }}
          tagName: ${{ env.TAG }}
          args: --target ${{ matrix.target }}
          # The parallel builds would race on one latest.json; `updater-manifest` writes it once.
          uploadUpdaterJson: false
      # tauri-action notarizes the .app but not the DMG around it; notarize and
      # staple the DMG too, then replace the uploaded asset.
      - name: Notarize DMG
        if: runner.os == 'macOS' && env.APPLE_ID != ''
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          for dmg in target/${{ matrix.target }}/release/bundle/dmg/*.dmg; do
            xcrun notarytool submit "$dmg" --apple-id "$APPLE_ID" --password "$APPLE_PASSWORD" \
              --team-id "$APPLE_TEAM_ID" --wait
            xcrun stapler staple "$dmg"
            gh release upload "$TAG" "$dmg" --clobber
          done

  # The remote development server, per host platform it can run on. The desktop
  # app downloads the one for the host (ide-tools `server`) and installs it over SSH.
  # Linux builds are static (musl), so they run whatever the host's glibc.
  server:
    needs: create-release
    name: Server (${{ matrix.os }}-${{ matrix.arch }})
    strategy:
      fail-fast: false
      matrix:
        include:
          - { runner: ubuntu-22.04, target: x86_64-unknown-linux-musl, os: linux, arch: x86_64 }
          - { runner: ubuntu-24.04-arm, target: aarch64-unknown-linux-musl, os: linux, arch: aarch64 }
          - { runner: macos-latest, target: aarch64-apple-darwin, os: macos, arch: aarch64 }
          - { runner: macos-latest, target: x86_64-apple-darwin, os: macos, arch: x86_64 }
    runs-on: ${{ matrix.runner }}
    steps:
      - uses: actions/checkout@v5
        with: { ref: "${{ env.TAG }}" }
      - uses: dtolnay/rust-toolchain@stable
        with: { targets: "${{ matrix.target }}" }
      - uses: Swatinem/rust-cache@v2
        with: { key: "server-${{ matrix.target }}" }
      - name: musl toolchain
        if: runner.os == 'Linux'
        run: sudo apt-get update && sudo apt-get install -y musl-tools
      - name: Build
        run: |
          # musl-tools only ships `musl-gcc`; cc-rs would look for `<arch>-linux-musl-gcc`.
          if [ "$RUNNER_OS" = Linux ]; then export CC_${TARGET//-/_}=musl-gcc; fi
          cargo build --release --locked -p ide-host --bin openidea-server --target "$TARGET"
        env:
          TARGET: ${{ matrix.target }}
      - name: Upload
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          ASSET: openidea-server-${{ matrix.os }}-${{ matrix.arch }}.gz
        run: |
          gzip -9 -c target/${{ matrix.target }}/release/openidea-server > "$ASSET"
          if command -v sha256sum >/dev/null; then sha256sum "$ASSET"; else shasum -a 256 "$ASSET"; fi > "$ASSET.sha256"
          gh release upload "$TAG" "$ASSET" "$ASSET.sha256" --clobber

  # The official plugins, signed, and the marketplace index released apps read
  # (releases/latest/download/plugins-index.json). They are not in the
  # installers: users install them from Settings › Plugins. Without the
  # signing key (secret PLUGIN_SIGNING_KEY: the file `openidea-plugin keygen`
  # writes) nothing is published and the release goes on. The index also lists
  # the community plugins of the registry (COMMUNITY_PLUGINS_INDEX; refreshed
  # between releases by plugins-index.yml), and the release carries the
  # openidea-plugin tool for Linux x64, which that workflow and the registry's
  # checks run.
  plugins:
    needs: create-release
    name: Official plugins
    runs-on: ubuntu-22.04
    env:
      SIGNING_KEY: ${{ secrets.PLUGIN_SIGNING_KEY }}
    steps:
      - id: key
        run: |
          if [ -z "$SIGNING_KEY" ]; then
            echo "::warning::PLUGIN_SIGNING_KEY is not set: the official plugins are not published"
            echo "skip=true" >> "$GITHUB_OUTPUT"
          fi
      - uses: actions/checkout@v5
        if: steps.key.outputs.skip != 'true'
        with: { ref: "${{ env.TAG }}" }
      - uses: dtolnay/rust-toolchain@stable
        if: steps.key.outputs.skip != 'true'
        with: { targets: wasm32-wasip2 }
      - uses: Swatinem/rust-cache@v2
        if: steps.key.outputs.skip != 'true'
        with: { key: release-plugins }
      - uses: pnpm/action-setup@v5
        if: steps.key.outputs.skip != 'true'
        with: { version: 11 }
      - uses: actions/setup-node@v5
        if: steps.key.outputs.skip != 'true'
        with: { node-version: 22 }
      # Builds the web pages; fails when a checked-in component isn't built from these sources.
      - name: Build
        if: steps.key.outputs.skip != 'true'
        run: |
          plugins/build.sh --check
          cargo build --release --locked -p ide-host --bin openidea-plugin
      - name: Pack, index and upload
        if: steps.key.outputs.skip != 'true'
        shell: bash
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          set -euo pipefail
          tool="$PWD/target/release/openidea-plugin"
          key="$RUNNER_TEMP/openidea.key"
          out="$RUNNER_TEMP/market"
          (umask 077 && printf '%s' "$SIGNING_KEY" > "$key")
          trap 'rm -f "$key"' EXIT
          mkdir -p "$out"
          for dir in plugins/official/*/; do
            id="$(sed -n 's/^id *= *"\(.*\)".*/\1/p' "$dir/plugin.toml" | head -1)"
            version="$(sed -n 's/^version *= *"\(.*\)".*/\1/p' "$dir/plugin.toml" | head -1)"
            "$tool" pack "$dir" --key "$key" --publisher openidea --out "$out/$id-$version.oiplugin"
          done
          # The published index's revocations, earlier keys and community plugins carry over.
          curl -fsSL "https://github.com/$GITHUB_REPOSITORY/releases/latest/download/plugins-index.json" \
            -o "$out/plugins-index.json" || rm -f "$out/plugins-index.json"
          # Downloads point at this release: older versions kept for older IDEs stay where they were published.
          "$tool" index "$out" --publisher openidea --name OpenIDEA --key "$key" --out "$out/plugins-index.json" \
            --download-base "https://github.com/$GITHUB_REPOSITORY/releases/download/$TAG"
          "$tool" merge "$out/plugins-index.json" "$COMMUNITY_PLUGINS_INDEX" --keep openidea ||
            echo "::warning::the community plugins were not refreshed"
          gzip -9 -c "$tool" > "$out/openidea-plugin-linux-x86_64.gz"
          gh release upload "$TAG" "$out"/*.oiplugin "$out/plugins-index.json" \
            "$out/openidea-plugin-linux-x86_64.gz" --clobber

