release.yml

name: Release

on:
  push:
    tags:
      - "v*"
  workflow_dispatch:

permissions:
  contents: write

jobs:
  build-macos:
    name: macOS (${{ matrix.arch }})
    runs-on: macos-14
    strategy:
      fail-fast: false
      matrix:
        include:
          - target: aarch64-apple-darwin
            arch: aarch64
          - target: x86_64-apple-darwin
            arch: x64
    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-node@v4
        with:
          node-version: 22
          cache: npm

      - uses: dtolnay/rust-toolchain@stable
        with:
          targets: ${{ matrix.target }}

      - uses: Swatinem/rust-cache@v2
        with:
          workspaces: src-tauri

      - name: Install frontend dependencies
        run: npm ci

      - name: Build Tauri app
        run: npm run tauri build -- --target ${{ matrix.target }} --bundles app

      - name: Package macOS zip + checksums
        env:
          VERSION: ${{ github.ref_name }}
          ARCH: ${{ matrix.arch }}
        run: |
          set -euo pipefail
          VERSION="${VERSION#v}"
          APP_PATH="$(find src-tauri/target -path "*/release/bundle/macos/AgentDeck.app" -print -quit)"
          OUT_DIR="$RUNNER_TEMP/agentdeck-macos-${ARCH}"
          mkdir -p "$OUT_DIR"

          if [ -z "$APP_PATH" ]; then
            echo "AgentDeck.app not found"
            exit 1
          fi

          (
            cd "$(dirname "$APP_PATH")"
            zip -r "$OUT_DIR/AgentDeck-${VERSION}-macos-${ARCH}.zip" AgentDeck.app
          )

          (
            cd "$OUT_DIR"
            shasum -a 256 AgentDeck-* > "checksums-macos-${ARCH}.sha256"
            cat "checksums-macos-${ARCH}.sha256"
          )

      - uses: actions/upload-artifact@v4
        with:
          name: build-macos-${{ matrix.arch }}
          path: ${{ runner.temp }}/agentdeck-macos-${{ matrix.arch }}/*
          retention-days: 7

  release:
    name: Publish GitHub Release
    if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags/v')
    needs: [build-macos]
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Download build artifacts
        uses: actions/download-artifact@v4
        with:
          path: artifacts
          merge-multiple: true

      - name: List artifacts
        run: find artifacts -type f | sort

      - name: Write release notes
        env:
          TAG: ${{ github.ref_name }}
        run: |
          VERSION="${TAG#v}"
          cat > release-notes.md <<EOF
          ## AgentDeck v${VERSION}

          ### Install (macOS)

          Download **\`AgentDeck-${VERSION}-macos-aarch64.zip\`** (Apple Silicon) or **\`AgentDeck-${VERSION}-macos-x64.zip\`** (Intel). Unzip and drag **AgentDeck.app** to Applications.

          The app is ad-hoc signed, so macOS Gatekeeper may block the first launch: **right-click → Open → Open**, or run:

          \`\`\`bash
          xattr -d com.apple.quarantine /Applications/AgentDeck.app
          \`\`\`

          **Requirements:** macOS 14+ · Apple Silicon or Intel build below

          Prefer building locally? See [README — Quick Start](https://github.com/lepfinder/AgentDeck#quick-start).

          ### SHA-256

          Per-arch checksum files are bundled in Assets as \`checksums-macos-*.sha256\`. A combined list is in \`SHA256SUMS.txt\`.
          EOF

      - name: Combine checksums
        run: |
          echo "## SHA-256 Checksums" > artifacts/SHA256SUMS.txt
          echo "" >> artifacts/SHA256SUMS.txt
          for cs in artifacts/checksums-*.sha256; do
            [ -f "$cs" ] || continue
            cat "$cs" >> artifacts/SHA256SUMS.txt
            echo "" >> artifacts/SHA256SUMS.txt
          done
          cat artifacts/SHA256SUMS.txt

      - name: Create GitHub Release
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          TAG: ${{ github.ref_name }}
        run: |
          VERSION="${TAG#v}"
          FILES=()
          while IFS= read -r f; do
            FILES+=("$f")
          done < <(find artifacts -type f \
            \( -name "*.zip" \
               -o -name "checksums-*.sha256" -o -name "SHA256SUMS.txt" \) | sort)

          gh release create "${TAG}" \
            --title "v${VERSION}" \
            --notes-file release-notes.md \
            --latest \
            "${FILES[@]}"