build.yml

name: Build & Release

on:
  push:
    branches: [master]
    tags: ['v*']
  pull_request:
    branches: [master]
  workflow_dispatch:

permissions:
  contents: write

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  build:
    strategy:
      fail-fast: false
      matrix:
        include:
          - os: macos-latest
            platform: mac
          - os: windows-latest
            platform: win
          - os: ubuntu-latest
            platform: linux

    runs-on: ${{ matrix.os }}

    env:
      # Expose secret presence as a plain env var so `if:` expressions
      # can gate on it (secrets themselves can't be used in `if`).
      HAS_MAC_SIGNING: ${{ secrets.CSC_LINK != '' }}

    steps:
      - uses: actions/checkout@v4

      - uses: oven-sh/setup-bun@v2
        with:
          bun-version: latest

      - name: Install dependencies
        run: bun install --frozen-lockfile

      # Import the Developer ID Application certificate into a fresh
      # keychain so electron-builder can find a valid signing identity.
      # Skipped on non-mac runners and on mac runs without a CSC_LINK
      # secret (e.g. forks / PRs) so those keep producing unsigned builds.
      - name: Import signing certificate (macOS)
        if: matrix.platform == 'mac' && env.HAS_MAC_SIGNING == 'true'
        uses: apple-actions/import-codesign-certs@v3
        with:
          p12-file-base64: ${{ secrets.CSC_LINK }}
          p12-password: ${{ secrets.CSC_KEY_PASSWORD }}

      - name: Probe signing identities (macOS)
        if: matrix.platform == 'mac'
        run: security find-identity -v -p codesigning || true

      - name: Typecheck
        run: bun run typecheck

      - name: Build
        run: bun run build

      - name: Package (${{ matrix.platform }})
        # Only auto-publish to GitHub Releases on tag pushes; otherwise
        # build the artifact and stop so PR / branch runs don't try to
        # upload to a non-existent draft release.
        #
        # Signing + notarization: if the CSC_LINK secret is set on the
        # mac runner, electron-builder will sign with that cert and
        # @electron/notarize will notarize using APPLE_ID / APPLE_APP_
        # SPECIFIC_PASSWORD / APPLE_TEAM_ID. If the secret is absent the
        # build falls back to the old unsigned behavior so forks and PRs
        # without secrets still build.
        run: bunx electron-builder --${{ matrix.platform }} --publish ${{ startsWith(github.ref, 'refs/tags/v') && 'always' || 'never' }}
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          # Notarization credentials — @electron/notarize picks these up
          # automatically when mac.notarize is true in electron-builder.
          APPLE_ID: ${{ secrets.APPLE_ID }}
          APPLE_APP_SPECIFIC_PASSWORD: ${{ secrets.APPLE_APP_SPECIFIC_PASSWORD }}
          APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
          # If there's no signing cert available (fork / no secrets),
          # disable auto-discovery so electron-builder doesn't try to
          # match an ad-hoc identity and explode on notarize.
          CSC_IDENTITY_AUTO_DISCOVERY: ${{ env.HAS_MAC_SIGNING }}

      - name: Upload artifacts
        if: success()
        uses: actions/upload-artifact@v4
        with:
          name: flicky-${{ matrix.platform }}
          if-no-files-found: ignore
          path: |
            release/*.dmg
            release/*.zip
            release/*.exe
            release/*.AppImage
            release/*.deb

  release:
    if: startsWith(github.ref, 'refs/tags/v')
    needs: build
    runs-on: ubuntu-latest

    steps:
      - uses: actions/download-artifact@v4
        with:
          merge-multiple: true

      - name: Create GitHub Release
        uses: softprops/action-gh-release@v2
        with:
          files: |
            *.dmg
            *.zip
            *.exe
            *.AppImage
            *.deb
          generate_release_notes: true