push.yml

name: ⚓ Push

run-name: Release ${{ inputs.version }}
on:
    workflow_dispatch:
      inputs:
          version:
              description: version(optional)
              type: string
              default: 
          ref:
              type: string
              default: dev
    workflow_call:
      inputs:
          version:
              description: version(optional)
              type: string
              required: false
          ref:
              type: string
              description: The branch or tag to checkout
              default: dev
              required: false
      secrets:
          GH_TOKEN:
              required: true
          S3_ACCESS_KEY_ID:
              required: true
          S3_ACCESS_KEY_SECRET:
              required: true
          GO_BUILD_CERTIFICATE_BASE64:
              required: true
          GO_P12_PASSWORD:
              required: true
          GO_BUILD_PROVISION_PROFILE_BASE64:
              required: true
          GO_KEYCHAIN_PASSWORD:
              required: true
          APPLE_ID:
              required: true
          APPLE_PASSWORD:
              required: true
          APPLE_TEAM_ID:
              required: true              

jobs:
    build-binary:
        name: BuildBinary
        permissions:
          id-token: write
          contents: write
          attestations: write
        strategy:
            fail-fast: true
            matrix:
                os: [windows-latest, macos-latest]
        runs-on: ${{ matrix.os }}
        timeout-minutes: 30
        steps:
            - uses: actions/checkout@v4
              with:
                  repository: dream-num/univer-desktop
                  ref: ${{ inputs.ref }}
                  token: ${{ secrets.GH_TOKEN }}
                  submodules: true

            - name: Setup pnpm
              uses: pnpm/action-setup@v4

            - uses: actions/setup-node@v4
              with:
                  node-version: '22'

            - name: Set version
              id: set_version
              shell: bash
              run: |
                if [ -z "${{ inputs.version }}" ]; then
                  cd app
                  APP_VERSION=$(node -e 'console.log(require("./package.json").version)')

                  if [ "${{ github.repository }}" = "dream-num/univer-go" ]; then
                    echo "version=${APP_VERSION}" >> $GITHUB_OUTPUT
                  else
                    COMMIT_HASH=$(git rev-parse --short=7 HEAD)
                    # get dev release count
                    DEV_RELEASES=$(gh release list -R ${{ github.repository }} --limit 100 | grep "${APP_VERSION}-dev" | wc -l || true)
                    BUILD_NUMBER=$((DEV_RELEASES + 1))
                    
                    echo "version=${APP_VERSION}-dev.${BUILD_NUMBER}-${COMMIT_HASH}" >> $GITHUB_OUTPUT
                  fi
                else
                  echo "version=${{ inputs.version }}" >> $GITHUB_OUTPUT
                fi
              env:
                GH_TOKEN: ${{ secrets.GH_TOKEN }}

            - name: Determine version type
              id: version_type
              shell: bash
              run: |
                VERSION="${{ steps.set_version.outputs.version }}"
                
                if [[ $VERSION == *"-dev"* ]]; then
                  echo "is_dev=true" >> $GITHUB_OUTPUT
                  echo "is_stable=false" >> $GITHUB_OUTPUT
                elif [[ $VERSION =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
                  echo "is_dev=false" >> $GITHUB_OUTPUT
                  echo "is_stable=true" >> $GITHUB_OUTPUT
                else
                  echo "is_dev=false" >> $GITHUB_OUTPUT
                  echo "is_stable=false" >> $GITHUB_OUTPUT
                fi

            - name: Check version
              if: ${{ github.repository == 'dream-num/univer-go' }}
              shell: bash
              run: |
                if [ ${{ steps.version_type.outputs.is_dev }} = "true" ]; then
                  exit 1
                fi

            - name: Determine release channel
              id: release_channel
              shell: bash
              run: |
                if [ "${{ steps.version_type.outputs.is_dev }}" = "true" ]; then
                  echo "channel=development" >> $GITHUB_OUTPUT
                else
                  echo "channel=production" >> $GITHUB_OUTPUT
                fi

            - name: init dest
              id: init_dest
              shell: bash
              run: |
                if [ ${{ steps.release_channel.outputs.channel }} = "development" ]; then
                  echo "dest=test/staging/" >> $GITHUB_OUTPUT
                else
                  echo "dest=univer-go/latest/" >> $GITHUB_OUTPUT
                fi
  
            - name: Print Release Info
              shell: bash
              run: |
                  echo "Version: ${{ steps.set_version.outputs.version }}"
                  echo "Is Dev: ${{ steps.version_type.outputs.is_dev }}"
                  echo "Is Stable: ${{ steps.version_type.outputs.is_stable }}"
                  echo "Dest: ${{ steps.init_dest.outputs.dest }}"
                  echo "RELEASE_CHANNEL: ${{ steps.release_channel.outputs.channel }}"

            - name: Install Python setuptools
              if: matrix.os == 'macos-latest'
              run: brew install python-setuptools

            - name: Install appdmg
              if: matrix.os == 'macos-latest'
              run: pnpm add -g appdmg

