release-portable.yml

name: CI/CD Desktop Releases

on:
  push:
    branches:
      - main

permissions:
  contents: read

concurrency:
  group: release-main
  cancel-in-progress: false

jobs:
  quality:
    name: Lint and audit
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
        with:
          persist-credentials: false

      - name: Setup Python
        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405
        with:
          python-version: "3.12"

      - name: Setup uv
        uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b
        with:
          enable-cache: true

      - name: Setup Node.js
        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e
        with:
          node-version: "22"
          cache: npm
          cache-dependency-path: |
            bdgen/web/package-lock.json
            bdgen/desktop/package-lock.json

      - name: Install backend dependencies
        run: uv sync
        working-directory: bdgen
        env:
          UV_PROJECT_ENVIRONMENT: ../.venv

      - name: Install frontend dependencies
        run: npm ci
        working-directory: bdgen/web

      - name: Install desktop dependencies
        run: npm ci
        working-directory: bdgen/desktop

      - name: Run all linters
        run: make lint

      - name: Audit frontend dependencies
        run: npm audit
        working-directory: bdgen/web

      - name: Audit desktop dependencies
        run: npm audit
        working-directory: bdgen/desktop

  test:
    name: Tests
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
        with:
          persist-credentials: false

      - name: Setup Python
        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405
        with:
          python-version: "3.12"

      - name: Setup uv
        uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b
        with:
          enable-cache: true

      - name: Setup Node.js
        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e
        with:
          node-version: "22"
          cache: npm
          cache-dependency-path: bdgen/web/package-lock.json

      - name: Install backend dependencies
        run: uv sync
        working-directory: bdgen
        env:
          UV_PROJECT_ENVIRONMENT: ../.venv

      - name: Install frontend dependencies
        run: npm ci
        working-directory: bdgen/web

      - name: Run backend tests
        run: uv run pytest
        working-directory: bdgen
        env:
          UV_PROJECT_ENVIRONMENT: ../.venv

      - name: Run frontend tests
        run: npm test
        working-directory: bdgen/web

  version:
    name: Compute release version
    runs-on: ubuntu-latest
    needs:
      - quality
      - test
    outputs:
      version: ${{ steps.version.outputs.version }}
      tag: ${{ steps.version.outputs.tag }}
      tag_exists: ${{ steps.version.outputs.tag_exists }}
    steps:
      - name: Checkout
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
        with:
          fetch-depth: 0
          persist-credentials: false

      - name: Compute next SemVer
        id: version
        shell: pwsh
        run: |
          $tags = git tag --list "v[0-9]*" | Where-Object { $_ -match '^v\d+\.\d+\.\d+$' } | Sort-Object { [version]($_.Substring(1)) }
          $headTag = git tag --points-at HEAD --list "v[0-9]*" | Where-Object { $_ -match '^v\d+\.\d+\.\d+$' } | Sort-Object { [version]($_.Substring(1)) } | Select-Object -Last 1

          if ($headTag) {
            $version = $headTag.Substring(1)
            "version=$version" >> $env:GITHUB_OUTPUT
            "tag=$headTag" >> $env:GITHUB_OUTPUT
            "tag_exists=true" >> $env:GITHUB_OUTPUT
            exit 0
          }

          $lastTag = $tags | Select-Object -Last 1
          if ($lastTag) {
            $base = [version]$lastTag.Substring(1)
            $messages = git log --format=%B "$lastTag..HEAD"
          } else {
            $package = Get-Content -Raw "bdgen/desktop/package.json" | ConvertFrom-Json
            $base = [version]$package.version
            $messages = git log --format=%B
          }

          $bump = "patch"
          if ($messages -match "(?m)^BREAKING CHANGE:" -or $messages -match "(?m)^[a-zA-Z]+(\([^)]+\))?!:") {
            $bump = "major"
          } elseif ($messages -match "(?m)^feat(\([^)]+\))?:") {
            $bump = "minor"
          }

          if ($bump -eq "major") {
            $version = "$($base.Major + 1).0.0"
          } elseif ($bump -eq "minor") {
            $version = "$($base.Major).$($base.Minor + 1).0"
          } else {
            $version = "$($base.Major).$($base.Minor).$($base.Build + 1)"
          }

          "version=$version" >> $env:GITHUB_OUTPUT
          "tag=v$version" >> $env:GITHUB_OUTPUT
          "tag_exists=false" >> $env:GITHUB_OUTPUT

  tag-release:
    name: Create release tag
    runs-on: ubuntu-latest
    needs: version
    permissions:
      contents: write
    steps:
      - name: Checkout
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
        with:
          fetch-depth: 0
          persist-credentials: true

