release.yml

name: Release

on:
  push:
    tags:
      - 'v*'
  workflow_dispatch:
    inputs:
      tag:
        description: 'Existing v* release tag to build and upload'
        required: true
        type: string

concurrency:
  group: release-${{ github.event_name == 'workflow_dispatch' && inputs.tag || github.ref }}
  cancel-in-progress: false

jobs:
  # A tag used to go straight to build-sign-publish with no checks at all: a
  # broken commit could be signed and shipped to users. The release now gates on
  # the CI workflow itself, so the bar for publishing is the same bar as for
  # merging, and it cannot silently drift out of sync with it.
  verify:
    name: Verify
    uses: ./.github/workflows/ci.yml
    with:
      ref: ${{ github.event_name == 'workflow_dispatch' && inputs.tag || github.ref }}

  release:
    needs: verify
    runs-on: windows-latest
    timeout-minutes: 45
    permissions:
      contents: write

    steps:
      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
        with:
          ref: ${{ github.event_name == 'workflow_dispatch' && inputs.tag || github.ref }}

      - name: Setup Node.js
        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
        with:
          # Pinned to the same major the CI workflow and package.json engines
          # require. `lts/*` floats, and a release must not build on a runtime
          # the test suite never ran on.
          node-version: 22
          cache: npm

      - name: Setup Rust toolchain
        uses: dtolnay/rust-toolchain@4be7066ada62dd38de10e7b70166bc74ed198c30 # stable

      - name: Cache Rust build artifacts
        uses: swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
        with:
          workspaces: './apps/desktop/src-tauri -> target'

      - name: Install npm dependencies
        run: npm ci

      - name: Build and publish Tauri release
        uses: tauri-apps/tauri-action@84b9d35b5fc46c1e45415bdb6144030364f7ebc5 # v0
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
          TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
        with:
          tagName: ${{ github.event_name == 'workflow_dispatch' && inputs.tag || github.ref_name }}
          releaseName: 'Splice Shell v__VERSION__'
          releaseBody: 'See the changelog for details.'
          releaseDraft: true
          prerelease: false
          projectPath: './apps/desktop'