desktop-release.yml

name: Desktop release
run-name: Ace ${{ inputs.channel }} at ${{ inputs.revision || github.sha }}${{ inputs.publish && ' (publish)' || '' }}

on:
  workflow_dispatch:
    inputs:
      channel:
        description: Release channel
        type: choice
        options: [canary, stable]
        default: canary
      publish:
        description: Publish the verified release to GitHub and the public download bucket
        type: boolean
        default: false
      revision:
        description: Exact source commit (defaults to the selected ref)
        type: string

permissions:
  contents: read

concurrency:
  group: desktop-release-${{ inputs.channel }}
  cancel-in-progress: false

jobs:
  release:
    permissions:
      contents: write
    runs-on: macos-15
    timeout-minutes: 60
    environment: desktop-${{ inputs.channel }}
    env:
      DEVELOPER_DIR: /Applications/Xcode_26.2.app/Contents/Developer
      ACE_CODESIGN_IDENTITY: ${{ vars.ACE_CODESIGN_IDENTITY }}
      ACE_UPDATE_URL: ${{ vars.ACE_UPDATE_URL }}
      ACE_UPDATE_PUBLIC_KEY: ${{ vars.ACE_UPDATE_PUBLIC_KEY }}
      ACE_NOTARY_KEY_ID: ${{ vars.ACE_NOTARY_KEY_ID }}
      ACE_NOTARY_ISSUER: ${{ vars.ACE_NOTARY_ISSUER }}
      ACE_RELEASE_CHANNEL: ${{ inputs.channel }}
      ACE_RELEASE_REVISION: ${{ inputs.revision || github.sha }}
      # Sparkle orders canary builds by this run number; it increases across every dispatch.
      ACE_BUILD_NUMBER: ${{ github.run_number }}
    steps:
      - name: Validate source revision
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          if [[ ! "$ACE_RELEASE_REVISION" =~ ^[a-f0-9]{40}$ ]]; then
            echo "::error::The release revision must be a full commit SHA."
            exit 1
          fi
          # The environment admits only runs from main, but the revision input could name any commit.
          if [[ "$ACE_RELEASE_CHANNEL" == stable ]]; then
            status=$(gh api "repos/$GITHUB_REPOSITORY/compare/$ACE_RELEASE_REVISION...main" --jq .status)
            if [[ "$status" != identical && "$status" != ahead ]]; then
              echo "::error::Stable releases build only commits on main, which does not contain $ACE_RELEASE_REVISION ($status)."
              exit 1
            fi
          fi
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          ref: ${{ env.ACE_RELEASE_REVISION }}
      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
        with:
          bun-version: 1.4.0
      - run: bun install --frozen-lockfile
      - run: bun types && bun run ci
      - name: Import release credentials
        run: bun apps/desktop/scripts/credentials.ts
        env:
          ACE_CERTIFICATE_P12: ${{ secrets.ACE_CERTIFICATE_P12 }}
          ACE_CERTIFICATE_PASSWORD: ${{ secrets.ACE_CERTIFICATE_PASSWORD }}
          ACE_NOTARY_PRIVATE_KEY: ${{ secrets.ACE_NOTARY_PRIVATE_KEY }}
      - name: Build, sign, notarize, and verify
        run: bun desktop release "$ACE_RELEASE_CHANNEL"
        env:
          ACE_SPARKLE_PRIVATE_KEY: ${{ secrets.ACE_SPARKLE_PRIVATE_KEY }}
      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: ace-${{ inputs.channel }}-macos-arm64
          path: apps/desktop/artifacts/sparkle/
          if-no-files-found: error
      - name: Publish downloads and GitHub release, then the feed
        if: inputs.publish
        run: bun desktop publish
        env:
          GH_TOKEN: ${{ github.token }}
          ACE_SPARKLE_PRIVATE_KEY: ${{ secrets.ACE_SPARKLE_PRIVATE_KEY }}
          ACE_UPDATE_BUCKET: ${{ vars.ACE_UPDATE_BUCKET }}
          CLOUDFLARE_ACCOUNT_ID: ${{ vars.CLOUDFLARE_ACCOUNT_ID }}
          R2_ACCESS_KEY_ID: ${{ secrets.R2_ACCESS_KEY_ID }}
          R2_SECRET_ACCESS_KEY: ${{ secrets.R2_SECRET_ACCESS_KEY }}
      - name: Remove signing credentials
        if: always()
        run: bun apps/desktop/scripts/credentials.ts clean