release.yml

name: Release

on:
  push:
    tags: ['v*']
  workflow_dispatch:

permissions:
  contents: write

concurrency:
  group: release-${{ github.ref }}
  cancel-in-progress: false

# Single source of truth for the rivet pin; every install step below
# references this so a bump is one edit, not a grep-replace across jobs.
env:
  RIVET_PIN: 288c81f547eb64ec043546acc4df07efc19aceec
jobs:
  macos:
    name: macOS (${{ matrix.arch }})
    runs-on: ${{ matrix.runner }}
    strategy:
      fail-fast: false
      matrix:
        include:
          - { arch: arm64, runner: macos-latest, racket-arch: arm64 }
          - { arch: x64, runner: macos-15-intel, racket-arch: x64 }
    steps:
      - uses: actions/checkout@v4
      - name: Set up Racket CS
        uses: Bogdanp/setup-racket@v1.15
        with:
          architecture: ${{ matrix.racket-arch }}
          distribution: full
          variant: CS
          version: '9.3'
      - name: Install Rivet (catalog)
        # keel pinned just below the commit that added
        # tests/documentation — it collides with rivet v0.11.0's own
        # tests/documentation module and fails every install (upstream
        # issue filed against keel). Drop this pin once the rename lands.
        run: |
          raco pkg install --auto --no-docs 'https://github.com/turinglambdaai/keel.git#0740fdfbdab7bf5dab32232c82f07dd98aa6a196'
          raco pkg install --auto --no-docs 'https://github.com/turinglambdaai/rivet.git#${{ env.RIVET_PIN }}'
      - name: Version preflight (VERSION == rivet.rktd == updater == tag)
        run: bash scripts/check-release-version.sh "${{ github.ref_name }}"
      # The Finder DMG uses the PNG, not the editable SVG. Regenerate it so
      # artwork changes always land in the release (Rivet uses a 660x400 view).
      - name: Render DMG artwork from SVG
        run: |
          brew install librsvg
          bash scripts/render-dmg-background.sh
      # DMG (human installer) + portable zip + SBOM + notices, launch
      # smoke included. The macOS update feed entry is the portable zip,
      # assembled by scripts/make-update-manifest.sh in the publish job.
      - name: Release (DMG + portable zip)
        run: raco rivet release --without-updates --development
      - name: Family naming + checksums
        run: |
          set -euo pipefail
          VERSION="${GITHUB_REF_NAME#v}"
          ARCH="${{ matrix.arch }}"
          cd dist
          # rivet (pinned RIVET_PIN) names the portable zip in family form
          # already; only the DMG lacks the architecture.
          mv "taskly-${VERSION}-macos.dmg" "taskly-${VERSION}-macos-${ARCH}.dmg"
          mv sbom.cdx.json "taskly-${VERSION}-macos-${ARCH}.sbom.cdx.json"
          mv THIRD_PARTY_NOTICES.txt "taskly-${VERSION}-macos-${ARCH}-THIRD_PARTY_NOTICES.txt"
          for f in taskly-*; do
            case "$f" in
              *.sha256) ;;
              # The sbom/notices/wixpdb bodies stay in the CI artifact only;
              # a sidecar without its body on the release is a dangling
              # reference (the 1.4.0 leftover). Checksum what we upload.
              *.sbom.cdx.json | *-THIRD_PARTY_NOTICES.txt | *.wixpdb) ;;
              *) [ -f "$f" ] || continue; [ -f "$f.sha256" ] || shasum -a 256 "$f" > "$f.sha256";;
            esac
          done
      - uses: actions/upload-artifact@v4
        with:
          name: macos-${{ matrix.arch }}
          path: dist/taskly-*

