Aperant/.github/workflows/release.yml

name: Release

on:
  push:
    tags:
      - 'v*'
  workflow_dispatch:
    inputs:
      dry_run:
        description: 'Test build without creating release'
        required: false
        default: true
        type: boolean

jobs:
  # Intel build on Intel runner for native compilation
  # Note: macos-15-intel is the last Intel runner, supported until Fall 2027
  build-macos-intel:
    runs-on: macos-15-intel
    steps:
      - uses: actions/checkout@v4

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: '20'

      - name: Setup pnpm
        uses: pnpm/action-setup@v4
        with:
          version: 10

      - name: Get pnpm store directory
        id: pnpm-cache
        run: echo "dir=$(pnpm store path)" >> $GITHUB_OUTPUT

      - uses: actions/cache@v4
        with:
          path: ${{ steps.pnpm-cache.outputs.dir }}
          key: ${{ runner.os }}-x64-pnpm-${{ hashFiles('**/pnpm-lock.yaml') }}
          restore-keys: ${{ runner.os }}-x64-pnpm-

      - name: Install dependencies
        run: cd auto-claude-ui && pnpm install --frozen-lockfile

      - name: Build application
        run: cd auto-claude-ui && pnpm run build

      - name: Package macOS (Intel)
        run: cd auto-claude-ui && pnpm run package:mac -- --arch=x64
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          CSC_LINK: ${{ secrets.MAC_CERTIFICATE }}
          CSC_KEY_PASSWORD: ${{ secrets.MAC_CERTIFICATE_PASSWORD }}

      - name: Notarize macOS Intel app
        env:
          APPLE_ID: ${{ secrets.APPLE_ID }}
          APPLE_APP_SPECIFIC_PASSWORD: ${{ secrets.APPLE_APP_SPECIFIC_PASSWORD }}
          APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
        run: |
          if [ -z "$APPLE_ID" ]; then
            echo "Skipping notarization: APPLE_ID not configured"
            exit 0
          fi
          cd auto-claude-ui
          for dmg in dist/*.dmg; do
            echo "Notarizing $dmg..."
            xcrun notarytool submit "$dmg" \
              --apple-id "$APPLE_ID" \
              --password "$APPLE_APP_SPECIFIC_PASSWORD" \
              --team-id "$APPLE_TEAM_ID" \
              --wait
            xcrun stapler staple "$dmg"
            echo "Successfully notarized and stapled $dmg"
          done

      - name: Upload artifacts
        uses: actions/upload-artifact@v4
        with:
          name: macos-intel-builds
          path: |
            auto-claude-ui/dist/*.dmg
            auto-claude-ui/dist/*.zip

  # Apple Silicon build on ARM64 runner for native compilation
  build-macos-arm64:
    runs-on: macos-15
    steps:
      - uses: actions/checkout@v4

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: '20'

      - name: Setup pnpm
        uses: pnpm/action-setup@v4
        with:
          version: 10

      - name: Get pnpm store directory
        id: pnpm-cache
        run: echo "dir=$(pnpm store path)" >> $GITHUB_OUTPUT

      - uses: actions/cache@v4
        with:
          path: ${{ steps.pnpm-cache.outputs.dir }}
          key: ${{ runner.os }}-arm64-pnpm-${{ hashFiles('**/pnpm-lock.yaml') }}
          restore-keys: ${{ runner.os }}-arm64-pnpm-

      - name: Install dependencies
        run: cd auto-claude-ui && pnpm install --frozen-lockfile

      - name: Build application
        run: cd auto-claude-ui && pnpm run build

      - name: Package macOS (Apple Silicon)
        run: cd auto-claude-ui && pnpm run package:mac -- --arch=arm64
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          CSC_LINK: ${{ secrets.MAC_CERTIFICATE }}
          CSC_KEY_PASSWORD: ${{ secrets.MAC_CERTIFICATE_PASSWORD }}

