release.yml

name: Publish signed Drive Bridge packages
on:
  workflow_dispatch:
    inputs:
      tag:
        description: Existing version tag (vX.Y.Z)
        required: true
        type: string
permissions:
  contents: read
concurrency:
  group: bridge-release-${{ inputs.tag }}
  cancel-in-progress: false
jobs:
  build:
    strategy:
      fail-fast: false
      matrix:
        include:
          - os: windows-latest
            rust: x86_64-pc-windows-msvc
            target: windows-x86_64
          - os: ubuntu-22.04
            rust: x86_64-unknown-linux-gnu
            target: linux-x86_64
          - os: macos-14
            rust: aarch64-apple-darwin
            target: macos-aarch64
          - os: macos-15-intel
            rust: x86_64-apple-darwin
            target: macos-x86_64
    runs-on: ${{ matrix.os }}
    timeout-minutes: 25
    env:
      RELEASE_TAG: ${{ inputs.tag }}
      BRIDGE_TARGET: ${{ matrix.target }}
      RUST_TARGET: ${{ matrix.rust }}
    steps:
      - uses: actions/checkout@v4
        with:
          ref: ${{ inputs.tag }}
      - name: Validate release version
        shell: bash
        run: |
          node -e 'const fs=require("fs"); const tag=process.env.RELEASE_TAG; if(!/^v\d+\.\d+\.\d+$/.test(tag)||!fs.readFileSync("Cargo.toml","utf8").includes(`version = "${tag.slice(1)}"`)) process.exit(1)'
      - uses: dtolnay/rust-toolchain@stable
        with:
          targets: ${{ matrix.rust }}
      - name: Windows binding generator
        if: runner.os == 'Windows'
        shell: pwsh
        run: |
          python -m pip install libclang==18.1.1
          $clang = python -c "import clang.cindex; print(clang.cindex.Config.library_path)"
          "LIBCLANG_PATH=$clang" | Out-File -FilePath $env:GITHUB_ENV -Append
      - name: macOS build prerequisites
        if: runner.os == 'macOS'
        run: |
          brew install pkg-config
          brew install --cask macfuse
          echo "PKG_CONFIG_PATH=/usr/local/lib/pkgconfig:/opt/homebrew/lib/pkgconfig" >> "$GITHUB_ENV"
      - run: cargo build --release --locked --target ${{ matrix.rust }}
      - run: cargo test --locked --workspace --target ${{ matrix.rust }}
      - name: Install signed WinFsp runtime on the disposable runner
        if: runner.os == 'Windows'
        shell: pwsh
        run: |
          $msi = Join-Path $env:RUNNER_TEMP 'winfsp-2.1.25156.msi'
          Invoke-WebRequest 'https://github.com/winfsp/winfsp/releases/download/v2.1/winfsp-2.1.25156.msi' -OutFile $msi
          if ((Get-FileHash -Algorithm SHA256 -LiteralPath $msi).Hash -ne '073A70E00F77423E34BED98B86E600DEF93393BA5822204FAC57A29324DB9F7A') { throw 'WinFsp installer hash mismatch' }
          $signature = Get-AuthenticodeSignature -LiteralPath $msi
          if ($signature.Status -ne 'Valid' -or $signature.SignerCertificate.Subject -notmatch 'Navimatics') { throw 'WinFsp installer signature mismatch' }
          $install = Start-Process msiexec.exe -ArgumentList @('/i', ('"' + $msi + '"'), '/qn', '/norestart', 'INSTALLLEVEL=1000') -WindowStyle Hidden -Wait -PassThru
          if ($install.ExitCode -notin @(0, 3010)) { throw "WinFsp installation failed: $($install.ExitCode)" }
      - name: Native Windows filesystem acceptance
        if: runner.os == 'Windows'
        timeout-minutes: 5
        env:
          SHELLCANVAS_NATIVE_WINDOWS_TEST: '1'
        run: cargo test --release --locked --target ${{ matrix.rust }} --test native_windows -- --ignored --nocapture
      - name: Prepare executable
        shell: bash
        run: |
          mkdir -p release
          suffix=""
          if [ "$RUNNER_OS" = Windows ]; then suffix=".exe"; fi
          "target/$RUST_TARGET/release/shellcanvas-drive-bridge$suffix" --version > "release/$BRIDGE_TARGET.version"
          cp "target/$RUST_TARGET/release/shellcanvas-drive-bridge$suffix" "release/shellcanvas-drive-bridge-${RELEASE_TAG#v}-$BRIDGE_TARGET$suffix"
      - uses: actions/upload-artifact@v4
        with:
          name: release-${{ matrix.target }}
          path: release/*
          retention-days: 7
          if-no-files-found: error
  publish:
    needs: build
    runs-on: ubuntu-22.04
    permissions:
      contents: write
    env:
      RELEASE_TAG: ${{ inputs.tag }}
      GH_TOKEN: ${{ github.token }}
    steps:
      - uses: actions/checkout@v4
        with:
          ref: ${{ inputs.tag }}
      - uses: actions/download-artifact@v4
        with:
          pattern: release-*
          path: release
          merge-multiple: true
      - name: Prepare signed manifest and notices
        run: |
          cp LICENSE THIRD-PARTY.md release/
          node scripts/dependency-notices.mjs release/DEPENDENCY-LICENSES.txt
          node scripts/release-manifest.mjs release "$RELEASE_TAG"
          npm install --no-save @tauri-apps/cli@2.11.4
      - name: Sign release manifest
        env:
          TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.BRIDGE_SIGNING_PRIVATE_KEY }}
          TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ''
        run: npx tauri signer sign release/bridge-release.json > /dev/null
      - name: Publish complete release
        run: |
          gh release create "$RELEASE_TAG" release/* --verify-tag --title "Drive Bridge $RELEASE_TAG" --notes-file RELEASE-NOTES.md