psysonic/.github/workflows/release.yml

name: Release
on:
  push:
    tags:
      - 'v*'
  workflow_dispatch:

jobs:
  create-release:
    permissions:
      contents: write
    runs-on: ubuntu-latest
    outputs:
      release_id: ${{ steps.create-release.outputs.result }}
      package_version: ${{ steps.get-version.outputs.version }}
    steps:
      - uses: actions/checkout@v5
      - name: setup node
        uses: actions/setup-node@v5
        with:
          node-version: lts/*
          cache: 'npm'
      - name: get version
        id: get-version
        run: echo "version=$(node -p "require('./package.json').version")" >> $GITHUB_OUTPUT
      - name: extract changelog
        id: changelog
        run: |
          VERSION="${{ steps.get-version.outputs.version }}"
          # Extract the block between ## [VERSION] and the next ## heading
          BODY=$(awk "/^## \[$VERSION\]/{found=1; next} found && /^## \[/{exit} found{print}" CHANGELOG.md)
          # Store multiline output
          EOF=$(dd if=/dev/urandom bs=15 count=1 status=none | base64)
          echo "body<<$EOF" >> $GITHUB_OUTPUT
          echo "$BODY" >> $GITHUB_OUTPUT
          echo "$EOF" >> $GITHUB_OUTPUT
      - name: create release
        id: create-release
        uses: actions/github-script@v7
        env:
          PACKAGE_VERSION: ${{ steps.get-version.outputs.version }}
          CHANGELOG_BODY: ${{ steps.changelog.outputs.body }}
        with:
          script: |
            const tag = `app-v${process.env.PACKAGE_VERSION}`;
            const body = process.env.CHANGELOG_BODY || 'See the assets to download this version and install.';
            try {
              const { data } = await github.rest.repos.getReleaseByTag({
                owner: context.repo.owner,
                repo: context.repo.repo,
                tag,
              });
              await github.rest.repos.updateRelease({
                owner: context.repo.owner,
                repo: context.repo.repo,
                release_id: data.id,
                body,
              });
              return data.id;
            } catch (e) {
              if (e.status !== 404) throw e;
            }
            const { data } = await github.rest.repos.createRelease({
              owner: context.repo.owner,
              repo: context.repo.repo,
              tag_name: tag,
              name: `Psysonic v${process.env.PACKAGE_VERSION}`,
              body,
              draft: true,
              prerelease: false
            });
            return data.id;

  build-macos-windows:
    needs: create-release
    permissions:
      contents: write
    strategy:
      fail-fast: false
      matrix:
        settings:
          - platform: 'macos-latest'
            args: '--target aarch64-apple-darwin'
          - platform: 'macos-latest'
            args: '--target x86_64-apple-darwin'
          - platform: 'windows-latest'
            args: '--bundles nsis'
    runs-on: ${{ matrix.settings.platform }}
    steps:
      - uses: actions/checkout@v5
      - name: setup node
        uses: actions/setup-node@v5
        with:
          node-version: lts/*
          cache: 'npm'
      - name: install Rust stable
        uses: dtolnay/rust-toolchain@stable
        with:
          targets: ${{ matrix.settings.platform == 'macos-latest' && 'aarch64-apple-darwin,x86_64-apple-darwin' || '' }}
      - name: cache cargo
        uses: Swatinem/rust-cache@v2
        with:
          workspaces: src-tauri
      - name: install npm dependencies
        run: npm install
      - uses: tauri-apps/tauri-action@v0
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          VITE_LASTFM_API_KEY: ${{ secrets.VITE_LASTFM_API_KEY }}
          VITE_LASTFM_API_SECRET: ${{ secrets.VITE_LASTFM_API_SECRET }}
        with:
          releaseId: ${{ needs.create-release.outputs.release_id }}
          args: ${{ matrix.settings.args }}

  build-linux:
    needs: create-release
    permissions:
      contents: write
    runs-on: ubuntu-24.04
    steps:
      - uses: actions/checkout@v5

      - name: install dependencies
        run: |
          sudo apt-get update
          sudo apt-get install -y \
            libwebkit2gtk-4.1-dev libappindicator3-dev librsvg2-dev patchelf \
            libasound2-dev squashfs-tools cmake

      - name: setup node
        uses: actions/setup-node@v5
        with:
          node-version: lts/*
          cache: 'npm'

      - name: install Rust stable
        uses: dtolnay/rust-toolchain@stable

      - name: cache cargo
        uses: Swatinem/rust-cache@v2
        with:
          workspaces: src-tauri

      - name: install npm dependencies
        run: npm install

      - name: build
        env:
          VITE_LASTFM_API_KEY: ${{ secrets.VITE_LASTFM_API_KEY }}
          VITE_LASTFM_API_SECRET: ${{ secrets.VITE_LASTFM_API_SECRET }}
          APPIMAGE_EXTRACT_AND_RUN: 1
        run: npm run tauri:build -- --bundles deb,rpm,appimage

      - name: upload Linux artifacts
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          VERSION=${{ needs.create-release.outputs.package_version }}
          find src-tauri/target/release/bundle \
            \( -name "*.deb" -o -name "*.rpm" -o -name "*.AppImage" \) \
            | xargs gh release upload "app-v${VERSION}" --clobber

  # Verifies that `nix build .#psysonic` still works against the current source
  # and refreshes `nix/upstream-sources.json` (npmDepsHash) + `flake.lock`
  # (nixpkgs pin). Commits the refreshed files back to `main` when they change.
  #
  # Tarball publishing / Cachix upload are intentionally out of scope here —
  # those will live in a dedicated workflow tied to a binary cache setup.
  verify-nix:
    needs: create-release
    runs-on: ubuntu-24.04
    permissions:
      contents: write
    steps:
      - uses: actions/checkout@v5
        with:
          # Full history so we can push the auto-commit back to the default branch.
          fetch-depth: 0
          # Checkout main, not the tag — we want to push lock/hash refreshes to
          # the moving branch, not the immutable tag ref.
          ref: main

      - name: install Nix
        uses: DeterminateSystems/nix-installer-action@v15

      - name: compute npmDepsHash from package-lock.json
        id: npm-hash
        run: |
          set -euo pipefail
          HASH="$(nix run nixpkgs/nixos-unstable#prefetch-npm-deps -- package-lock.json)"
          echo "hash=$HASH" >> "$GITHUB_OUTPUT"
          echo "Computed npmDepsHash: $HASH"

      - name: write npmDepsHash into nix/upstream-sources.json
        run: |
          set -euo pipefail
          HASH='${{ steps.npm-hash.outputs.hash }}'
          jq --arg h "$HASH" '.npmDepsHash = $h' nix/upstream-sources.json > nix/upstream-sources.json.new
          mv nix/upstream-sources.json.new nix/upstream-sources.json
          cat nix/upstream-sources.json

      - name: refresh flake.lock (nixpkgs pin)
        run: nix flake update --accept-flake-config

      - name: verify nix build
        run: nix build .#psysonic --accept-flake-config --no-link --print-build-logs

      - name: commit + push refreshed lock and hash (if changed)
        run: |
          set -euo pipefail
          git config user.name "github-actions[bot]"
          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
          git add flake.lock nix/upstream-sources.json
          if git diff --cached --quiet; then
            echo "flake.lock / nix/upstream-sources.json unchanged — nothing to commit."
            exit 0
          fi
          VERSION="${{ needs.create-release.outputs.package_version }}"
          git commit -m "chore(nix): refresh lock + npmDepsHash for v${VERSION}"
          git push origin HEAD:main