build.yml

name: Build artifacts and attach to release

on:
    release:
        types: [published]

concurrency:
    group: "build"
    cancel-in-progress: true

jobs:
    buildWindows:
        name: Build windows artifacts and attach to release
        runs-on: win11
        permissions:
            contents: write
        env:
            SIGN_TOKEN_ALIAS: ${{ secrets.SIGN_TOKEN_ALIAS }}
            SIGN_TOKEN_PASS: ${{ secrets.SIGN_TOKEN_PASS }}
            ELECTRON_BUILDER_CACHE: "C:\\actions-runner\\cache\\builder"
            ELECTRON_BUILDER_DOWNLOAD_PATH: "C:\\actions-runner\\cache\\electron"
        steps:
            - name: Checkout
              uses: actions/checkout@v4
            - name: Set up Node
              uses: actions/setup-node@v4
              with:
                  node-version: 20
                  cache: "npm"
            - name: Clear builder cache
              run: |
                  if (Test-Path "$env:ELECTRON_BUILDER_CACHE") {
                    Remove-Item -Recurse -Force "$env:ELECTRON_BUILDER_CACHE"
                  }

                  if (Test-Path "$env:ELECTRON_BUILDER_DOWNLOAD_PATH") {
                    Remove-Item -Recurse -Force "$env:ELECTRON_BUILDER_DOWNLOAD_PATH"
                  }
            - name: Install dependencies
              run: npm install --package-lock-only; npm ci
            - name: Install prebuilts
              run: npm install @parcel/watcher-win32-ia32@latest @parcel/watcher-win32-x64@latest @parcel/watcher-win32-arm64@latest --force
            - name: Build
              run: npm run build:win
              env:
                  SIGN_TOKEN_ALIAS: ${{ secrets.SIGN_TOKEN_ALIAS }}
                  SIGN_TOKEN_PASS: ${{ secrets.SIGN_TOKEN_PASS }}
            - name: Generate SHA256 hashes
              run: |
                  Get-ChildItem prod -File | ForEach-Object {
                    $hash = CertUtil -hashfile $_.FullName SHA256 | Select-String -Pattern "^[0-9a-fA-F]{64}$"
                    $hash -replace "\s+", "" | Out-File "$($_.FullName).sha256.txt"
                  }
            - name: Generate update hashes
              run: npm run build:hashes
            - name: Attach artifacts to release
              uses: softprops/action-gh-release@v2
              with:
                  files: |
                      prod/Filen_win.exe
                      prod/Filen_win.exe.sha256.txt
                      prod/Filen_win.exe.blockmap
                      prod/Filen_win.exe.blockmap.sha256.txt
                      prod/Filen_win_arm64.exe
                      prod/Filen_win_arm64.exe.sha256.txt
                      prod/Filen_win_arm64.exe.blockmap
                      prod/Filen_win_arm64.exe.blockmap.sha256.txt
                      prod/Filen_win_arm64.zip
                      prod/Filen_win_arm64.zip.sha256.txt
                      prod/Filen_win_x64.exe
                      prod/Filen_win_x64.exe.sha256.txt
                      prod/Filen_win_x64.exe.blockmap
                      prod/Filen_win_x64.exe.blockmap.sha256.txt
                      prod/Filen_win_x64.zip
                      prod/Filen_win_x64.zip.sha256.txt
                      prod/latest.yml
                      prod/latest.yml.sha256.txt
            - name: Cleanup
              run: npm run clear

    buildLinux:
        name: Build linux artifacts and attach to release
        runs-on: ubuntu-latest
        permissions:
            contents: write
        env:
            ELECTRON_BUILDER_CACHE: "/tmp/electron-builder"
            ELECTRON_BUILDER_DOWNLOAD_PATH: "/tmp/electron"
        steps:
            - name: Checkout
              uses: actions/checkout@v4
            - name: Set up Node
              uses: actions/setup-node@v4
              with:
                  node-version: 20
                  cache: "npm"
            - name: Clear builder cache
              run: |
                  if [ -d "$ELECTRON_BUILDER_CACHE" ]; then
                      rm -rf $ELECTRON_BUILDER_CACHE
                  fi