  windows:
    name: Windows (x64)
    runs-on: windows-latest
    steps:
      - uses: actions/checkout@v4
      - name: Set up Racket CS
        uses: Bogdanp/setup-racket@v1.15
        with:
          architecture: x64
          distribution: full
          variant: CS
          version: '9.3'
      - name: Install Rivet (catalog)
        shell: pwsh
        # keel pinned below the tests/documentation collision commit
        # (upstream issue filed); drop once keel renames the module.
        run: raco pkg install --auto --no-docs 'https://github.com/turinglambdaai/keel.git#0740fdfbdab7bf5dab32232c82f07dd98aa6a196' && raco pkg install --auto --no-docs 'https://github.com/turinglambdaai/rivet.git#${{ env.RIVET_PIN }}'
      - name: Install WiX (v5; rivet's MSI toolchain)
        run: dotnet tool install --global wix --version 5.0.2
        shell: bash
      - name: Install crypto (updater dependency)
        run: raco pkg install --auto --no-docs crypto
        shell: pwsh
      - name: Version preflight (VERSION == rivet.rktd == updater == tag)
        shell: bash
        run: bash scripts/check-release-version.sh "${{ github.ref_name }}"
      - name: Verify Windows installer checkbox surface
        shell: pwsh
        run: python scripts/check-windows-installer-bitmaps.py
      - name: Release (MSI + portable zip)
        shell: pwsh
        run: raco rivet release --without-updates --development
      - name: Family naming + checksums
        shell: bash
        run: |
          set -euo pipefail
          VERSION="${GITHUB_REF_NAME#v}"
          cd dist
          # rivet (pinned RIVET_PIN) names msi and portable zip in family
          # form already.
          mv sbom.cdx.json "taskly-${VERSION}-windows-x64.sbom.cdx.json"
          mv THIRD_PARTY_NOTICES.txt "taskly-${VERSION}-windows-x64-THIRD_PARTY_NOTICES.txt"
          for f in taskly-*; do
            case "$f" in
              *.sha256) ;;
              # The sbom/notices/wixpdb bodies stay in the CI artifact only;
              # a sidecar without its body on the release is a dangling
              # reference (the 1.4.0 leftover). Checksum what we upload.
              *.sbom.cdx.json | *-THIRD_PARTY_NOTICES.txt | *.wixpdb) ;;
              *) [ -f "$f" ] || continue; [ -f "$f.sha256" ] || sha256sum "$f" > "$f.sha256";;
            esac
          done
      - uses: actions/upload-artifact@v4
        with:
          name: windows
          path: dist/taskly-*

  linux:
    name: Linux (${{ matrix.arch }})
    runs-on: ${{ matrix.runner }}
    strategy:
      fail-fast: false
      matrix:
        include:
          - { arch: x64, runner: ubuntu-latest, racket-arch: x64 }
          - { arch: arm64, runner: ubuntu-24.04-arm, racket-arch: arm64 }
    steps:
      - uses: actions/checkout@v4
      - name: Set up embeddable Racket CS
        uses: turinglambdaai/rivet/.github/actions/setup-embed-racket@288c81f547eb64ec043546acc4df07efc19aceec
      # Installed after the embeddable runtime so the catalog dependency
      # closure (cext-lib, crypto-lib, keel) resolves against the minimal
      # build — it ships no packages of its own. db backs taskly's storage;
      # crypto backs the updater's signing.
      - name: Install Rivet (catalog) and backend packages
        run: |
          # keel pinned below the tests/documentation collision commit
          # (upstream issue filed); drop once keel renames the module.
          raco pkg install --auto --no-docs 'https://github.com/turinglambdaai/keel.git#0740fdfbdab7bf5dab32232c82f07dd98aa6a196'
          raco pkg install --auto --no-docs 'https://github.com/turinglambdaai/rivet.git#${{ env.RIVET_PIN }}'
          raco pkg install --auto --no-docs db crypto
      - name: Install GTK4, rpm and packaging tooling
        run: |
          sudo apt-get update
          sudo apt-get install --yes \
            libgtk-4-dev libadwaita-1-dev libjson-glib-dev libsecret-1-dev \
            libglib2.0-dev cmake ninja-build pkg-config file \
            rpm desktop-file-utils
      - name: Version preflight (VERSION == rivet.rktd == updater == tag)
        run: bash scripts/check-release-version.sh "${{ github.ref_name }}"
      # tar.gz (the update-feed payload) + deb + rpm + AppImage + portable
      # zip + SBOM, launch smoke included. The AppImage carries its own
      # GTK4 dependency closure; APPIMAGE_EXTRACT_AND_RUN lets
      # appimagetool run on the runner.
      - name: Release (tar.gz + deb + rpm + AppImage + portable zip)
        env:
          APPIMAGE_EXTRACT_AND_RUN: '1'
        run: raco rivet release --without-updates --development
      - name: Family naming + checksums
        run: |
          set -euo pipefail
          VERSION="${GITHUB_REF_NAME#v}"
          ARCH="${{ matrix.arch }}"
          cd dist
          mv sbom.cdx.json "taskly-${VERSION}-linux-${ARCH}.sbom.cdx.json"
          mv THIRD_PARTY_NOTICES.txt "taskly-${VERSION}-linux-${ARCH}-THIRD_PARTY_NOTICES.txt"
          for f in taskly-*; do
            case "$f" in
              *.sha256) ;;
              # The sbom/notices/wixpdb bodies stay in the CI artifact only;
              # a sidecar without its body on the release is a dangling
              # reference (the 1.4.0 leftover). Checksum what we upload.
              *.sbom.cdx.json | *-THIRD_PARTY_NOTICES.txt | *.wixpdb) ;;
              *) [ -f "$f" ] || continue; [ -f "$f.sha256" ] || sha256sum "$f" > "$f.sha256" ;;
            esac
          done
      - uses: actions/upload-artifact@v4
        with:
          name: linux-${{ matrix.arch }}
          path: dist/taskly-*

