ci.yml

name: Build and Test

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]
  release:
    types: [published]

permissions:
  contents: read

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  build:
    name: Build (${{ matrix.os-name }})
    runs-on: ${{ matrix.os }}
    strategy:
      fail-fast: false
      matrix:
        include:
          - os: ubuntu-latest
            os-name: Linux
            dotnet-rid: linux-x64
            sidecar-triple: x86_64-unknown-linux-gnu
            sidecar-ext: ""
          - os: macos-latest
            os-name: macOS
            dotnet-rid: osx-arm64
            sidecar-triple: aarch64-apple-darwin
            sidecar-ext: ""
          - os: windows-latest
            os-name: Windows
            dotnet-rid: win-x64
            sidecar-triple: x86_64-pc-windows-msvc
            sidecar-ext: ".exe"

    steps:
      # ── Checkout ──────────────────────────────────────────────
      - name: Checkout code
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7

      # ── Toolchains ───────────────────────────────────────────
      - name: Install Rust (stable)
        uses: dtolnay/rust-toolchain@4be7066ada62dd38de10e7b70166bc74ed198c30 # stable
        with:
          components: clippy, rustfmt

      - name: Install .NET 10
        uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5
        with:
          dotnet-version: 10.0.x

      - name: Install Node.js 24
        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
        with:
          node-version: 24
          cache: npm

      # ── Linux system dependencies ────────────────────────────
      - name: Install Tauri system dependencies (Linux)
        if: runner.os == 'Linux'
        run: |
          sudo apt-get update
          sudo apt-get install -y libwebkit2gtk-4.1-dev libappindicator3-dev librsvg2-dev patchelf

      # ── Caching ──────────────────────────────────────────────
      - name: Cache Cargo registry and target
        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6
        with:
          path: |
            ~/.cargo/bin/cargo-audit
            ~/.cargo/bin/cargo-audit.exe
            ~/.cargo/advisory-db
            ~/.cargo/registry
            ~/.cargo/git
            src-tauri/target
          key: cargo-${{ runner.os }}-${{ hashFiles('**/Cargo.lock') }}
          restore-keys: |
            cargo-${{ runner.os }}-

      - name: Cache NuGet packages
        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6
        with:
          path: ~/.nuget/packages
          key: nuget-${{ runner.os }}-${{ hashFiles('**/Directory.Packages.props') }}
          restore-keys: |
            nuget-${{ runner.os }}-

      # ── Frontend ─────────────────────────────────────────────
      - name: Install npm dependencies
        run: npm ci

      - name: Build frontend
        run: npm run build

      - name: Run npm audit
        run: npm audit --audit-level=moderate

      # ── .NET sidecar ─────────────────────────────────────────
      - name: Build .NET sidecar
        run: dotnet build sidecar/Ssmsx.Sidecar.slnx

      - name: Run .NET tests
        run: dotnet test sidecar/Ssmsx.Sidecar.slnx --filter "Category!=Integration"

      - name: Publish sidecar (${{ matrix.dotnet-rid }})
        run: dotnet publish sidecar/src/Ssmsx.Sidecar -c Release -r ${{ matrix.dotnet-rid }}

      - name: Copy sidecar binary to src-tauri/sidecars/
        shell: bash
        run: |
          mkdir -p src-tauri/sidecars
          src="sidecar/src/Ssmsx.Sidecar/bin/Release/net10.0/${{ matrix.dotnet-rid }}/publish/Ssmsx.Sidecar${{ matrix.sidecar-ext }}"
          dst="src-tauri/sidecars/ssmsx-sidecar-${{ matrix.sidecar-triple }}${{ matrix.sidecar-ext }}"
          cp "$src" "$dst"
          echo "Copied sidecar to $dst"

      # ── Rust checks ──────────────────────────────────────────
      - name: Check Rust formatting
        run: cargo fmt --manifest-path src-tauri/Cargo.toml --check

      - name: Run Rust clippy
        run: cargo clippy --manifest-path src-tauri/Cargo.toml --all-targets -- -D warnings

      - name: Run Rust tests
        run: cargo test --manifest-path src-tauri/Cargo.toml

      - name: Check Rust build
        run: cargo check --manifest-path src-tauri/Cargo.toml

      - name: Install cargo-audit
        shell: bash
        run: |
          if ! command -v cargo-audit >/dev/null 2>&1; then
            cargo install cargo-audit --locked
          fi