      - name: Notarize macOS ARM64 app
        env:
          APPLE_ID: ${{ secrets.APPLE_ID }}
          APPLE_APP_SPECIFIC_PASSWORD: ${{ secrets.APPLE_APP_SPECIFIC_PASSWORD }}
          APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
        run: |
          if [ -z "$APPLE_ID" ]; then
            echo "Skipping notarization: APPLE_ID not configured"
            exit 0
          fi
          cd auto-claude-ui
          for dmg in dist/*.dmg; do
            echo "Notarizing $dmg..."
            xcrun notarytool submit "$dmg" \
              --apple-id "$APPLE_ID" \
              --password "$APPLE_APP_SPECIFIC_PASSWORD" \
              --team-id "$APPLE_TEAM_ID" \
              --wait
            xcrun stapler staple "$dmg"
            echo "Successfully notarized and stapled $dmg"
          done

      - name: Upload artifacts
        uses: actions/upload-artifact@v4
        with:
          name: macos-arm64-builds
          path: |
            auto-claude-ui/dist/*.dmg
            auto-claude-ui/dist/*.zip

  build-windows:
    runs-on: windows-latest
    steps:
      - uses: actions/checkout@v4

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: '20'

      - name: Setup pnpm
        uses: pnpm/action-setup@v4
        with:
          version: 10

      - name: Get pnpm store directory
        id: pnpm-cache
        shell: bash
        run: echo "dir=$(pnpm store path)" >> $GITHUB_OUTPUT

      - uses: actions/cache@v4
        with:
          path: ${{ steps.pnpm-cache.outputs.dir }}
          key: ${{ runner.os }}-pnpm-${{ hashFiles('**/pnpm-lock.yaml') }}
          restore-keys: ${{ runner.os }}-pnpm-

      - name: Install dependencies
        run: cd auto-claude-ui && pnpm install --frozen-lockfile

      - name: Build application
        run: cd auto-claude-ui && pnpm run build

      - name: Package Windows
        run: cd auto-claude-ui && pnpm run package:win
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          CSC_LINK: ${{ secrets.WIN_CERTIFICATE }}
          CSC_KEY_PASSWORD: ${{ secrets.WIN_CERTIFICATE_PASSWORD }}

      - name: Upload artifacts
        uses: actions/upload-artifact@v4
        with:
          name: windows-builds
          path: |
            auto-claude-ui/dist/*.exe

  build-linux:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: '20'

      - name: Setup pnpm
        uses: pnpm/action-setup@v4
        with:
          version: 10

      - name: Get pnpm store directory
        id: pnpm-cache
        run: echo "dir=$(pnpm store path)" >> $GITHUB_OUTPUT

      - uses: actions/cache@v4
        with:
          path: ${{ steps.pnpm-cache.outputs.dir }}
          key: ${{ runner.os }}-pnpm-${{ hashFiles('**/pnpm-lock.yaml') }}
          restore-keys: ${{ runner.os }}-pnpm-

      - name: Install dependencies
        run: cd auto-claude-ui && pnpm install --frozen-lockfile

      - name: Build application
        run: cd auto-claude-ui && pnpm run build

      - name: Package Linux
        run: cd auto-claude-ui && pnpm run package:linux
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

      - name: Upload artifacts
        uses: actions/upload-artifact@v4
        with:
          name: linux-builds
          path: |
            auto-claude-ui/dist/*.AppImage
            auto-claude-ui/dist/*.deb

  create-release:
    needs: [build-macos-intel, build-macos-arm64, build-windows, build-linux]
    runs-on: ubuntu-latest
    permissions:
      contents: write
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Download all artifacts
        uses: actions/download-artifact@v4
        with:
          path: dist

      - name: Flatten and validate artifacts
        run: |
          mkdir -p release-assets
          find dist -type f \( -name "*.dmg" -o -name "*.zip" -o -name "*.exe" -o -name "*.AppImage" -o -name "*.deb" \) -exec cp {} release-assets/ \;

