release.yml

# Builds every package from a version tag on a clean GitHub-hosted runner, signs SHA256SUMS
# (Ed25519; required by the in-app updater), signs SLSA build provenance for each file
# (Sigstore, verifiable with `gh attestation verify`) and publishes the release. The landing
# page reads the latest release from GitHub's API, so it needs no update here.
name: release

on:
  push:
    tags: ["v*"]

permissions:
  contents: read

jobs:
  build:
    runs-on: macos-15 # Apple silicon: builds the macOS apps (Swift + WebKit) and the Linux packages
    permissions:
      contents: write # create the GitHub release
      id-token: write # sign attestations
      attestations: write
    steps:
      - uses: actions/checkout@v5
      - uses: oven-sh/setup-bun@v2
        with:
          bun-version: 1.4.4

      - name: Tag matches package.json
        run: |
          v=$(bun -e 'console.log(require("./package.json").version)')
          test "v$v" = "$GITHUB_REF_NAME" || { echo "tag $GITHUB_REF_NAME != package.json $v"; exit 1; }

      - run: bun run test

      # Pinned browser for the Linux packages is verified against packaging/browser-pins.json.
      - run: bun run build

      # The in-app updater only installs releases whose SHA256SUMS carries this signature.
      - name: Sign SHA256SUMS
        env:
          CODEVIEWER_UPDATE_KEY: ${{ secrets.CODEVIEWER_UPDATE_KEY }}
        run: bun scripts/sign.ts dist/release/SHA256SUMS

      - name: Attest build provenance
        uses: actions/attest-build-provenance@v4
        with:
          subject-path: dist/release/*

      - name: Publish release
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          # The notes are the release commit's summary paragraph (HEAD of the checked-out tag),
          # written outside dist/release so they are not uploaded as an asset.
          bun scripts/release-notes.ts > "$RUNNER_TEMP/release-notes.md"
          gh release create "$GITHUB_REF_NAME" dist/release/* \
            --verify-tag \
            --title "Codeviewer $GITHUB_REF_NAME" \
            --notes-file "$RUNNER_TEMP/release-notes.md"