  # The updater manifest (latest.json), built once from the signed bundles every build uploaded.
  # Fails when a platform is missing, so a release never ships a manifest without it.
  updater-manifest:
    needs: [create-release, build]
    runs-on: ubuntu-latest
    steps:
      - uses: actions/github-script@v8
        env:
          RELEASE_ID: ${{ needs.create-release.outputs.release_id }}
        with:
          script: |
            const { owner, repo } = context.repo;
            const release_id = Number(process.env.RELEASE_ID);
            const tag = process.env.TAG;
            const assets = await github.paginate(github.rest.repos.listReleaseAssets, { owner, repo, release_id });
            const sigs = assets.filter((a) => a.name.endsWith(".sig"));
            if (sigs.length === 0) {
              core.notice("no signed bundles (TAURI_SIGNING_PRIVATE_KEY unset): skipping latest.json");
              return;
            }
            // Bundle suffix → updater platform keys, as tauri-action names them.
            const kinds = [
              [/_aarch64\.AppImage$/, ["linux-aarch64", "linux-aarch64-appimage"]],
              [/_arm64\.deb$/, ["linux-aarch64-deb"]],
              [/\.aarch64\.rpm$/, ["linux-aarch64-rpm"]],
              [/_amd64\.AppImage$/, ["linux-x86_64", "linux-x86_64-appimage"]],
              [/_amd64\.deb$/, ["linux-x86_64-deb"]],
              [/\.x86_64\.rpm$/, ["linux-x86_64-rpm"]],
              [/_aarch64\.app\.tar\.gz$/, ["darwin-aarch64", "darwin-aarch64-app"]],
              [/_x64\.app\.tar\.gz$/, ["darwin-x86_64", "darwin-x86_64-app"]],
              [/_arm64_en-US\.msi$/, ["windows-aarch64", "windows-aarch64-msi"]],
              [/_arm64-setup\.exe$/, ["windows-aarch64-nsis"]],
              [/_x64_en-US\.msi$/, ["windows-x86_64", "windows-x86_64-msi"]],
              [/_x64-setup\.exe$/, ["windows-x86_64-nsis"]],
            ];
            const platforms = {};
            for (const sig of sigs) {
              const bundle = sig.name.slice(0, -".sig".length);
              const kind = kinds.find(([re]) => re.test(bundle));
              if (!kind) continue;
              const { data } = await github.rest.repos.getReleaseAsset({
                owner, repo, asset_id: sig.id, headers: { accept: "application/octet-stream" },
              });
              const signature = Buffer.from(data).toString("utf8").trim();
              const url = `https://github.com/${owner}/${repo}/releases/download/${tag}/${encodeURIComponent(bundle)}`;
              for (const key of kind[1]) platforms[key] = { signature, url };
            }
            const missing = kinds.flatMap(([, keys]) => keys).filter((k) => !platforms[k]);
            if (missing.length) {
              core.setFailed(`latest.json would miss ${missing.join(", ")}`);
              return;
            }
            const manifest = { version: tag.replace(/^v/, ""), notes: "", pub_date: new Date().toISOString(), platforms };
            const old = assets.find((a) => a.name === "latest.json");
            if (old) await github.rest.repos.deleteReleaseAsset({ owner, repo, asset_id: old.id });
            await github.rest.repos.uploadReleaseAsset({
              owner, repo, release_id, name: "latest.json",
              data: JSON.stringify(manifest, null, 2),
              headers: { "content-type": "application/json" },
            });
            core.info(`latest.json: ${Object.keys(platforms).sort().join(", ")}`);

  publish:
    needs: [create-release, build, server, plugins, updater-manifest]
    runs-on: ubuntu-latest
    steps:
      - uses: actions/github-script@v8
        env:
          RELEASE_ID: ${{ needs.create-release.outputs.release_id }}
        with:
          script: |
            await github.rest.repos.updateRelease({
              ...context.repo, release_id: Number(process.env.RELEASE_ID), draft: false,
            });

  # The China mirror the updater's CNB source reads; a failure here leaves the GitHub release as is.
  cnb-mirror:
    needs: publish
    uses: ./.github/workflows/cnb-mirror.yml
    with: { tag: "${{ github.event.inputs.tag || github.ref_name }}" }
    secrets: inherit