                  if [ -d "$ELECTRON_BUILDER_DOWNLOAD_PATH" ]; then
                      rm -rf $ELECTRON_BUILDER_DOWNLOAD_PATH
                  fi
            - name: Install dependencies
              run: npm install --package-lock-only && npm ci
            - name: Install prebuilts
              run: npm install @parcel/watcher-linux-x64-glibc@latest @parcel/watcher-linux-x64-musl@latest @parcel/watcher-linux-arm64-musl@latest @parcel/watcher-linux-arm64-glibc@latest @parcel/watcher-linux-arm-glibc@latest @parcel/watcher-linux-arm-musl@latest --force
            - name: Build
              run: npm run build:linux
            - name: Generate SHA256 hashes
              run: |
                  for file in prod/*; do
                    if [ -f "$file" ]; then
                      sha256sum "$file" | awk '{print $1}' > "$file.sha256.txt"
                    fi
                  done
            - name: Generate update hashes
              run: npm run build:hashes
            - name: Attach artifacts to release
              uses: softprops/action-gh-release@v2
              with:
                  files: |
                      prod/Filen_linux_aarch64.rpm
                      prod/Filen_linux_amd64.deb
                      prod/Filen_linux_arm64.AppImage
                      prod/Filen_linux_arm64.deb
                      prod/Filen_linux_arm64.zip
                      prod/Filen_linux_x64.zip
                      prod/Filen_linux_x86_64.AppImage
                      prod/Filen_linux_x86_64.rpm
                      prod/latest-linux-arm64.yml
                      prod/latest-linux.yml
                      prod/Filen_linux_aarch64.rpm.sha256.txt
                      prod/Filen_linux_amd64.deb.sha256.txt
                      prod/Filen_linux_arm64.AppImage.sha256.txt
                      prod/Filen_linux_arm64.deb.sha256.txt
                      prod/Filen_linux_arm64.zip.sha256.txt
                      prod/Filen_linux_x64.zip.sha256.txt
                      prod/Filen_linux_x86_64.AppImage.sha256.txt
                      prod/Filen_linux_x86_64.rpm.sha256.txt
                      prod/latest-linux-arm64.yml.sha256.txt
                      prod/latest-linux.yml.sha256.txt
            - name: Cleanup
              run: npm run clear

    buildMac:
        name: Build macOS artifacts and attach to release
        runs-on: macos-latest
        permissions:
            contents: write
        env:
            APPLE_DEVELOPER_ID_CERT: ${{ secrets.APPLE_DEVELOPER_ID_CERT }}
            APPLE_DEVELOPER_ID_CERT_PASS: ${{ secrets.APPLE_DEVELOPER_ID_CERT_PASS }}
            APPLE_NOTARIZE_ID: ${{ secrets.APPLE_NOTARIZE_ID }}
            APPLE_NOTARIZE_PASS: ${{ secrets.APPLE_NOTARIZE_PASS }}
            APPLE_NOTARIZE_TEAM_ID: ${{ secrets.APPLE_NOTARIZE_TEAM_ID }}
            ELECTRON_BUILDER_CACHE: "/tmp/electron-builder-cache"
            ELECTRON_BUILDER_DOWNLOAD_PATH: "/tmp/electron-download"
        steps:
            - name: Checkout
              uses: actions/checkout@v4
            - name: Set up Node
              uses: actions/setup-node@v4
              with:
                  node-version: 20
                  cache: "npm"
            - name: Clear builder cache
              run: |
                  if [ -d "$ELECTRON_BUILDER_CACHE" ]; then
                      rm -rf $ELECTRON_BUILDER_CACHE
                  fi

                  if [ -d "$ELECTRON_BUILDER_DOWNLOAD_PATH" ]; then
                      rm -rf $ELECTRON_BUILDER_DOWNLOAD_PATH
                  fi
            - name: Install dependencies
              run: npm install --package-lock-only && npm ci
            - name: Install prebuilts
              run: npm install @parcel/watcher-darwin-arm64@latest @parcel/watcher-darwin-x64@latest --force
            - name: Decode macOS certificate
              run: |
                  echo "$APPLE_DEVELOPER_ID_CERT" | base64 --decode > certificate.p12
            - name: Import certificate to keychain
              run: |
                  security create-keychain -p actions build.keychain
                  security import certificate.p12 -k ~/Library/Keychains/build.keychain -P "$APPLE_DEVELOPER_ID_CERT_PASS" -T /usr/bin/codesign
                  security list-keychains -d user -s ~/Library/Keychains/build.keychain
                  security set-keychain-settings -t 3600 -u ~/Library/Keychains/build.keychain
                  security unlock-keychain -p actions ~/Library/Keychains/build.keychain
                  security set-key-partition-list -S apple-tool:,apple: -s -k actions ~/Library/Keychains/build.keychain
            - name: Build
              run: npm run build:mac
            - name: Generate SHA256 hashes
              run: |
                  for file in prod/*; do
                    if [ -f "$file" ]; then
                      shasum -a 256 "$file" | awk '{print $1}' > "$file.sha256.txt"
                    fi
                  done
            - name: Generate update hashes
              run: npm run build:hashes
            - name: Attach artifacts to release
              uses: softprops/action-gh-release@v2
              with:
                  files: |
                      prod/Filen_mac_x64.dmg
                      prod/Filen_mac_x64.dmg.sha256.txt
                      prod/Filen_mac_arm64.dmg
                      prod/Filen_mac_arm64.dmg.sha256.txt
                      prod/Filen_mac_x64.dmg.blockmap
                      prod/Filen_mac_x64.dmg.blockmap.sha256.txt
                      prod/Filen_mac_arm64.dmg.blockmap
                      prod/Filen_mac_arm64.dmg.blockmap.sha256.txt
                      prod/Filen_mac_x64.zip
                      prod/Filen_mac_x64.zip.sha256.txt
                      prod/Filen_mac_arm64.zip
                      prod/Filen_mac_arm64.zip.sha256.txt
                      prod/latest-mac.yml
                      prod/latest-mac.yml.sha256.txt
            - name: Cleanup keychain
              run: |
                  security delete-keychain build.keychain
                  rm -f certificate.p12
            - name: Cleanup
              run: npm run clear