      - name: Create git tag
        if: needs.version.outputs.tag_exists == 'false'
        env:
          TAG: ${{ needs.version.outputs.tag }}
        run: |
          git config user.name "github-actions[bot]"
          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
          git tag "$TAG"
          git push origin "refs/tags/$TAG"

  build-desktop:
    name: Build ${{ matrix.label }}
    runs-on: ${{ matrix.os }}
    needs:
      - version
      - tag-release
    strategy:
      fail-fast: false
      matrix:
        include:
          - platform: windows
            label: Windows portable exe
            os: windows-latest
            build_script: build:windows
            backend_binary: ../build/backend/bdgen-server.exe
            artifact_name: windows-portable
            artifact_path: build/portable/*.exe
          - platform: macos
            label: unsigned macOS DMG
            os: macos-latest
            build_script: build:mac
            backend_binary: ../build/backend/bdgen-server
            artifact_name: macos-dmg-unsigned
            artifact_path: build/mac/*.dmg
          - platform: linux
            label: Linux AppImage
            os: ubuntu-latest
            build_script: build:linux
            backend_binary: ../build/backend/bdgen-server
            artifact_name: linux-appimage
            artifact_path: build/linux/*.AppImage
    steps:
      - name: Checkout
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
        with:
          persist-credentials: false

      - name: Setup Python
        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405
        with:
          python-version: "3.12"

      - name: Setup uv
        uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b
        with:
          enable-cache: true

      - name: Setup Node.js
        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e
        with:
          node-version: "22"
          cache: npm
          cache-dependency-path: |
            bdgen/web/package-lock.json
            bdgen/desktop/package-lock.json

      - name: Apply desktop package version
        shell: pwsh
        env:
          VERSION: ${{ needs.version.outputs.version }}
        run: npm version $env:VERSION --no-git-tag-version --allow-same-version
        working-directory: bdgen/desktop

      - name: Install backend dependencies
        run: uv sync
        working-directory: bdgen
        env:
          UV_PROJECT_ENVIRONMENT: ../.venv

      - name: Build frontend static assets
        run: |
          npm ci
          npm run build
        working-directory: bdgen/web

      - name: Build backend executable
        shell: pwsh
        run: |
          uv run pyinstaller --distpath ../build/backend --workpath ../build/pyinstaller-work bdgen-server.spec
          if (!(Test-Path -LiteralPath "${{ matrix.backend_binary }}")) {
            throw "Missing backend executable: ${{ matrix.backend_binary }}"
          }
          if ("${{ matrix.platform }}" -ne "windows") {
            chmod +x "${{ matrix.backend_binary }}"
          }
          if ("${{ matrix.platform }}" -eq "macos") {
            codesign --force --sign - "${{ matrix.backend_binary }}"
          }
        working-directory: bdgen
        env:
          UV_PROJECT_ENVIRONMENT: ../.venv

      - name: Build desktop artifact
        run: |
          npm ci
          npm run ${{ matrix.build_script }}
        working-directory: bdgen/desktop
        env:
          CSC_IDENTITY_AUTO_DISCOVERY: "false"

      - name: Upload workflow artifact
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02
        with:
          name: BdGEN-${{ needs.version.outputs.version }}-${{ matrix.artifact_name }}
          path: ${{ matrix.artifact_path }}
          if-no-files-found: error

  publish-release:
    name: Publish GitHub release
    runs-on: ubuntu-latest
    needs:
      - version
      - tag-release
      - build-desktop
    permissions:
      contents: write
    steps:
      - name: Checkout
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
        with:
          fetch-depth: 0
          persist-credentials: false

      - name: Download release artifacts
        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093
        with:
          path: release-artifacts
          merge-multiple: true

      - name: Publish GitHub release
        env:
          GH_TOKEN: ${{ github.token }}
          TAG: ${{ needs.version.outputs.tag }}
          VERSION: ${{ needs.version.outputs.version }}
        run: |
          shopt -s nullglob
          assets=(release-artifacts/*.exe release-artifacts/*.dmg release-artifacts/*.AppImage exemple.bdgen)
          if [ ${#assets[@]} -eq 0 ]; then
            echo "No release assets found." >&2
            exit 1
          fi

          notes=$(cat <<EOF
          Automated desktop release for BdGEN $VERSION.

          Quality gates:
          - Backend (pytest) and frontend (vitest) tests passed.
          - Backend, frontend and desktop lint passed.
          - Frontend and desktop npm audit passed with no vulnerabilities.

          Artifacts:
          - Windows portable executable.
          - Unsigned macOS DMG.
          - Linux AppImage.
          - Bundled example project archive (exemple.bdgen).

          Note: the macOS DMG is not signed or notarized yet, so Gatekeeper may warn on first launch.
          EOF
          )

          if gh release view "$TAG" >/dev/null 2>&1; then
            gh release upload "$TAG" "${assets[@]}" --clobber
          else
            gh release create "$TAG" "${assets[@]}" --title "BdGEN $VERSION" --notes "$notes"
          fi