build.yml

name: Build

on:
  push:
    tags:
      - '*' # Trigger on every newly created tag
  workflow_dispatch: {} # Manually build

# Defaults for every job and step in this workflow
defaults:
  run:
    shell: bash # Run everything using bash, even on Windows

# Global environment variables
env:
  NODE_VERSION: '18'

# The GitHub Token needs to be able to write contents in order to prepare a release.
permissions:
  contents: write

# Ensure only a single build workflow runs at any one time
concurrency:
  group: ${{ github.workflow }}
  cancel-in-progress: true

# This workflow file contains four jobs, three to build the corresponding
# releases on all three supported platforms, and a last one, which will
# create the release draft.
jobs:
  # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #
  #                                                                           #
  #                              WINDOWS BUILDS                               #
  #                                                                           #
  # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #
  build_win_x64:
    name: Windows (x86_64)
    runs-on: windows-latest
    steps:
      - name: Checkout branch ${{ github.ref_name }}
        uses: actions/checkout@v4
        with:
          ref: ${{ github.ref_name }}
      - name: Setup NodeJS ${{ env.NODE_VERSION }}
        uses: actions/setup-node@v4
        with:
          node-version: ${{ env.NODE_VERSION }}
          cache: 'yarn'
      - name: Set up build environment
        run: yarn install --immutable
      - name: Retrieve package.json version
        id: ref
        run: echo "version=$(cat package.json | jq -r '.version')" >> $GITHUB_ENV
      # Now, remove all platform/arch-incompatible prebuilt binaries, as
      # signtool will error out if it finds such incompatible binaries instead
      # of just signing them.
      - name: Remove incompatible llama.cpp binaries
        run: |
          rm -rf node_modules/node-llama-cpp/llamaBins/linux-arm64
          rm -rf node_modules/node-llama-cpp/llamaBins/linux-armv7l
          rm -rf node_modules/node-llama-cpp/llamaBins/linux-x64
          rm -rf node_modules/node-llama-cpp/llamaBins/linux-x64-cuda
          rm -rf node_modules/node-llama-cpp/llamaBins/linux-x64-vulkan
          rm -rf node_modules/node-llama-cpp/llamaBins/mac-arm64-metal
          rm -rf node_modules/node-llama-cpp/llamaBins/mac-x64
      - name: Prepare certificate
        run: |
          echo "${{ secrets.WIN32_CERT }}" | base64 --decode > "win32_cert.p12"
      - name: Package & Release
        run: yarn package:win-x64 && yarn release:win-x64
        env:
          WIN32_CERT: "win32_cert.p12"
          WIN32_CERT_PASS: "${{ secrets.WIN32_CERT_PASS }}"
      - name: Cache installer
        uses: actions/upload-artifact@v4
        with:
          name: win32_x64
          # There are three files we have to upload. The Setup.exe is the main
          # installer, the nupkg- and RELEASES-files are for updating.
          path: ./out

  # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #
  #                                                                           #
  #                               MACOS BUILDS                                #
  #                                                                           #
  # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #
  build_macos_x64:
    name: macOS (x86_64)
    runs-on: macos-latest
    env:
      APPLE_ID: ${{ secrets.APPLE_ID }}
      APPLE_ID_PASS: ${{ secrets.APPLE_ID_PASS }}
    steps:
      # Check out master for a regular release, or develop branch for a nightly
      - name: Checkout branch ${{ github.ref_name }}
        uses: actions/checkout@v4
        with:
          ref: ${{ github.ref_name }}
      - name: Setup NodeJS ${{ env.NODE_VERSION }}
        uses: actions/setup-node@v4
        with:
          node-version: ${{ env.NODE_VERSION }}
          cache: 'yarn'
      - name: Set up build environment
        run: yarn install --immutable
      - name: Retrieve package.json version
        id: ref
        run: echo "version=$(cat package.json | jq -r '.version')" >> $GITHUB_ENV
      # Save the macOS certificate on this runner for forge to access it in the
      # next step below.
      - name: Retrieve code signing certificate
        run: ./scripts/add-osx-cert.sh
        env:
          MACOS_CERT: ${{ secrets.MACOS_CERT }}
          MACOS_CERT_PASS: ${{ secrets.MACOS_CERT_PASS }}
      - name: Package
        run: yarn package:mac-x64
      - name: Release
        run: yarn release:mac-x64
      - name: Cache image file
        uses: actions/upload-artifact@v4
        with:
          name: darwin_x64
          path: ./out

