mattermostest/.github/workflows/release.yaml

name: release

on:
  push:
    tags:
      - "v[0-9]+.[0-9]+.[0-9]+"
      - "v[0-9]+.[0-9]+.[0-9]+-rc.[0-9]+"

defaults:
  run:
    shell: bash

env:
  TERM: xterm
  MM_WIN_INSTALLERS: 1

jobs:
  begin-notification:
    runs-on: ubuntu-22.04
    steps:
      - name: release/checkout-repo
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

      - name: release/fetch-version
        id: calc
        run: echo "VERSION=$(jq -r .version package.json)" >> ${GITHUB_OUTPUT}

      - name: release/notify-channel
        uses: mattermost/action-mattermost-notify@d317daebed2a792679f68fd0248557a8d21d82b6
        with:
          MATTERMOST_WEBHOOK_URL: ${{ secrets.MM_DESKTOP_RELEASE_WEBHOOK_URL }}
          MATTERMOST_USERNAME: MattermostRelease
          MATTERMOST_ICON_URL: https://mattermost.com/wp-content/uploads/2022/02/icon.png
          TEXT: |
            [${{ steps.calc.outputs.VERSION }}] Release process for the desktop app has started, it should take about 30 minutes to complete.

  build-linux:
    runs-on: ubuntu-22.04
    needs:
      - begin-notification
    steps:
      - name: release/checkout-repo
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
      - name: release/setup-node
        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
        with:
          node-version-file: "package.json"
          cache: "npm"
          cache-dependency-path: package-lock.json
      - name: release/install-dependencies
        env:
          PLAYWRIGHT_SKIP_BROWSER_DOWNLOAD: 1
        run: |
          wget -qO - https://download.opensuse.org/repositories/Emulators:/Wine:/Debian/xUbuntu_22.04/Release.key | sudo apt-key add -
          wget -qO /usr/local/bin/yq https://github.com/mikefarah/yq/releases/download/v4.20.1/yq_linux_amd64 && chmod a+x /usr/local/bin/yq
          sudo apt-get update || true && sudo apt-get install -y ca-certificates libxtst-dev libpng++-dev gcc-aarch64-linux-gnu g++-aarch64-linux-gnu jq icnsutils graphicsmagick tzdata
          npm ci
      - name: release/test
        uses: ./.github/actions/test
      - name: release/build
        run: |
          mkdir -p ./build/linux
          npm run package:linux
          bash -x ./scripts/patch_updater_yml.sh
          bash -x ./scripts/cp_artifacts.sh release ./build/linux
      - name: release/upload-build
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
        with:
          name: build-${{ runner.os }}
          path: ./build
          compression-level: 0
          retention-days: 14 ## No need to keep CI builds more than 14 days

  build-msi-installer:
    runs-on: windows-2022
    needs:
      - begin-notification
    steps:
      - name: release/checkout-repo
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
      - name: release/setup-node
        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
        with:
          node-version-file: "package.json"
          cache: "npm"
          cache-dependency-path: package-lock.json
      - name: release/install-deps
        shell: powershell
        run: |
          choco install yq --version 4.15.1 -y
          npm i -g node-gyp
          node-gyp install
          node-gyp install --devdir="C:\Users\runneradmin\.electron-gyp" --target=$(jq -r .devDependencies.electron package.json) --dist-url="https://electronjs.org/headers"
          node-gyp install --devdir="C:\Users\runneradmin\.electron-gyp" --target=$(jq -r .devDependencies.electron package.json) --dist-url="https://electronjs.org/headers" --arch arm64
          npm ci --openssl_fips=''
      - name: release/test
        uses: ./.github/actions/test
      - name: release/build
        shell: powershell
        env:
          MM_WIN_INSTALLERS: 1
          PFX_KEY: ${{ secrets.MM_DESKTOP_MSI_INSTALLER_PFX_KEY }}
          CSC_KEY_PASSWORD: ${{ secrets.MM_DESKTOP_MSI_INSTALLER_CSC_KEY_PASSWORD }}
          PFX: ${{ secrets.MM_DESKTOP_MSI_INSTALLER_PFX }}
          CSC_LINK: ${{ secrets.MM_DESKTOP_MSI_INSTALLER_CSC_LINK }}
        run: |
          npm run package:windows
      - name: release/package
        run: |
          mkdir -p ./build/win-release
          bash -x ./scripts/patch_updater_yml.sh
          bash -x ./scripts/cp_artifacts.sh release ./build/win-release
      - name: release/upload-build
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
        with:
          name: build-${{ runner.os }}
          path: ./build
          compression-level: 0
          retention-days: 14