  publish:
    name: Publish
    needs: [macos, windows, linux]
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Set up Racket CS
        uses: Bogdanp/setup-racket@v1.15
        with:
          architecture: x64
          distribution: full
          variant: CS
          version: '9.3'
      - name: Install Rivet (catalog)
        # keel pinned just below the commit that added
        # tests/documentation — it collides with rivet v0.11.0's own
        # tests/documentation module and fails every install (upstream
        # issue filed against keel). Drop this pin once the rename lands.
        run: |
          raco pkg install --auto --no-docs 'https://github.com/turinglambdaai/keel.git#0740fdfbdab7bf5dab32232c82f07dd98aa6a196'
          raco pkg install --auto --no-docs 'https://github.com/turinglambdaai/rivet.git#${{ env.RIVET_PIN }}'
      - uses: actions/download-artifact@v4
        with:
          path: artifacts
      # Release-kind acceptance (#58): signed-feed rejection, download
      # cancel, the N→N+1 lifecycle, and data preservation must pass on
      # the exact tree being published — bound here so a release cannot
      # ship without its update evidence.
      - name: Release update suite (signed-reject, cancel, N→N+1, data preservation)
        run: raco test racket/tests/release-update-test.rkt
      - name: Gather + sign the update feed + publish
        env:
          GH_TOKEN: ${{ github.token }}
          UPDATE_ED25519_PRIVATE_KEY: ${{ secrets.UPDATE_ED25519_PRIVATE_KEY }}
        run: |
          set -euo pipefail
          VERSION="${GITHUB_REF_NAME#v}"
          bash scripts/check-release-version.sh "$GITHUB_REF_NAME"
          mkdir -p dist
          # cp -R merges: rivet releases leave a dist/taskly-linux-<arch>/
          # staging bundle in the artifacts, and a plain mv dies on the
          # directory collision ("Directory not empty").
          for a in macos-arm64 macos-x64 windows linux-x64 linux-arm64; do
            cp -R "artifacts/$a/." dist/
          done
          # All supported hosts require the signed release feed for
          # in-app updates. Never publish an un-updatable release if the
          # signing secret is missing, malformed, or signing fails.
          if [[ -z "${UPDATE_ED25519_PRIVATE_KEY:-}" ]]; then
            echo "::error::UPDATE_ED25519_PRIVATE_KEY is missing; refusing to publish without a signed update manifest"
            exit 1
          fi
          KEY_PEM="$RUNNER_TEMP/update-signing-key.pem"
          printf '%s\n' "$UPDATE_ED25519_PRIVATE_KEY" > "$KEY_PEM"
          chmod 600 "$KEY_PEM"
          # Refuse to publish a feed signed by a key the shipped clients do not trust.
          DER_PUBLIC="$(openssl pkey -in "$KEY_PEM" -pubout -outform DER 2>/dev/null | base64 -w0)"
          RAW_PUBLIC="$(openssl pkey -in "$KEY_PEM" -pubout -outform DER 2>/dev/null | tail -c 32 | base64 -w0)"
          EXPECTED_DER="$(sed -n '/(define update-public-key-b64/{n;s/^[[:space:]]*"\([^"]*\)".*/\1/p;}' racket/taskly/updater.rkt)"
          EXPECTED_RAW="$(sed -n 's/.*public static let publicKeyBase64 = "\([^"]*\)".*/\1/p' macos-host/Sources/RivetHost/UpdateService.swift)"
          [[ -n "$EXPECTED_DER" && "$DER_PUBLIC" == "$EXPECTED_DER" ]] || {
            echo "::error::Signing secret does not match the backend Ed25519 public key"