      - name: Fetch Rust advisory database
        shell: bash
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          db="$HOME/.cargo/advisory-db"
          auth="$(printf 'x-access-token:%s' "$GH_TOKEN" | base64 | tr -d '\n')"
          if [ -d "$db/.git" ]; then
            git -C "$db" -c "http.https://github.com/.extraheader=AUTHORIZATION: basic $auth" pull --ff-only
          else
            rm -rf "$db"
            git -c "http.https://github.com/.extraheader=AUTHORIZATION: basic $auth" clone --depth=1 https://github.com/RustSec/advisory-db.git "$db"
          fi

      - name: Run Rust advisory audit
        shell: bash
        run: |
          cd src-tauri
          # RUSTSEC-2026-0194 / -0195: quadratic-parse and namespace-allocation
          # DoS in quick-xml <0.41. It reaches us only transitively via
          # tauri -> plist (Apple bundle/Info.plist parsing at build/bundle time,
          # never attacker-controlled runtime XML), and plist 1.8.0 pins
          # quick-xml ^0.38 so there's no upstream fix to pull yet. Ignore these
          # two IDs only — every other advisory still fails the build. Drop this
          # once a tauri/plist release moves to quick-xml >=0.41.
          cargo audit --db "$HOME/.cargo/advisory-db" --no-fetch \
            --ignore RUSTSEC-2026-0194 \
            --ignore RUSTSEC-2026-0195

      # ── Tauri CLI ──────────────────────────────────────────────
      - name: Install Tauri CLI
        shell: bash
        env:
          CARGO_HTTP_MULTIPLEXING: "false"
        run: |
          for attempt in 1 2 3; do
            if cargo install tauri-cli --version "^2"; then
              exit 0
            fi

            if [ "$attempt" = 3 ]; then
              exit 1
            fi

            sleep "$((attempt * 10))"
          done

      # ── Tauri / Rust ─────────────────────────────────────────
      - name: Build Tauri app
        run: cargo tauri build

  release:
    name: Sign, Notarize & Release
    needs: build
    if: github.event_name == 'release'
    runs-on: macos-14
    timeout-minutes: 60
    environment: prod
    permissions:
      contents: write

    steps:
      - name: Checkout repository
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7

      - name: Install Rust (stable)
        uses: dtolnay/rust-toolchain@4be7066ada62dd38de10e7b70166bc74ed198c30 # stable

      - name: Install .NET 10
        uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5
        with:
          dotnet-version: 10.0.x

      - name: Install Node.js 24
        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
        with:
          node-version: 24
          cache: npm

      - name: Cache Rust build output
        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6
        with:
          path: |
            ~/.cargo/registry
            ~/.cargo/git
            src-tauri/target
          key: ${{ runner.os }}-release-cargo-${{ hashFiles('src-tauri/Cargo.lock') }}
          restore-keys: |
            ${{ runner.os }}-release-cargo-

      - name: Cache NuGet packages
        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6
        with:
          path: ~/.nuget/packages
          key: release-nuget-${{ runner.os }}-${{ hashFiles('**/Directory.Packages.props') }}
          restore-keys: |
            release-nuget-${{ runner.os }}-

      - name: Install npm dependencies
        run: npm ci

      - name: Set release version
        run: |
          if [[ "${GITHUB_REF_NAME}" =~ ^v([0-9]+)\.([0-9]+)(-beta\.[0-9]+)?$ ]]; then
            export VERSION="${GITHUB_REF_NAME#v}"
            export APP_VERSION="${BASH_REMATCH[1]}.${BASH_REMATCH[2]}.${GITHUB_RUN_NUMBER}${BASH_REMATCH[3]}"
            echo "VERSION=${VERSION}" >> "${GITHUB_ENV}"
            echo "APP_VERSION=${APP_VERSION}" >> "${GITHUB_ENV}"
          else
            echo "Release tag must be stable v{major}.{minor} or beta v{major}.{minor}-beta.{n}, like v0.1 or v0.1-beta.1; got ${GITHUB_REF_NAME}" >&2
            exit 1
          fi

          node --input-type=module <<'NODE'
          import fs from "node:fs";

          const version = process.env.APP_VERSION;

          const packageJson = JSON.parse(fs.readFileSync("package.json", "utf8"));
          packageJson.version = version;
          fs.writeFileSync("package.json", `${JSON.stringify(packageJson, null, 2)}\n`);

