fork-release.yml

name: Fork release

# Publishes installers for this fork as a GitHub Release on every push to main.
# release.yml needs upstream's signing identities and
# deploy secrets, so this reuses only its per-platform packaging
# (release-desktop.yml) on GitHub-hosted runners.

on:
  push:
    branches: [main]
  workflow_dispatch:
    inputs:
      publish:
        description: Publish a signed nightly release (leave off to validate packaging only)
        type: boolean
        default: false
      macos_arm64_only:
        description: Build only the signed macOS arm64 installer for PR validation
        type: boolean
        default: false

concurrency:
  group: ${{ github.event_name == 'workflow_dispatch' && !inputs.publish && format('fork-nightly-validation-{0}-{1}', github.ref, inputs.macos_arm64_only) || 'fork-nightly-release' }}
  cancel-in-progress: true

permissions:
  # release-desktop.yml's Windows job lists this run's artifacts to wait for the
  # Linux CLI archive it embeds.
  actions: read
  contents: read

jobs:
  bundle:
    name: Build JS bundle
    if: github.repository != 'pingdotgg/t3code'
    runs-on: ubuntu-24.04
    timeout-minutes: 60
    outputs:
      version: ${{ steps.meta.outputs.version }}
      clerk_publishable_key: ${{ steps.meta.outputs.clerk_publishable_key }}
      clerk_jwt_template: ${{ steps.meta.outputs.clerk_jwt_template }}
      clerk_cli_oauth_client_id: ${{ steps.meta.outputs.clerk_cli_oauth_client_id }}
      relay_url: ${{ steps.meta.outputs.relay_url }}
    steps:
      # checkout's credential cleanup runs submodule foreach, which fails on the
      # orphaned gitlinks in the vendored .repos tree.
      - name: Checkout
        shell: bash
        env:
          GIT_TERMINAL_PROMPT: "0"
        run: |
          set -euo pipefail
          git init .
          git remote add origin "${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}.git"
          git fetch --no-tags --depth=1 origin "$GITHUB_SHA"
          git sparse-checkout set --no-cone '/*' '!/.repos/'
          git checkout --detach FETCH_HEAD

      - name: Setup Vite+
        uses: voidzero-dev/setup-vp@250f29ce396baf5e8f24498e17c0dfdebabc26eb # v1
        with:
          node-version-file: package.json
          cache: true
          run-install: false

      - name: Install bundle dependencies
        run: vp install --filter=t3... --filter=@t3tools/web... --filter=@t3tools/desktop... --filter=@t3tools/scripts...

      # .env.example holds the public T3 Connect identifiers that official
      # builds bake in. release-desktop.yml takes them as inputs.
      - id: meta
        name: Resolve version and public configuration
        shell: bash
        run: |
          set -euo pipefail
          version="$(node scripts/resolve-nightly-release.ts \
            --date "$(date -u +%Y%m%d)" \
            --run-number "$GITHUB_RUN_NUMBER" \
            --sha "$GITHUB_SHA" | sed -n 's/^version=//p')"
          node scripts/update-release-package-versions.ts "$version"
          echo "version=$version" >> "$GITHUB_OUTPUT"

          cp .env.example .env
          for key in clerk_publishable_key:T3CODE_CLERK_PUBLISHABLE_KEY clerk_jwt_template:T3CODE_CLERK_JWT_TEMPLATE clerk_cli_oauth_client_id:T3CODE_CLERK_CLI_OAUTH_CLIENT_ID relay_url:T3CODE_RELAY_URL; do
            value="$(sed -n "s/^${key##*:}=//p" .env.example | head -n 1)"
            echo "${key%%:*}=${value}" >> "$GITHUB_OUTPUT"
          done

      - uses: ./.github/actions/setup-apt-mirrors

      - name: Install browser secret helper build libraries
        run: sudo apt-get update && sudo apt-get install -y libsecret-1-dev pkg-config

      - name: Setup Rust for server addons
        uses: dtolnay/rust-toolchain@6bed0761d98439e5a578e2877258200ad565ba87 # stable
        with:
          toolchain: stable

      - name: Build JS bundle
        run: vp run build:desktop

      # Same layout as release.yml's js-bundle so release-desktop.yml can
      # package it unchanged.
      - name: Upload JS bundle
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        with:
          name: js-bundle
          path: |
            apps/server/dist
            apps/desktop/dist-electron
          if-no-files-found: error
          retention-days: 1

  desktop:
    name: Desktop
    needs: bundle
    if: ${{ !inputs.macos_arm64_only || inputs.publish }}
    strategy:
      fail-fast: false
      matrix:
        include:
          - label: macOS arm64
            runner: macos-26
            platform: mac
            target: dmg
            arch: arm64
            rust_target: aarch64-apple-darwin
            resource_key: darwin-arm64
          - label: macOS x64
            runner: macos-26
            platform: mac
            target: dmg
            arch: x64
            rust_target: x86_64-apple-darwin
            resource_key: darwin-x64
          # The Windows job waits for this job's CLI archive by its label.
          - label: Linux x64
            runner: ubuntu-24.04
            platform: linux
            target: AppImage
            arch: x64
            rust_target: x86_64-unknown-linux-gnu
            resource_key: linux-x64
          - label: Linux arm64
            runner: ubuntu-24.04-arm
            platform: linux
            target: AppImage
            arch: arm64
            rust_target: aarch64-unknown-linux-gnu
            resource_key: linux-arm64
          - label: Windows x64
            runner: windows-2025
            platform: win
            target: nsis
            arch: x64
            rust_target: x86_64-pc-windows-msvc
            resource_key: win32-x64
          - label: Windows arm64
            runner: windows-11-arm
            platform: win
            target: nsis
            arch: arm64
            rust_target: aarch64-pc-windows-msvc
            resource_key: win32-arm64
    uses: ./.github/workflows/release-desktop.yml
    secrets: inherit
    with:
      version: ${{ needs.bundle.outputs.version }}
      ref: ${{ github.sha }}
      release_channel: nightly
      require_macos_signing: ${{ github.event_name == 'push' || inputs.publish }}
      relay_client_tracing: false
      clerk_publishable_key: ${{ needs.bundle.outputs.clerk_publishable_key }}
      clerk_jwt_template: ${{ needs.bundle.outputs.clerk_jwt_template }}
      clerk_cli_oauth_client_id: ${{ needs.bundle.outputs.clerk_cli_oauth_client_id }}
      relay_url: ${{ needs.bundle.outputs.relay_url }}
      label: ${{ matrix.label }}
      runner: ${{ matrix.runner }}
      platform: ${{ matrix.platform }}
      target: ${{ matrix.target }}
      arch: ${{ matrix.arch }}
      rust_target: ${{ matrix.rust_target }}
      resource_key: ${{ matrix.resource_key }}
      cli_archive: ${{ matrix.platform != 'mac' || matrix.arch != 'x64' }}