  build_macos_arm64:
    name: macOS (arm64)
    runs-on: macos-latest
    env:
      APPLE_ID: ${{ secrets.APPLE_ID }}
      APPLE_ID_PASS: ${{ secrets.APPLE_ID_PASS }}
    steps:
      - name: Checkout branch ${{ github.ref_name }}
        uses: actions/checkout@v4
        with:
          ref: ${{ github.ref_name }}
      - name: Setup NodeJS ${{ env.NODE_VERSION }}
        uses: actions/setup-node@v4
        with:
          node-version: ${{ env.NODE_VERSION }}
          cache: 'yarn'
      - name: Set up build environment
        run: yarn install --immutable
      - name: Retrieve package.json version
        id: ref
        run: echo "version=$(cat package.json | jq -r '.version')" >> $GITHUB_ENV
      # Save the macOS certificate on this runner for forge to access it in the
      # next step below.
      - name: Retrieve code signing certificate
        run: ./scripts/add-osx-cert.sh
        env:
          MACOS_CERT: ${{ secrets.MACOS_CERT }}
          MACOS_CERT_PASS: ${{ secrets.MACOS_CERT_PASS }}
      - name: Package
        run: yarn package:mac-arm
      - name: Release
        run: yarn release:mac-arm
      - name: Cache image file
        uses: actions/upload-artifact@v4
        with:
          name: darwin_arm64
          path: ./out

  # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #
  #                                                                           #
  #                               LINUX BUILDS                                #
  #                                                                           #
  # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #
  build_linux_x64:
    name: Linux (x86_64)
    runs-on: ubuntu-20.04
    steps:
      # Check out master for a regular release, or develop branch for a nightly
      - name: Checkout branch ${{ github.ref_name }}
        uses: actions/checkout@v4
        with:
          ref: ${{ github.ref_name }}
      - name: Setup NodeJS ${{ env.NODE_VERSION }}
        uses: actions/setup-node@v4
        with:
          node-version: ${{ env.NODE_VERSION }}
          cache: 'yarn'
      - name: Set up build environment
        run: yarn install --immutable
      - name: Retrieve package.json version
        id: ref
        run: echo "version=$(cat package.json | jq -r '.version')" >> $GITHUB_ENV
      - name: Package & Release
        run: |
          yarn package:linux-x64
          yarn release:linux-x64
      - name: Cache installers
        uses: actions/upload-artifact@v4
        with:
          name: linux_x64
          path: ./out
          # BUG: See below
          # ./out/make/rpm/x64/localchat_${{env.version}}_x86_64.rpm
  build_linux_arm64:
    name: Linux (arm64)
    runs-on: ubuntu-20.04
    steps:
      - name: Checkout branch ${{ github.ref_name }}
        uses: actions/checkout@v4
        with:
          ref: ${{ github.ref_name }}
      - name: Setup NodeJS ${{ env.NODE_VERSION }}
        uses: actions/setup-node@v4
        with:
          node-version: ${{ env.NODE_VERSION }}
          cache: 'yarn'
      - name: Set up build environment
        run: yarn install --immutable
      - name: Retrieve package.json version
        id: ref
        run: echo "version=$(cat package.json | jq -r '.version')" >> $GITHUB_ENV
      - name: Package & Release
        run: |
          yarn package:linux-arm
          yarn release:linux-arm
      - name: Cache installers
        uses: actions/upload-artifact@v4
        with:
          name: linux_arm64
          path: ./out
          # BUG: See below
          # ./out/make/rpm/arm64/localchat_${{env.version}}_aarch64.rpm

  # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #
  #                                                                           #
  #                          PREPARE RELEASE DRAFT                            #
  #                                                                           #
  # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #
  # After the three builds, this job downloads all assets, creates and verifies
  # SHA256 checksums, and finally creates a release draft and uploads all
  # assets to it. NOTE: If the workflow detects a nightly is being built, this
  # step rather uploads the binaries to the Zettlr server instead of creating
  # a release draft.
  prepare_release:
    name: Prepare release draft
    needs:
      - build_win_x64
      - build_macos_x64
      - build_macos_arm64
      - build_linux_x64
      - build_linux_arm64
    runs-on: ubuntu-20.04
    steps:
      - name: Checkout branch ${{ github.ref_name }}
        uses: actions/checkout@v4
      - name: Setup NodeJS ${{ env.NODE_VERSION }}
        uses: actions/setup-node@v4
        with:
          node-version: ${{ env.NODE_VERSION }}
          cache: 'yarn'
      - name: Set up build environment
        run: yarn install --immutable
      - name: Retrieve tag version
        id: ref
        run: echo "version=$(cat package.json | jq -r '.version')" >> $GITHUB_ENV
      - name: Make out and release directories
        run: |
          mkdir ./out
          mkdir ./release
      # Download all resulting assets from the previous steps.
      - name: Retrieve installers (Windows x86_64)
        uses: actions/download-artifact@v4
        with:
          name: win32_x64
          path: ./out
      - name: Retrieve installers (macOS x86_64)
        uses: actions/download-artifact@v4
        with:
          name: darwin_x64
          path: ./out
      - name: Retrieve installers (macOS arm64)
        uses: actions/download-artifact@v4
        with:
          name: darwin_arm64
          path: ./out
      - name: Retrieve installers (Linux x86_64)
        uses: actions/download-artifact@v4
        with:
          name: linux_x64
          path: ./out
      - name: Retrieve installers (Linux arm64)
        uses: actions/download-artifact@v4
        with:
          name: linux_arm64
          path: ./out
      # Next step: Move all the files to the root-level releases directory. This
      # ensures that sha256sum will not prepend any weird paths that users would
      # have a difficult time replicating just for checking the checksums.
      # NOTE: The files are in the following directory structure:
      #
      # ./out
      #   +--> make
      #        |
      #        |--> LocalChat-${{env.version}}-arm64.dmg
      #        |--> LocalChat-${{env.version}}-x64.dmg
      #        |
      #        |--> deb
      #        |    |--> x64
      #        |    |    +--> localchat_${{env.version}}_amd64.deb
      #        |    |
      #        |    +--> arm64
      #        |         +--> localchat_${{env.version}}_arm64.deb
      #        |
      #        |--> zip
      #        |    +--> darwin
      #        |         |--> arm64
      #        |         |    +--> LocalChat-darwin-arm64-${{env.version}}.zip
      #        |         |
      #        |         +--> x64
      #        |              +--> LocalChat-darwin-x64-${{env.version}}.zip
      #        |
      #        +--> squirrel.windows
      #             +--> x64
      #                  |--> LocalChat-${{env.version}} Setup.exe
      #                  |--> LocalChat-${{env.version}}-full.nupkg
      #                  +--> RELEASES
      - name: Move files to ./release directory
        run: |
          mv ./out/make/LocalChat-${{env.version}}-arm64.dmg ./release
          mv ./out/make/LocalChat-${{env.version}}-x64.dmg ./release
          mv ./out/make/deb/arm64/localchat_${{env.version}}_arm64.deb ./release
          mv ./out/make/deb/x64/localchat_${{env.version}}_amd64.deb ./release
          mv ./out/make/zip/darwin/arm64/LocalChat-darwin-arm64-${{env.version}}.zip ./release
          mv ./out/make/zip/darwin/x64/LocalChat-darwin-x64-${{env.version}}.zip ./release
          mv "./out/make/squirrel.windows/x64/LocalChat-${{env.version}} Setup.exe" ./release
          mv ./out/make/squirrel.windows/x64/LocalChat-${{env.version}}-full.nupkg ./release
          mv ./out/make/squirrel.windows/x64/RELEASES ./release
      # Generate the checksums
      - name: Generate SHA256 checksums
        # NOTE: We are not generating checksums for the NuPKG and RELEASES file,
        # as the latter contains checksums itself, and the former only requires
        # checksums in the RELEASES file.
        run: |
          cd ./release
          sha256sum "localchat_${{env.version}}_amd64.deb" > "SHA256SUMS.txt"
          sha256sum "localchat_${{env.version}}_arm64.deb" >> "SHA256SUMS.txt"
          sha256sum "LocalChat-${{env.version}} Setup.exe" >> "SHA256SUMS.txt"
          sha256sum "LocalChat-${{env.version}}-arm64.dmg" >> "SHA256SUMS.txt"
          sha256sum "LocalChat-${{env.version}}-x64.dmg" >> "SHA256SUMS.txt"
          sha256sum "LocalChat-darwin-arm64-${{env.version}}.zip" >> "SHA256SUMS.txt"
          sha256sum "LocalChat-darwin-x64-${{env.version}}.zip" >> "SHA256SUMS.txt"
          cd ..
        # BUG: The rpm builder doesn't like it (see forge.config.js)
        # sha256sum "localchat_${{env.version}}_x86_64.rpm" >> "SHA256SUMS.txt"
        # sha256sum "localchat_${{env.version}}_aarch64.rpm" >> "SHA256SUMS.txt"
      - name: Verify checksums
        run: |
          cd ./release
          sha256sum -c SHA256SUMS.txt
          cd ..
      - name: Create release draft
        uses: softprops/action-gh-release@v1
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        with:
          # Populate the inputs of the release we already know
          tag_name: v${{env.version}}
          name: Release v${{env.version}}
          body: If you can read this, we have forgotten to fill in the changelog. Sorry!
          draft: true # Always create as draft, so that we can populate the remaining values easily
          files: |
            ./release/localchat_${{env.version}}_amd64.deb
            ./release/localchat_${{env.version}}_arm64.deb
            ./release/LocalChat-${{env.version}} Setup.exe
            ./release/LocalChat-${{env.version}}-arm64.dmg
            ./release/LocalChat-${{env.version}}-full.nupkg
            ./release/LocalChat-${{env.version}}-x64.dmg
            ./release/LocalChat-darwin-arm64-${{env.version}}.zip
            ./release/LocalChat-darwin-x64-${{env.version}}.zip
            ./release/RELEASES
            ./release/SHA256SUMS.txt
          # BUG: See above
          # ./release/localchat_${{env.version}}_x86_64.rpm
          # ./release/localchat_${{env.version}}_aarch64.rpm