          const tauriConfig = JSON.parse(fs.readFileSync("src-tauri/tauri.conf.json", "utf8"));
          tauriConfig.version = version;
          fs.writeFileSync("src-tauri/tauri.conf.json", `${JSON.stringify(tauriConfig, null, 2)}\n`);

          const cargoPath = "src-tauri/Cargo.toml";
          const cargoToml = fs.readFileSync(cargoPath, "utf8");
          fs.writeFileSync(
            cargoPath,
            cargoToml.replace(/^version = "[^"]+"/m, `version = "${version}"`),
          );

          const propsPath = "sidecar/Directory.Build.props";
          const props = fs.readFileSync(propsPath, "utf8");
          fs.writeFileSync(
            propsPath,
            props.replace(/<Version>[^<]+<\/Version>/, `<Version>${version}</Version>`),
          );
          NODE

      - name: Publish sidecar
        run: dotnet publish sidecar/src/Ssmsx.Sidecar -c Release -r osx-arm64

      - name: Copy sidecar binary
        run: |
          mkdir -p src-tauri/sidecars
          cp sidecar/src/Ssmsx.Sidecar/bin/Release/net10.0/osx-arm64/publish/Ssmsx.Sidecar \
            src-tauri/sidecars/ssmsx-sidecar-aarch64-apple-darwin

      - name: Import signing certificate
        env:
          CERTIFICATE_BASE64: ${{ secrets.DEVELOPER_ID_CERTIFICATE }}
          CERTIFICATE_PASSWORD: ${{ secrets.DEVELOPER_ID_PASSWORD }}
        run: |
          test -n "${CERTIFICATE_BASE64}" || { echo "DEVELOPER_ID_CERTIFICATE is not set in the prod environment." >&2; exit 1; }
          test -n "${CERTIFICATE_PASSWORD}" || { echo "DEVELOPER_ID_PASSWORD is not set in the prod environment." >&2; exit 1; }

          echo "${CERTIFICATE_BASE64}" | base64 --decode > certificate.p12
          KEYCHAIN_PATH="${RUNNER_TEMP}/signing.keychain-db"
          KEYCHAIN_PASSWORD="$(openssl rand -hex 16)"
          security create-keychain -p "${KEYCHAIN_PASSWORD}" "${KEYCHAIN_PATH}"
          security default-keychain -s "${KEYCHAIN_PATH}"
          security unlock-keychain -p "${KEYCHAIN_PASSWORD}" "${KEYCHAIN_PATH}"
          security import certificate.p12 \
            -k "${KEYCHAIN_PATH}" \
            -P "${CERTIFICATE_PASSWORD}" \
            -T /usr/bin/codesign
          security set-key-partition-list \
            -S apple-tool:,apple:,codesign: \
            -s -k "${KEYCHAIN_PASSWORD}" \
            "${KEYCHAIN_PATH}"
          security find-identity -v -p codesigning "${KEYCHAIN_PATH}"
          rm certificate.p12

      - name: Build signed app bundle
        env:
          APPLE_SIGNING_IDENTITY: "Developer ID Application: Gordon Beeming (89DBN36T4T)"
        run: npm run tauri -- build --bundles app

      - name: Verify release app metadata
        run: |
          APP_BUNDLE="src-tauri/target/release/bundle/macos/SSMSx.app"
          INFO_PLIST="${APP_BUNDLE}/Contents/Info.plist"
          test -d "${APP_BUNDLE}" || { echo "Release app bundle was not created at ${APP_BUNDLE}." >&2; exit 1; }
          test -f "${INFO_PLIST}" || { echo "Release app metadata was not created at ${INFO_PLIST}." >&2; exit 1; }

          BUNDLE_VERSION="$(/usr/libexec/PlistBuddy -c 'Print :CFBundleShortVersionString' "${INFO_PLIST}")"
          if [ "${BUNDLE_VERSION}" != "${APP_VERSION}" ]; then
            echo "Expected app bundle version ${APP_VERSION}, got ${BUNDLE_VERSION}." >&2
            exit 1
          fi

      - name: Sign application
        run: |
          APP_BUNDLE="src-tauri/target/release/bundle/macos/SSMSx.app"
          codesign --deep --force \
            --options runtime \
            --timestamp \
            --sign "Developer ID Application: Gordon Beeming (89DBN36T4T)" \
            "${APP_BUNDLE}"
          codesign --verify --deep --strict --verbose=2 "${APP_BUNDLE}"