            exit 1
          }
          [[ -n "$EXPECTED_RAW" && "$RAW_PUBLIC" == "$EXPECTED_RAW" ]] || {
            echo "::error::Signing secret does not match the macOS Ed25519 public key"
            exit 1
          }
          scripts/make-update-manifest.sh "$GITHUB_REF_NAME" dist "$KEY_PEM"
          test -s dist/update-manifest.json || {
            echo "::error::Signed update manifest was not generated"
            exit 1
          }
          awk -v header="## [${VERSION}]" '
            index($0, header) == 1 {on=1; next}
            on && /^## / {exit}
            on {print}
          ' CHANGELOG.md > /tmp/notes.md
          if [[ ! -s /tmp/notes.md ]]; then
            echo "::error::CHANGELOG.md lacks release notes for ${VERSION}"
            exit 1
          fi
          cd dist
          for f in *.sha256; do [ -s "$f" ] || rm -f "$f"; done
          # Normalize: the Windows runner's sha256sum emits binary-mode
          # "HASH *name" lines; keep SHA256SUMS uniform in the two-space
          # text form (the msi row was the lone starred line in 0.2.0).
          cat *.sha256 | sed 's/ \*/  /' > SHA256SUMS
          # The signed manifest is mandatory. Assemble the remaining
          # uploads per-glob to avoid shell failures on absent optional formats.
          uploads=( )
          for pattern in *.zip *.tar.gz *.dmg *.msi *.deb *.rpm *.AppImage *.sha256; do
            uploads+=( "$pattern" )
          done
          uploads+=( SHA256SUMS update-manifest.json )
          # Idempotent publish: a failed run leaves the release (and some
          # assets) behind; re-runs edit + re-upload over it instead of
          # colliding with "release already exists".
          if gh release view "$GITHUB_REF_NAME" > /dev/null 2>&1; then
            gh release edit "$GITHUB_REF_NAME" --notes-file /tmp/notes.md
          else
            gh release create "$GITHUB_REF_NAME" \
              --title "Taskly ${VERSION}" \
              --notes-file /tmp/notes.md
          fi
          gh release upload "$GITHUB_REF_NAME" --clobber "${uploads[@]}"
      - name: Stable alias copies (versionless direct-download links)
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          set -euo pipefail
          VERSION="${GITHUB_REF_NAME#v}"
          # Family rule: download buttons point at
          # releases/latest/download/<alias>, so every release also ships
          # versionless copies of the primary installers. Aliases are
          # overwritten on each release; the versioned assets stay canonical.
          mkdir -p stable-alias
          cp "dist/taskly-${VERSION}-macos-arm64.dmg" stable-alias/taskly-macos-arm64.dmg
          cp "dist/taskly-${VERSION}-macos-x64.dmg" stable-alias/taskly-macos-x64.dmg
          cp "dist/taskly-${VERSION}-windows-x64.msi" stable-alias/taskly-windows-x64.msi
          cp "dist/taskly-${VERSION}-linux-amd64.deb" stable-alias/taskly-linux-x64.deb
          cp "dist/taskly-${VERSION}-linux-arm64.deb" stable-alias/taskly-linux-arm64.deb
          cp "dist/taskly-${VERSION}-linux-x86_64.AppImage" stable-alias/taskly-linux-x64.AppImage
          cp "dist/taskly-${VERSION}-linux-aarch64.AppImage" stable-alias/taskly-linux-arm64.AppImage
          gh release upload "$GITHUB_REF_NAME" stable-alias/* --clobber -R turinglambdaai/taskly