          # Validate that at least one artifact was copied
          artifact_count=$(find release-assets -type f \( -name "*.dmg" -o -name "*.zip" -o -name "*.exe" -o -name "*.AppImage" -o -name "*.deb" \) | wc -l)
          if [ "$artifact_count" -eq 0 ]; then
            echo "::error::No build artifacts found! Expected .dmg, .zip, .exe, .AppImage, or .deb files."
            exit 1
          fi

          echo "Found $artifact_count artifact(s):"
          ls -la release-assets/

      - name: Generate checksums
        run: |
          cd release-assets
          sha256sum ./* > checksums.sha256
          cat checksums.sha256

      - name: Scan with VirusTotal
        id: virustotal
        continue-on-error: true
        if: ${{ github.event_name == 'push' || (github.event_name == 'workflow_dispatch' && inputs.dry_run != true) }}
        env:
          VT_API_KEY: ${{ secrets.VIRUSTOTAL_API_KEY }}
        run: |
          if [ -z "$VT_API_KEY" ]; then
            echo "::warning::VIRUSTOTAL_API_KEY not configured, skipping scan"
            echo "vt_results=" >> $GITHUB_OUTPUT
            exit 0
          fi

          echo "## VirusTotal Scan Results" > vt_results.md
          echo "" >> vt_results.md

          for file in release-assets/*.{exe,dmg,AppImage,deb}; do
            [ -f "$file" ] || continue
            filename=$(basename "$file")
            filesize=$(stat -c%s "$file" 2>/dev/null || stat -f%z "$file")
            echo "Scanning $filename (${filesize} bytes)..."

            # For files > 32MB, get a special upload URL first
            if [ "$filesize" -gt 33554432 ]; then
              echo "  Large file detected, requesting upload URL..."
              upload_url_response=$(curl -s --request GET \
                --url "https://www.virustotal.com/api/v3/files/upload_url" \
                --header "x-apikey: $VT_API_KEY")

              upload_url=$(echo "$upload_url_response" | jq -r '.data // empty')
              if [ -z "$upload_url" ]; then
                echo "::warning::Failed to get upload URL for large file $filename"
                echo "Response: $upload_url_response"
                echo "- $filename - ⚠️ Upload failed (large file)" >> vt_results.md
                continue
              fi
              api_url="$upload_url"
            else
              api_url="https://www.virustotal.com/api/v3/files"
            fi

            # Upload file to VirusTotal
            response=$(curl -s --request POST \
              --url "$api_url" \
              --header "x-apikey: $VT_API_KEY" \
              --form "file=@$file")

            # Check if response is valid JSON before parsing
            if ! echo "$response" | jq -e . >/dev/null 2>&1; then
              echo "::warning::VirusTotal returned invalid JSON for $filename"
              echo "Response (first 500 chars): ${response:0:500}"
              echo "- $filename - ⚠️ Scan failed (invalid response)" >> vt_results.md
              continue
            fi

            # Check for API error response
            error_code=$(echo "$response" | jq -r '.error.code // empty')
            if [ -n "$error_code" ]; then
              error_msg=$(echo "$response" | jq -r '.error.message // "Unknown error"')
              echo "::warning::VirusTotal API error for $filename: $error_code - $error_msg"
              echo "- $filename - ⚠️ Scan failed ($error_code)" >> vt_results.md
              continue
            fi

            # Extract analysis ID
            analysis_id=$(echo "$response" | jq -r '.data.id // empty')

            if [ -z "$analysis_id" ]; then
              echo "::warning::Failed to upload $filename to VirusTotal"
              echo "Response: $response"
              echo "- $filename - ⚠️ Upload failed" >> vt_results.md
              continue
            fi

            echo "Uploaded $filename, analysis ID: $analysis_id"

            # Wait for analysis to complete (max 5 minutes per file)
            analysis=""
            for i in {1..30}; do
              sleep 10
              analysis=$(curl -s --request GET \
                --url "https://www.virustotal.com/api/v3/analyses/$analysis_id" \
                --header "x-apikey: $VT_API_KEY")