            - name: Install the Apple certificate and provisioning profile
              if: runner.os == 'macOS'
              env:
                BUILD_CERTIFICATE_BASE64: ${{ secrets.GO_BUILD_CERTIFICATE_BASE64 }}
                P12_PASSWORD: ${{ secrets.GO_P12_PASSWORD }}
                BUILD_PROVISION_PROFILE_BASE64: ${{ secrets.GO_BUILD_PROVISION_PROFILE_BASE64 }}
                KEYCHAIN_PASSWORD: ${{ secrets.GO_KEYCHAIN_PASSWORD }}
              run: |
                # create variables
                CERTIFICATE_PATH=$RUNNER_TEMP/build_certificate.p12
                PP_PATH=$RUNNER_TEMP/build_pp.provisionprofile
                KEYCHAIN_PATH=$RUNNER_TEMP/app-signing.keychain-db
      
                # import certificate and provisioning profile from secrets
                echo -n "$BUILD_CERTIFICATE_BASE64" | base64 --decode > $CERTIFICATE_PATH
                echo -n "$BUILD_PROVISION_PROFILE_BASE64" | base64 --decode > $PP_PATH
      
                # create temporary keychain
                security create-keychain -p "$KEYCHAIN_PASSWORD" $KEYCHAIN_PATH
                security set-keychain-settings -lut 21600 $KEYCHAIN_PATH
                security unlock-keychain -p "$KEYCHAIN_PASSWORD" $KEYCHAIN_PATH
      
                # import certificate to keychain
                security import $CERTIFICATE_PATH -P "$P12_PASSWORD" -A -t cert -f pkcs12 -k $KEYCHAIN_PATH
                security set-key-partition-list -S apple-tool:,apple: -k "$KEYCHAIN_PASSWORD" $KEYCHAIN_PATH
                security list-keychain -d user -s $KEYCHAIN_PATH
      
                # apply provisioning profile
                mkdir -p ~/Library/MobileDevice/Provisioning\ Profiles
                cp $PP_PATH ~/Library/MobileDevice/Provisioning\ Profiles

            - name: fix npm error
              shell: bash
              run: git config --global url.https://${{ secrets.GH_TOKEN }}@github.com/.insteadOf https://github.com/

            - run: pnpm i
              shell: bash

            - run: |
                cd app
                pnpm version ${{ steps.set_version.outputs.version }} --allow-same-version --no-git-tag-version

            - name: Make (macOS)
              if: matrix.os == 'macos-latest'
              env:
                APPLE_ID: ${{ secrets.APPLE_ID }}
                APPLE_PASSWORD: ${{ secrets.APPLE_PASSWORD }}
                APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
                KEYCHAIN_PATH: ${{ runner.temp }}/app-signing.keychain-db
              shell: bash
              run: |
                  RELEASE_CHANNEL=${{ steps.release_channel.outputs.channel }} pnpm make

            - name: Make
              if: matrix.os != 'macos-latest'
              shell: bash
              run: |
                RELEASE_CHANNEL=${{ steps.release_channel.outputs.channel }} pnpm make

            - uses: hexf00/upload-to-oss@v2
              with:
                  files: |
                      app/out/make/**/*.dmg
                      app/out/make/**/*.zip
                      app/out/make/**/*.exe
                      app/out/make/**/*.AppImage
                  dest: ${{ steps.init_dest.outputs.dest }}
                  bucket: release-univer
                  region: oss-cn-shenzhen
                  accessKeyId: ${{secrets.S3_ACCESS_KEY_ID}}
                  accessKeySecret: ${{secrets.S3_ACCESS_KEY_SECRET}}
                  timeout: 1200s

            - uses: hexf00/upload-to-oss@v2
              if: ${{ steps.version_type.outputs.is_stable == 'true' }}
              continue-on-error: true
              with:
                files: |
                    app/out/make/**/*.yml
                dest: ${{ steps.init_dest.outputs.dest }}
                bucket: release-univer
                region: oss-cn-shenzhen
                accessKeyId: ${{secrets.S3_ACCESS_KEY_ID}}
                accessKeySecret: ${{secrets.S3_ACCESS_KEY_SECRET}}
                timeout: 1200s

            - name: Create Release (stable)
              uses: softprops/action-gh-release@v2
              if: ${{ steps.version_type.outputs.is_stable == 'true' }}
              with:
                name: Release ${{ steps.set_version.outputs.version }}
                draft: false
                prerelease: ${{ steps.version_type.outputs.is_stable == 'false' }}
                tag_name: ${{ steps.set_version.outputs.version }}
                files: |
                  app/out/make/**/*.dmg
                  app/out/make/**/*.zip
                  app/out/make/**/*.exe
                  app/out/make/**/*.AppImage
                  app/out/make/**/*.yml

                body: |
                  ${{ !steps.version_type.outputs.is_stable && 'This is an automated nightly release for testing purposes.' || '' }}
                  Version: ${{ steps.set_version.outputs.version }}
                  Version Info:
                  - is_stable: ${{ steps.version_type.outputs.is_stable }}
                  - is_dev: ${{ steps.version_type.outputs.is_dev }}

                  ${{ !steps.version_type.outputs.is_stable && '**Warning:** This build may be unstable and is not recommended for production use.' || '' }}