gpx.studio/.github/workflows/desktop.yml

name: Desktop release
# run by hand: from `main` for a release, from `dev` for a pre-release
on:
    workflow_dispatch:

concurrency:
    group: desktop-${{ github.ref }}

jobs:
    # the release stays a draft until every platform is built and tested
    prepare:
        runs-on: ubuntu-latest

        permissions:
            contents: write

        env:
            GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

        outputs:
            version: ${{ steps.version.outputs.version }}
            draft_tag: ${{ steps.version.outputs.draft_tag }}
            release_id: ${{ steps.draft.outputs.release_id }}

        steps:
            - name: Checkout
              uses: actions/checkout@v5

            - name: Choose version
              id: version
              run: |
                  base=$(jq -r .version tauri/tauri.conf.json)
                  if [[ ! "$base" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
                      echo "::error::The version in tauri.conf.json should be x.y.z, not $base"
                      exit 1
                  fi
                  case "$GITHUB_REF_NAME" in
                      main)
                          version=$base
                          draft_tag=desktop-v$base
                          if git ls-remote --exit-code --tags origin "refs/tags/$draft_tag"; then
                              echo "::error::$draft_tag is already released: bump the version in tauri.conf.json"
                              exit 1
                          fi
                          if [ -z "$(jq -r '.plugins.updater.pubkey' tauri/tauri.conf.json)" ]; then
                              echo "::error::The public key of the updater is missing from tauri.conf.json"
                              exit 1
                          fi
                          ;;
                      dev)
                          version=$base-beta.$GITHUB_RUN_NUMBER
                          draft_tag=desktop-beta-$GITHUB_RUN_NUMBER
                          ;;
                      *)
                          echo "::error::Desktop builds are made from main or dev, not $GITHUB_REF_NAME"
                          exit 1
                          ;;
                  esac
                  echo "version=$version" >> "$GITHUB_OUTPUT"
                  echo "draft_tag=$draft_tag" >> "$GITHUB_OUTPUT"

            - name: Create draft release
              id: draft
              env:
                  VERSION: ${{ steps.version.outputs.version }}
                  DRAFT_TAG: ${{ steps.version.outputs.draft_tag }}
              run: |
                  # what a previous attempt left: this tag is not released, so it can only be a draft
                  gh release delete "$DRAFT_TAG" --yes || true
                  if [ "$GITHUB_REF_NAME" = main ]; then
                      gh release create "$DRAFT_TAG" --draft --target "$GITHUB_SHA" \
                          --title "Desktop $VERSION" --generate-notes
                  else
                      gh release create "$DRAFT_TAG" --draft --prerelease --target "$GITHUB_SHA" \
                          --title "Desktop beta $VERSION" \
                          --notes "Beta of the desktop app, built from $GITHUB_SHA on the dev branch. The builds are not signed yet: macOS and Windows will warn before opening them."
                  fi
                  echo "release_id=$(gh release view "$DRAFT_TAG" --json databaseId --jq .databaseId)" >> "$GITHUB_OUTPUT"

    build:
        needs: prepare

        strategy:
            fail-fast: false
            matrix:
                include:
                    - platform: macos-latest
                      rust_targets: aarch64-apple-darwin,x86_64-apple-darwin,wasm32-unknown-unknown
                      args: --target universal-apple-darwin
                    # the oldest supported Ubuntu, so that the AppImage runs on older systems too
                    - platform: ubuntu-22.04
                      rust_targets: wasm32-unknown-unknown
                      args: ''
                    - platform: windows-latest
                      rust_targets: wasm32-unknown-unknown
                      args: ''

        runs-on: ${{ matrix.platform }}

        permissions:
            contents: write

        steps:
            - name: Checkout
              uses: actions/checkout@v5

            - name: Install Linux dependencies
              if: runner.os == 'Linux'
              run: |
                  sudo apt-get update
                  sudo apt-get install -y libwebkit2gtk-4.1-dev libappindicator3-dev librsvg2-dev patchelf

            - name: Install Node.js
              uses: actions/setup-node@v6
              with:
                  node-version: 24
                  cache: npm
                  cache-dependency-path: website/package-lock.json

            - name: Install Rust
              uses: dtolnay/rust-toolchain@stable
              with:
                  targets: ${{ matrix.rust_targets }}

            - name: Cache Rust build
              uses: Swatinem/rust-cache@v2

            - name: Install wasm-pack
              uses: taiki-e/install-action@v2
              with:
                  tool: wasm-pack

            # the desktop app does not use it, but the website depends on its package
            - name: Build wasm
              run: wasm-pack build --target bundler
              working-directory: wasm

            - name: Install dependencies for website
              run: npm install --prefix website

            # the key would be readable in the app: it is left empty, so only the MapTiler layer fails
            - name: Create env file
              run: echo "PUBLIC_MAPTILER_KEY=" >> website/.env

            # only the releases update themselves: they need the updater files, and the signing key
            - name: Set version and updater files
              shell: bash
              env:
                  VERSION: ${{ needs.prepare.outputs.version }}
                  UPDATER: ${{ github.ref_name == 'main' }}
              run: |
                  node -e "
                      const fs = require('fs');
                      const path = 'tauri/tauri.conf.json';
                      const config = JSON.parse(fs.readFileSync(path));
                      config.version = process.env.VERSION;
                      config.bundle.createUpdaterArtifacts = process.env.UPDATER === 'true';
                      fs.writeFileSync(path, JSON.stringify(config, null, 4));
                  "

            - name: Build app and upload it to the draft
              uses: tauri-apps/tauri-action@v1
              env:
                  GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
                  TAURI_SIGNING_PRIVATE_KEY: ${{ github.ref_name == 'main' && secrets.TAURI_SIGNING_PRIVATE_KEY || '' }}
                  TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ github.ref_name == 'main' && secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD || '' }}
              with:
                  projectPath: tauri
                  tauriScript: npx --yes @tauri-apps/cli@2
                  args: ${{ matrix.args }}
                  releaseId: ${{ needs.prepare.outputs.release_id }}
                  # given with the id for the addresses in `latest.json`
                  tagName: ${{ needs.prepare.outputs.draft_tag }}
                  uploadUpdaterJson: ${{ github.ref_name == 'main' }}

            # after the build, which gives the app the website it embeds
            - name: Test engine and app
              run: cargo test -p gpx-engine -p gpx-studio-desktop

    # `releases/latest`, which the updater reads, only changes here
    publish:
        needs: [prepare, build]
        runs-on: ubuntu-latest

        permissions:
            contents: write

        env:
            GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
            GH_REPO: ${{ github.repository }}
            DRAFT_TAG: ${{ needs.prepare.outputs.draft_tag }}

        steps:
            # the builds of the platforms add themselves to it in parallel, and could overwrite each other
            - name: Check updater file
              if: github.ref_name == 'main'
              run: |
                  gh release download "$DRAFT_TAG" --pattern latest.json
                  for platform in darwin-aarch64 darwin-x86_64 linux-x86_64 windows-x86_64; do
                      if ! jq -e --arg platform "$platform" '.platforms[$platform].signature | length > 0' latest.json; then
                          echo "::error::latest.json has no signed update for $platform"
                          exit 1
                      fi
                  done

            - name: Publish release
              if: github.ref_name == 'main'
              run: gh release edit "$DRAFT_TAG" --draft=false --latest

            - name: Replace beta release
              if: github.ref_name == 'dev'
              run: |
                  gh release delete desktop-beta --cleanup-tag --yes || true
                  gh release edit "$DRAFT_TAG" --tag desktop-beta --draft=false --prerelease --latest=false