  desktop_mac_arm64:
    name: Desktop macOS arm64 PR validation
    needs: bundle
    if: ${{ github.event_name == 'workflow_dispatch' && inputs.macos_arm64_only && !inputs.publish }}
    uses: ./.github/workflows/release-desktop.yml
    secrets: inherit
    with:
      version: ${{ needs.bundle.outputs.version }}
      ref: ${{ github.sha }}
      release_channel: nightly
      require_macos_signing: true
      relay_client_tracing: false
      clerk_publishable_key: ${{ needs.bundle.outputs.clerk_publishable_key }}
      clerk_jwt_template: ${{ needs.bundle.outputs.clerk_jwt_template }}
      clerk_cli_oauth_client_id: ${{ needs.bundle.outputs.clerk_cli_oauth_client_id }}
      relay_url: ${{ needs.bundle.outputs.relay_url }}
      label: macOS arm64
      runner: macos-26
      platform: mac
      target: dmg
      arch: arm64
      rust_target: aarch64-apple-darwin
      resource_key: darwin-arm64
      cli_archive: true

  publish:
    name: Prepare and publish GitHub Release
    needs: [bundle, desktop]
    runs-on: ubuntu-24.04
    timeout-minutes: 15
    permissions:
      contents: write
    steps:
      - name: Checkout
        shell: bash
        run: |
          set -euo pipefail
          git init .
          git remote add origin "${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}.git"
          git fetch --no-tags --depth=1 origin "$GITHUB_SHA"
          git sparse-checkout set --no-cone '/*' '!/.repos/'
          git checkout --detach FETCH_HEAD

      - uses: ./.github/actions/setup-ci-deps
        with:
          install-args: --filter=@t3tools/scripts...

      - name: Download desktop installers
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
        with:
          pattern: desktop-*
          path: assets
          merge-multiple: true

      - name: Download CLI archives
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
        with:
          pattern: cli-*
          path: assets
          merge-multiple: true

      - name: Prepare updater metadata and checksums
        shell: bash
        env:
          VERSION: ${{ needs.bundle.outputs.version }}
        run: |
          set -euo pipefail
          node scripts/build-release-metadata.ts --version "$VERSION" --output-dir assets
          node scripts/merge-update-manifests.ts --platform mac assets/nightly-mac.yml assets/nightly-mac-x64.yml
          node scripts/merge-update-manifests.ts --platform win assets/nightly-win-x64.yml assets/nightly-win-arm64.yml assets/nightly.yml
          cd assets
          rm nightly-mac-x64.yml nightly-win-x64.yml nightly-win-arm64.yml
          for manifest in nightly.yml nightly-mac.yml nightly-linux.yml nightly-linux-arm64.yml; do
            test -s "$manifest"
          done
          rm -f builder-debug.yml
          shopt -s nullglob
          archives=(t3-*.tar.gz t3-*.zip T3-Code-*.dmg T3-Code-*.zip T3-Code-*.exe T3-Code-*.AppImage T3-Code-*.deb)
          shopt -u nullglob
          if [[ ${#archives[@]} -eq 0 ]]; then
            echo "No release archives were produced." >&2
            exit 1
          fi
          sha256sum "${archives[@]}" > SHA256SUMS
          cat SHA256SUMS

      - name: Publish release
        if: github.event_name == 'push' || inputs.publish
        shell: bash
        env:
          GH_TOKEN: ${{ github.token }}
          VERSION: ${{ needs.bundle.outputs.version }}
        run: |
          set -euo pipefail
          short_sha="${GITHUB_SHA:0:12}"
          cat > notes.md <<EOF
          Built from ${GITHUB_REPOSITORY}@${short_sha}.

          Desktop updates come from this fork's GitHub Releases. Keep the app's update channel set to Nightly.

          - **macOS:** install the signed, notarized app from the \`.dmg\`.
          - **Windows:** run the \`.exe\` installer.
          - **Linux:** make the \`.AppImage\` executable, then run it.
          - **CLI / headless server:** extract the \`t3\` archive for your platform.

          Older preview/source builds have no update feed. Install this release once; subsequent nightly releases are available through the app's Update control.
          EOF
          release_assets=()
          for asset in assets/*; do
            if [[ -f "$asset" ]]; then
              release_assets+=("$asset")
            fi
          done
          gh release create "v${VERSION}" "${release_assets[@]}" \
            --repo "$GITHUB_REPOSITORY" \
            --target "$GITHUB_SHA" \
            --title "T3 Code ${VERSION}" \
            --notes-file notes.md \
            --prerelease