AgentCompany/.github/workflows/release-build.yml

name: Build Release Installers

# A pushed v* tag builds Windows, Linux and macOS installers on the Gitea
# runners and attaches them to the tag's release. The tag must equal
# "v" + package.json version. macOS builds are signed and notarized when the
# APPLE_API_* secrets are set (the Developer ID identity must then be reachable,
# or the job fails); without those secrets they are ad-hoc signed.

on:
  push:
    tags: ["v*"]

permissions:
  contents: write

env:
  COREPACK_ENABLE_DOWNLOAD_PROMPT: "0"
  GITEA_TOKEN: ${{ secrets.GITHUB_TOKEN }}

jobs:
  release:
    name: Release for the tag
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v5
      - uses: actions/setup-node@v5
        with:
          node-version: 24
          package-manager-cache: false
      - name: Check version and create the release
        run: node scripts/gitea-release.mjs create

  windows:
    name: Windows installer (NSIS x64)
    needs: release
    runs-on: windows-latest
    steps:
      - uses: actions/checkout@v5
      - uses: actions/setup-node@v5
        with:
          node-version: 24
          package-manager-cache: false
      - name: Enable pnpm via corepack
        run: corepack enable pnpm
      - name: Install dependencies
        run: pnpm install --frozen-lockfile
      - name: Build installer
        run: pnpm run package:win
      - name: Upload installer
        run: node scripts/gitea-release.mjs upload release

  linux:
    name: Linux packages (AppImage + deb x64)
    needs: release
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v5
      - uses: actions/setup-node@v5
        with:
          node-version: 24
          package-manager-cache: false
      - name: Enable pnpm via corepack
        run: corepack enable pnpm
      - name: Install dependencies
        run: pnpm install --frozen-lockfile
      - name: Build packages
        run: pnpm run package:linux
      - name: Upload packages
        run: node scripts/gitea-release.mjs upload release

  macos:
    name: macOS installers (dmg + zip, x64 + arm64)
    needs: release
    # Runs in the login session, where the Developer ID identity lives.
    runs-on: macos-signing
    steps:
      - uses: actions/checkout@v5
      - uses: actions/setup-node@v5
        with:
          node-version: 24
          package-manager-cache: false
      - name: Enable pnpm via corepack
        run: corepack enable pnpm
      - name: Install dependencies
        run: pnpm install --frozen-lockfile
      - name: Detect signing capability
        id: signing
        env:
          CSC_LINK: ${{ secrets.CSC_LINK }}
          APPLE_API_ISSUER: ${{ secrets.APPLE_API_ISSUER }}
          APPLE_API_KEY_ID: ${{ secrets.APPLE_API_KEY_ID }}
          APPLE_API_KEY_P8: ${{ secrets.APPLE_API_KEY_P8 }}
        run: |
          if [ -z "$APPLE_API_ISSUER" ] || [ -z "$APPLE_API_KEY_ID" ] || [ -z "$APPLE_API_KEY_P8" ]; then
            echo "signed=false" >> "$GITHUB_OUTPUT"
            echo "::warning::No notarization secrets: building ad-hoc-signed, un-notarized macOS installers."
          elif [ -n "$CSC_LINK" ] || security find-identity -v -p codesigning | grep -q "Developer ID Application: Yang Zhang (9PDD8M2SMS)"; then
            echo "signed=true" >> "$GITHUB_OUTPUT"
            echo "Developer ID certificate and notarization credentials found: building signed + notarized installers."
          else
            security find-identity -v -p codesigning
            echo "::error::Notarization secrets are set but this runner cannot reach the Developer ID identity; run the runner in the login session or set CSC_LINK."
            exit 1
          fi
      - name: Build installers (signed + notarized)
        if: steps.signing.outputs.signed == 'true'
        env:
          CSC_LINK: ${{ secrets.CSC_LINK }}
          CSC_KEY_PASSWORD: ${{ secrets.CSC_KEY_PASSWORD }}
          APPLE_API_KEY: ${{ runner.temp }}/apple-api-key.p8
          APPLE_API_KEY_ID: ${{ secrets.APPLE_API_KEY_ID }}
          APPLE_API_ISSUER: ${{ secrets.APPLE_API_ISSUER }}
          APPLE_API_KEY_P8: ${{ secrets.APPLE_API_KEY_P8 }}
        run: |
          # An empty CSC_LINK reads as a certificate path; the keychain signs instead.
          [ -n "$CSC_LINK" ] || unset CSC_LINK CSC_KEY_PASSWORD
          printf '%s' "$APPLE_API_KEY_P8" > "$APPLE_API_KEY"
          trap 'rm -f "$APPLE_API_KEY"' EXIT
          pnpm build
          pnpm exec electron-builder --mac --x64 --arm64 --publish never -c.forceCodeSigning=true
      - name: Build installers (ad-hoc fallback)
        if: steps.signing.outputs.signed != 'true'
        run: |
          pnpm build
          pnpm exec electron-builder --mac --x64 --arm64 --publish never --config electron-builder.unsigned.yml
      - name: Upload installers
        run: node scripts/gitea-release.mjs upload release