              # Validate JSON response
              if ! echo "$analysis" | jq -e . >/dev/null 2>&1; then
                echo "  Warning: Invalid JSON response on attempt $i, retrying..."
                continue
              fi

              status=$(echo "$analysis" | jq -r '.data.attributes.status // "unknown"')
              echo "  Status: $status (attempt $i/30)"

              if [ "$status" = "completed" ]; then
                break
              fi
            done

            # Final validation that we have valid analysis data
            if ! echo "$analysis" | jq -e '.data.attributes.stats' >/dev/null 2>&1; then
              echo "::warning::Could not get complete analysis for $filename, using local hash"
              file_hash=$(sha256sum "$file" | cut -d' ' -f1)
              echo "- [$filename](https://www.virustotal.com/gui/file/$file_hash) - ⚠️ Analysis incomplete" >> vt_results.md
              continue
            fi

            # Get file hash for permanent URL
            file_hash=$(echo "$analysis" | jq -r '.meta.file_info.sha256 // empty')

            if [ -z "$file_hash" ]; then
              # Fallback: calculate hash locally
              file_hash=$(sha256sum "$file" | cut -d' ' -f1)
            fi

            # Get detection stats
            malicious=$(echo "$analysis" | jq -r '.data.attributes.stats.malicious // 0')
            suspicious=$(echo "$analysis" | jq -r '.data.attributes.stats.suspicious // 0')
            undetected=$(echo "$analysis" | jq -r '.data.attributes.stats.undetected // 0')

            vt_url="https://www.virustotal.com/gui/file/$file_hash"

            if [ "$malicious" -gt 0 ] || [ "$suspicious" -gt 0 ]; then
              echo "::warning::$filename has $malicious malicious and $suspicious suspicious detections (likely false positives)"
              echo "- [$filename]($vt_url) - ⚠️ **$malicious malicious, $suspicious suspicious** detections (review recommended)" >> vt_results.md
            else
              echo "$filename is clean ($undetected engines, 0 detections)"
              echo "- [$filename]($vt_url) - ✅ Clean ($undetected engines, 0 detections)" >> vt_results.md
            fi
          done

          echo "" >> vt_results.md

          # Save results for release notes
          cat vt_results.md
          echo "vt_results<<EOF" >> $GITHUB_OUTPUT
          cat vt_results.md >> $GITHUB_OUTPUT
          echo "EOF" >> $GITHUB_OUTPUT

      - name: Dry run summary
        if: ${{ github.event_name == 'workflow_dispatch' && inputs.dry_run == true }}
        run: |
          echo "## Dry Run Complete" >> $GITHUB_STEP_SUMMARY
          echo "Build artifacts created successfully:" >> $GITHUB_STEP_SUMMARY
          echo "\`\`\`" >> $GITHUB_STEP_SUMMARY
          ls -la release-assets/ >> $GITHUB_STEP_SUMMARY
          echo "\`\`\`" >> $GITHUB_STEP_SUMMARY
          echo "### Checksums" >> $GITHUB_STEP_SUMMARY
          echo "\`\`\`" >> $GITHUB_STEP_SUMMARY
          cat release-assets/checksums.sha256 >> $GITHUB_STEP_SUMMARY
          echo "\`\`\`" >> $GITHUB_STEP_SUMMARY

      - name: Generate changelog
        if: ${{ github.event_name == 'push' || (github.event_name == 'workflow_dispatch' && inputs.dry_run != true) }}
        id: changelog
        uses: release-drafter/release-drafter@v6
        with:
          config-name: release-drafter.yml
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

      - name: Create Release
        if: ${{ github.event_name == 'push' || (github.event_name == 'workflow_dispatch' && inputs.dry_run != true) }}
        uses: softprops/action-gh-release@v2
        with:
          body: |
            ${{ steps.changelog.outputs.body }}

            ${{ steps.virustotal.outputs.vt_results }}
          files: release-assets/*
          draft: false
          prerelease: ${{ contains(github.ref, 'beta') || contains(github.ref, 'alpha') }}
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}