native-release.yml

name: Build & Release Native App

on:
  push:
    tags: ["native-v*"]
  workflow_dispatch:
    inputs:
      tag:
        description: "Release tag (e.g. native-v0.1.0). Leave blank for a dry-run build with no release."
        required: false

permissions:
  contents: write

concurrency:
  group: native-release
  cancel-in-progress: true

jobs:
  test:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v5
      - uses: actions/setup-node@v5
        with:
          node-version: 24
          cache: npm
      - run: npm ci
      - run: npm test

  build:
    needs: test
    strategy:
      fail-fast: false
      matrix:
        include:
          - os: macos-latest
            target: aarch64-apple-darwin
            label: mac-arm64
          - os: macos-latest
            target: x86_64-apple-darwin
            label: mac-x64
          - os: ubuntu-latest
            target: x86_64-unknown-linux-gnu
            label: linux-x64
          - os: windows-latest
            target: x86_64-pc-windows-msvc
            label: win-x64

    runs-on: ${{ matrix.os }}
    steps:
      - uses: actions/checkout@v5

      - uses: actions/setup-node@v5
        with:
          node-version: 24
          cache: npm

      - uses: dtolnay/rust-toolchain@stable
        with:
          targets: ${{ matrix.target }}

      - name: Install Linux dependencies
        if: runner.os == 'Linux'
        run: |
          sudo apt-get update
          sudo apt-get install -y libwebkit2gtk-4.1-dev libappindicator3-dev librsvg2-dev patchelf

      - run: npm ci

      - name: Set version from tag
        if: startsWith(github.ref, 'refs/tags/native-v') || github.event.inputs.tag != ''
        id: ver
        shell: bash
        run: |
          if [[ "${{ github.ref_type }}" == "tag" ]]; then
            TAG="${{ github.ref_name }}"
          else
            TAG="${{ github.event.inputs.tag }}"
          fi
          VERSION="${TAG#native-v}"
          echo "value=${VERSION}" >> "$GITHUB_OUTPUT"
          node -e "const fs=require('fs'),c=JSON.parse(fs.readFileSync('native/tauri.conf.json','utf8'));c.version='${VERSION}';fs.writeFileSync('native/tauri.conf.json',JSON.stringify(c,null,2)+'\n')"

      - name: Import Apple certificate
        if: runner.os == 'macOS'
        env:
          APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }}
          APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
        run: |
          CERT_PATH="$RUNNER_TEMP/apple_cert.p12"
          KEYCHAIN_PATH="$RUNNER_TEMP/app-signing.keychain-db"
          echo -n "$APPLE_CERTIFICATE" | base64 --decode -o "$CERT_PATH"
          security create-keychain -p "" "$KEYCHAIN_PATH"
          security set-keychain-settings -lut 21600 "$KEYCHAIN_PATH"
          security unlock-keychain -p "" "$KEYCHAIN_PATH"
          security import "$CERT_PATH" -P "$APPLE_CERTIFICATE_PASSWORD" -A -t cert -f pkcs12 -k "$KEYCHAIN_PATH"
          security set-key-partition-list -S apple-tool:,apple: -k "" "$KEYCHAIN_PATH"
          security list-keychain -d user -s "$KEYCHAIN_PATH"

      - name: Build Tauri app
        env:
          APPLE_SIGNING_IDENTITY: ${{ secrets.APPLE_SIGNING_IDENTITY }}
          APPLE_ID: ${{ secrets.APPLE_ID }}
          APPLE_PASSWORD: ${{ secrets.APPLE_PASSWORD }}
          APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
        run: npx tauri build --config native/tauri.conf.json --target ${{ matrix.target }}

      - name: Install Flatpak tools
        if: matrix.label == 'linux-x64'
        run: |
          sudo apt-get install -y flatpak flatpak-builder
          sudo flatpak remote-add --if-not-exists flathub https://dl.flathub.org/repo/flathub.flatpakrepo
          sudo flatpak install -y flathub org.gnome.Platform//47 org.gnome.Sdk//47

      - name: Stage Flatpak sources
        if: matrix.label == 'linux-x64'
        shell: bash
        run: |
          cp native/target/${{ matrix.target }}/release/terramap-native native/flatpak/terramap
          cp native/icons/32x32.png native/flatpak/32x32.png
          cp native/icons/128x128.png native/flatpak/128x128.png
          cp native/icons/128x128@2x.png native/flatpak/256x256.png
          VERSION="${{ steps.ver.outputs.value }}"
          if [ -n "$VERSION" ]; then
            sed -i "s|release version=\"[^\"]*\" date=\"[^\"]*\"|release version=\"${VERSION}\" date=\"$(date +%Y-%m-%d)\"|" native/flatpak/io.github.terramap.native.metainfo.xml
          fi

      - name: Build Flatpak bundle
        if: matrix.label == 'linux-x64'
        uses: bilelmoussaoui/flatpak-github-actions/flatpak-builder@v6
        with:
          bundle: TerraMap.flatpak
          manifest-path: native/flatpak/io.github.terramap.native.yml
          run-tests: false
          upload-artifact: false
          cache: true
          cache-key: flatpak-${{ hashFiles('native/flatpak/io.github.terramap.native.yml') }}