      - name: Notarize application
        env:
          APPLE_ID: ${{ secrets.APPLE_ID }}
          APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
          APPLE_APP_PASSWORD: ${{ secrets.APPLE_APP_PASSWORD }}
        run: |
          test -n "${APPLE_ID}" || { echo "APPLE_ID is not set in the prod environment." >&2; exit 1; }
          test -n "${APPLE_TEAM_ID}" || { echo "APPLE_TEAM_ID is not set in the prod environment." >&2; exit 1; }
          test -n "${APPLE_APP_PASSWORD}" || { echo "APPLE_APP_PASSWORD is not set in the prod environment." >&2; exit 1; }

          APP_BUNDLE="src-tauri/target/release/bundle/macos/SSMSx.app"
          NOTARY_ZIP="${RUNNER_TEMP}/ssmsx-notarize.zip"
          ditto -c -k --keepParent "${APP_BUNDLE}" "${NOTARY_ZIP}"
          xcrun notarytool submit "${NOTARY_ZIP}" \
            --apple-id "${APPLE_ID}" \
            --team-id "${APPLE_TEAM_ID}" \
            --password "${APPLE_APP_PASSWORD}" \
            --wait

      - name: Staple notarization ticket
        run: xcrun stapler staple src-tauri/target/release/bundle/macos/SSMSx.app

      - name: Create DMG
        run: |
          VERSION="${GITHUB_REF_NAME#v}"
          mkdir -p dist/release
          hdiutil create \
            -volname "SSMSx" \
            -srcfolder src-tauri/target/release/bundle/macos/SSMSx.app \
            -ov \
            -format UDZO \
            "dist/release/ssmsx-${VERSION}-aarch64.dmg"

      - name: Upload release asset
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          VERSION="${GITHUB_REF_NAME#v}"
          gh release upload "${GITHUB_REF_NAME}" \
            "dist/release/ssmsx-${VERSION}-aarch64.dmg" \
            --clobber

      - name: Update Homebrew tap
        env:
          HOMEBREW_TAP_DEPLOY_KEY: ${{ secrets.HOMEBREW_TAP_DEPLOY_KEY }}
        run: |
          test -n "${HOMEBREW_TAP_DEPLOY_KEY}" || { echo "HOMEBREW_TAP_DEPLOY_KEY is not set in the prod environment." >&2; exit 1; }

          VERSION="${GITHUB_REF_NAME#v}"
          DMG_PATH="dist/release/ssmsx-${VERSION}-aarch64.dmg"
          DMG_SHA256="$(shasum -a 256 "${DMG_PATH}" | awk '{print $1}')"

          mkdir -p ~/.ssh
          echo "${HOMEBREW_TAP_DEPLOY_KEY}" > ~/.ssh/homebrew_tap_key
          chmod 600 ~/.ssh/homebrew_tap_key
          ssh-keyscan github.com >> ~/.ssh/known_hosts 2>/dev/null
          export GIT_SSH_COMMAND="ssh -i ~/.ssh/homebrew_tap_key -o StrictHostKeyChecking=no"

          git clone git@github.com:GordonBeeming/homebrew-tap.git /tmp/homebrew-tap

          mkdir -p /tmp/homebrew-tap/Casks
          cat > /tmp/homebrew-tap/Casks/ssmsx.rb << CASK_EOF
          cask "ssmsx" do
            version "${VERSION}"
            sha256 "${DMG_SHA256}"

            url "https://github.com/gordonbeeming/ssmsx/releases/download/v${VERSION}/ssmsx-${VERSION}-aarch64.dmg"
            name "SSMSx"
            desc "Fast cross-platform SQL Server Management Studio replacement"
            homepage "https://github.com/gordonbeeming/ssmsx"

            depends_on macos: :sonoma

            app "SSMSx.app"

            zap trash: [
              "~/Library/Application Support/com.ssmsx.app",
              "~/Library/Caches/com.ssmsx.app",
              "~/Library/Preferences/com.ssmsx.app.plist",
            ]
          end
          CASK_EOF
          sed -i '' 's/^          //' /tmp/homebrew-tap/Casks/ssmsx.rb

          cd /tmp/homebrew-tap
          git config user.name "github-actions[bot]"
          git config user.email "github-actions[bot]@users.noreply.github.com"
          git add Casks/ssmsx.rb
          git commit -m "Update ssmsx to ${VERSION}" || echo "No changes to commit"
          git push

          rm -f ~/.ssh/homebrew_tap_key