  build-mac-installer:
    runs-on: macos-15
    env:
      MACOS_NOTIFICATION_STATE_NO_SDK_CHECK: true
    needs:
      - begin-notification
    steps:
      - name: release/checkout-repo
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
      - name: release/setup-node
        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
        with:
          node-version-file: "package.json"
          cache: "npm"
          cache-dependency-path: package-lock.json
      - name: release/create-build-folder
        run: mkdir -p ./build
      - name: release/install-dependencies
        run: |
          brew install yq rename
          sudo xcode-select -s /Applications/Xcode_16.2.app/Contents/Developer
          npm ci
      - name: release/test
        uses: ./.github/actions/test
      - name: release/build
        env:
          APPLE_API_KEY_ID: ${{ secrets.MM_DESKTOP_MAC_APP_STORE_MACOS_API_KEY_ID }}
          APPLE_API_KEY_RAW: ${{ secrets.MM_DESKTOP_MAC_APP_STORE_MACOS_API_KEY }}
          APPLE_API_KEY: "./key.p8"
          APPLE_API_ISSUER: ${{ secrets.MM_DESKTOP_MAC_APP_STORE_MACOS_API_ISSUER_ID }}
          CSC_FOR_PULL_REQUEST: true
          CSC_KEY_PASSWORD: ${{ secrets.MM_DESKTOP_MAC_INSTALLER_CSC_KEY_PASSWORD }}
          CSC_LINK: ${{ secrets.MM_DESKTOP_MAC_INSTALLER_CSC_LINK }}
          MAC_PROFILE: ${{ secrets.MM_DESKTOP_MAC_INSTALLER_DMG_PROFILE }}
        run: |
          echo $MAC_PROFILE | base64 -D > ./mac.provisionprofile
          zsh -c 'echo -n $APPLE_API_KEY_RAW > ./key.p8'
          mkdir -p ./build/macos-release
          npm run package:mac-with-universal
          bash -x ./scripts/patch_updater_yml.sh
          bash -x ./scripts/cp_artifacts.sh release ./build/macos-release
      - name: release/rename-arm64-to-m1
        run: rename 's/arm64/m1/' ./build/macos-release/$(jq -r .version package.json)/*
      - name: release/upload-build
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
        with:
          name: build-${{ runner.os }}
          path: ./build
          compression-level: 0
          retention-days: 14

  upload-to-s3:
    runs-on: ubuntu-22.04
    needs:
      - build-mac-installer
      - build-msi-installer
      - build-linux
    steps:
      - name: release/setup-aws-credentials
        uses: aws-actions/configure-aws-credentials@ececac1a45f3b08a01d2dd070d28d111c5fe6722 # v4.1.0
        with:
          aws-region: us-east-1
          aws-access-key-id: ${{ secrets.MM_DESKTOP_RELEASE_AWS_ACCESS_KEY_ID }}
          aws-secret-access-key: ${{ secrets.MM_DESKTOP_RELEASE_AWS_SECRET_ACCESS_KEY }}

      - name: release/download-builds
        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
        with:
          path: build
          pattern: build-*
          merge-multiple: true

      - name: release/setup-files-for-aws
        run: |
          mkdir -p ./aws-s3-dist
          cp -r --backup=numbered ./build/{macos-release,win-release,linux}/* ./aws-s3-dist
      - name: release/upload-to-s3
        run: aws s3 cp ./aws-s3-dist/ s3://releases.mattermost.com/desktop/ --acl public-read --cache-control "no-cache" --recursive

  github-release:
    runs-on: ubuntu-22.04
    needs:
      - upload-to-s3
    steps:
      - name: release/checkout-repo
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

      - name: release/download-builds
        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
        with:
          path: build
          pattern: build-*
          merge-multiple: true

      - name: release/setup-files-for-github-release
        run: |
          mkdir -p ./ghr-dist
          find ./build/{macos-release,win-release,linux} -type f -exec cp --backup=numbered -t ./ghr-dist {} +

      - name: release/publish-release
        env:
          GITHUB_TOKEN: ${{ secrets.MATTERMOST_BUILD_GH_TOKEN }}
        run: |
          VERSION=$(jq -r .version package.json)
          ./scripts/generate_release_markdown.sh ${VERSION} > release-notes.md
          RELEASE_TITLE="v${VERSION} ($(date -u "+%Y-%m-%d"))"
          [[ $VERSION =~ "-rc" ]] && PRERELEASE="--prerelease"
          gh release create --draft ${PRERELEASE} --verify-tag -F release-notes.md --target "${GITHUB_SHA}" --title "${RELEASE_TITLE}" "${GITHUB_REF_NAME}" ./ghr-dist/*

  end-notification:
    runs-on: ubuntu-22.04
    needs:
      - github-release
    steps:
      - name: release/checkout-repo
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
          fetch-depth: 0

      - name: release/fetch-version
        id: calc
        run: |
          echo "BODY<<EOF" >> "${GITHUB_OUTPUT}"
          bash -x scripts/generate_release_post.sh $(jq -r .version package.json) >> "${GITHUB_OUTPUT}"
          echo "EOF" >> "${GITHUB_OUTPUT}"

      - name: release/notify-channel
        uses: mattermost/action-mattermost-notify@d317daebed2a792679f68fd0248557a8d21d82b6
        with:
          MATTERMOST_WEBHOOK_URL: ${{ secrets.MM_DESKTOP_RELEASE_WEBHOOK_URL }}
          MATTERMOST_USERNAME: MattermostRelease
          MATTERMOST_ICON_URL: https://mattermost.com/wp-content/uploads/2022/02/icon.png
          TEXT: |
            ${{ steps.calc.outputs.BODY }}