release-macos.yml

name: Release macOS

# Builds the MobileCode desktop app for Apple silicon and attaches it to a GitHub release.
#
# Two ways to run it:
#   - Push a tag matching packages/opencode/package.json.
#   - Run it manually. The workflow reads that version and creates the matching tag.
#
# The release is created as a draft so it can be reviewed, then published from the GitHub UI
# (or pass publish=true). Only the DMG is attached. The zip, blockmaps and latest-mac.yml that
# electron-builder can produce exist for the in-app updater, so attach them again once it is enabled.
#
# Builds are intentionally unsigned for now. electron-builder.config.ts ad-hoc seals the bundle so
# a downloaded copy is not reported as "damaged"; the first launch is refused, and the user allows
# it under System Settings > Privacy & Security > Open Anyway. The in-app updater stays disabled
# until builds are signed with a Developer ID and notarized.

on:
  push:
    tags:
      - "v*"
  workflow_dispatch:
    inputs:
      publish:
        description: "Publish the release immediately instead of leaving it as a draft"
        required: false
        type: boolean
        default: false

permissions:
  contents: write

concurrency: release-macos-${{ github.ref }}

jobs:
  build:
    if: github.repository == 'hsandhu/mobilecode'
    runs-on: macos-15
    timeout-minutes: 90
    env:
      OPENCODE_CHANNEL: prod
      MOBILECODE_UPDATER_ENABLED: "false"
      CSC_IDENTITY_AUTO_DISCOVERY: "false"
      FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"
    steps:
      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
        with:
          fetch-depth: 0

      - name: Resolve version
        id: version
        run: |
          set -euo pipefail
          PACKAGE_VERSION="$(node -p "require('./packages/opencode/package.json').version")"
          if [ "${{ github.event_name }}" = "push" ]; then
            VERSION="${GITHUB_REF_NAME#v}"
          else
            VERSION="$PACKAGE_VERSION"
          fi
          if [[ ! "$VERSION" =~ ^(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)$ ]]; then
            echo "Version must be a stable SemVer such as 1.2.3, got '$VERSION'"
            exit 1
          fi
          if [ "$VERSION" != "$PACKAGE_VERSION" ]; then
            echo "Release version $VERSION must match OpenCode version $PACKAGE_VERSION"
            exit 1
          fi
          echo "version=$VERSION" >> "$GITHUB_OUTPUT"
          echo "tag=v$VERSION" >> "$GITHUB_OUTPUT"

      - name: Create or refresh draft tag
        if: github.event_name == 'workflow_dispatch'
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          set -euo pipefail
          TAG="${{ steps.version.outputs.tag }}"
          git config user.name "github-actions[bot]"
          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
          if git rev-parse -q --verify "refs/tags/$TAG" >/dev/null; then
            TAG_COMMIT="$(git rev-list -n 1 "$TAG")"
            if [ "$TAG_COMMIT" != "$GITHUB_SHA" ]; then
              RELEASE_DRAFT="$(gh api --paginate "repos/$GITHUB_REPOSITORY/releases?per_page=100" --jq ".[] | select(.tag_name == \"$TAG\") | .draft")"
              if [ "$RELEASE_DRAFT" = "false" ]; then
                echo "Published release $TAG cannot be moved. Sync to a newer OpenCode version before releasing again."
                exit 1
              fi
              TAG_OBJECT="$(git rev-parse "refs/tags/$TAG")"
              git tag -fa "$TAG" "$GITHUB_SHA" -m "MobileCode $TAG"
              git push --force-with-lease="refs/tags/$TAG:$TAG_OBJECT" origin "refs/tags/$TAG"
            fi
          else
            git tag -a "$TAG" -m "MobileCode $TAG"
            git push origin "$TAG"
          fi
          git checkout --detach "$TAG"

      - uses: ./.github/actions/setup-bun

      - name: Setup Node.js
        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
        with:
          node-version: "22"

      - name: Test desktop
        working-directory: packages/desktop
        run: bun test

      - name: Typecheck desktop
        working-directory: packages/desktop
        run: bun typecheck

      - name: Prepare
        working-directory: packages/desktop
        run: bun ./scripts/prepare.ts
        env:
          OPENCODE_VERSION: ${{ steps.version.outputs.version }}

      - name: Build
        working-directory: packages/desktop
        run: bun run build
        env:
          NODE_OPTIONS: --max-old-space-size=4096
          OPENCODE_VERSION: ${{ steps.version.outputs.version }}

      - name: Package
        working-directory: packages/desktop
        run: bun x electron-builder --mac dmg --arm64 --publish never --config electron-builder.config.ts

      - name: Attach the app to the release
        working-directory: packages/desktop
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          GH_REPO: ${{ github.repository }}
          TAG: ${{ steps.version.outputs.tag }}
          VERSION: ${{ steps.version.outputs.version }}
        run: |
          set -euo pipefail
          DMG="dist/mobilecode-desktop-mac-arm64.dmg"
          if ! gh release view "$TAG" >/dev/null 2>&1; then
            gh release create "$TAG" --draft --verify-tag --title "$VERSION" --notes ""
          fi
          # A re-run on an existing draft may find update files an older run attached; keep only the app.
          gh release view "$TAG" --json assets --jq '.assets[].name' \
            | { grep -vxF "$(basename "$DMG")" || true; } \
            | while read -r ASSET; do gh release delete-asset "$TAG" "$ASSET" --yes; done
          gh release upload "$TAG" "$DMG" --clobber

      - name: Keep the app on the run too
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
        with:
          name: mobilecode-desktop-mac-arm64
          path: packages/desktop/dist/*.dmg
          if-no-files-found: error

      - name: Publish release
        if: github.event_name == 'workflow_dispatch' && inputs.publish
        run: gh release edit "${{ steps.version.outputs.tag }}" --draft=false
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}