      - name: Rename artifacts
        shell: bash
        run: |
          VERSION=$(grep '"version"' native/tauri.conf.json | head -1 | sed 's/.*"version": *"\([^"]*\)".*/\1/')
          LABEL="${{ matrix.label }}"
          DEST="release-assets"
          mkdir -p "$DEST"
          BUNDLE="native/target/${{ matrix.target }}/release/bundle"
          for f in "$BUNDLE"/dmg/*.dmg; do
            [ -f "$f" ] && cp "$f" "$DEST/TerraMap-${VERSION}-${LABEL}.dmg"
          done
          for f in "$BUNDLE"/macos/*.app.tar.gz; do
            [ -f "$f" ] && cp "$f" "$DEST/TerraMap-${VERSION}-${LABEL}.app.tar.gz"
          done
          for f in "$BUNDLE"/appimage/*.AppImage; do
            [ -f "$f" ] && cp "$f" "$DEST/TerraMap-${VERSION}-${LABEL}.AppImage"
          done
          for f in "$BUNDLE"/deb/*.deb; do
            [ -f "$f" ] && cp "$f" "$DEST/TerraMap-${VERSION}-${LABEL}.deb"
          done
          for f in "$BUNDLE"/rpm/*.rpm; do
            [ -f "$f" ] && cp "$f" "$DEST/TerraMap-${VERSION}-${LABEL}.rpm"
          done
          for f in "$BUNDLE"/msi/*.msi; do
            [ -f "$f" ] && cp "$f" "$DEST/TerraMap-${VERSION}-${LABEL}.msi"
          done
          for f in "$BUNDLE"/nsis/*setup*.exe; do
            [ -f "$f" ] && cp "$f" "$DEST/TerraMap-${VERSION}-${LABEL}-setup.exe"
          done
          [ -f "TerraMap.flatpak" ] && cp "TerraMap.flatpak" "$DEST/TerraMap-${VERSION}-${LABEL}.flatpak"
          ls -la "$DEST/"

      - name: Upload artifacts
        if: matrix.label != 'win-x64'
        uses: actions/upload-artifact@v6
        with:
          name: TerraMap-${{ matrix.label }}
          path: release-assets/*

      - name: Upload unsigned Windows artifacts
        if: matrix.label == 'win-x64'
        uses: actions/upload-artifact@v6
        with:
          name: unsigned-TerraMap-win-x64
          path: release-assets/*

  sign-windows:
    needs: build
    if: ${{ !cancelled() }}
    runs-on: ubuntu-latest
    permissions:
      contents: read
      actions: read
    steps:
      - name: Find unsigned Windows artifact ID
        id: artifact
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          ID=$(gh api "repos/${{ github.repository }}/actions/runs/${{ github.run_id }}/artifacts" \
            --jq '.artifacts[] | select(.name=="unsigned-TerraMap-win-x64") | .id')
          if [ -z "$ID" ]; then
            echo "Could not find unsigned-TerraMap-win-x64 artifact" >&2
            exit 1
          fi
          echo "id=$ID" >> "$GITHUB_OUTPUT"

      - name: Submit signing request to SignPath
        uses: signpath/github-action-submit-signing-request@b9d91eadd323de506c0c81cf0c7fe7438f3360fd # v2
        with:
          api-token: ${{ secrets.SIGNPATH_API_TOKEN }}
          organization-id: ${{ vars.SIGNPATH_ORGANIZATION_ID }}
          project-slug: ${{ vars.SIGNPATH_PROJECT_SLUG }}
          signing-policy-slug: ${{ vars.SIGNPATH_POLICY_SLUG }}
          artifact-configuration-slug: ${{ vars.SIGNPATH_ARTIFACT_CONFIG_SLUG }}
          github-artifact-id: ${{ steps.artifact.outputs.id }}
          wait-for-completion: true
          output-artifact-directory: signed-windows

      - name: Upload signed Windows artifacts
        uses: actions/upload-artifact@v6
        with:
          name: TerraMap-win-x64
          path: signed-windows/*

  release:
    needs: [build, sign-windows]
    if: startsWith(github.ref, 'refs/tags/native-v') || github.event.inputs.tag != ''
    runs-on: ubuntu-latest
    steps:
      - uses: actions/download-artifact@v7
        with:
          pattern: TerraMap-*
          merge-multiple: true

      - name: Determine tag
        id: tag
        run: |
          if [[ "${{ github.ref_type }}" == "tag" ]]; then
            TAG="${{ github.ref_name }}"
          else
            TAG="${{ github.event.inputs.tag }}"
          fi
          echo "name=${TAG}" >> "$GITHUB_OUTPUT"
          echo "version=${TAG#native-}" >> "$GITHUB_OUTPUT"

      - name: Create GitHub Release
        uses: softprops/action-gh-release@v2
        with:
          tag_name: ${{ steps.tag.outputs.name }}
          name: TerraMap Native App ${{ steps.tag.outputs.version }}
          generate_release_notes: false
          append_body: true
          body: |
            TerraMap Native is a cross-platform, interactive Terraria v1.4.5 world map viewer that loads quickly and lets you pan, zoom, find blocks, ores, items in chests, dungeons, NPCs, etc.

            It's the same as the web app, but with a better experience for viewing worlds without spoilers.
            
            It makes it much easier than the web version to choose a world, then choose a player map for the chosen world. Only the parts of the world that have been seen by the player are then shown in TerraMap.

            ## Installation
            - **macOS**: Download the `.dmg` file for your processor, open it, and drag TerraMap to Applications.
              - aarch64: Apple Silicon
              - x64: Intel Silicon
            - **Linux**: Download the package format for your distro.
              - .flatpak: Universal, recommended for Steam Deck and any Flatpak-enabled distro. Install with `flatpak install TerraMap-*.flatpak`
              - .AppImage: Universal, runs on any distro (self-contained, no install needed)
              - .deb: Debian, Ubuntu, Mint, Pop!_OS, etc.
              - .rpm: Fedora, RHEL, CentOS, openSUSE, etc.
            - **Windows**: Download and run the `.msi` installer or `setup.exe` (NSIS) installer file.

          files: |
            **/*.dmg
            **/*.app.tar.gz
            **/*.flatpak
            **/*.AppImage
            **/*.deb
            **/*.rpm
            **/*.exe
            **/*.msi