name: Desktop release
run-name: Ace ${{ inputs.channel }} at ${{ inputs.revision || github.sha }}${{ inputs.publish && ' (publish)' || '' }}

on:
  workflow_dispatch:
    inputs:
      channel:
        description: Release channel
        type: choice
        options: [canary, stable]
        default: canary
      publish:
        description: Publish the verified release to GitHub and the public download bucket
        type: boolean
        default: false
      revision:
        description: Exact source commit (defaults to the selected ref)
        type: string

permissions:
  contents: read

concurrency:
  group: desktop-release-${{ inputs.channel }}
  cancel-in-progress: false

jobs:
  release:
    permissions:
      contents: write
    runs-on: macos-15
    timeout-minutes: 60
    environment: desktop-${{ inputs.channel }}
    env:
      DEVELOPER_DIR: /Applications/Xcode_26.2.app/Contents/Developer
      ACE_CODESIGN_IDENTITY: ${{ vars.ACE_CODESIGN_IDENTITY }}
      ACE_UPDATE_URL: ${{ vars.ACE_UPDATE_URL }}
      ACE_UPDATE_PUBLIC_KEY: ${{ vars.ACE_UPDATE_PUBLIC_KEY }}
      ACE_NOTARY_KEY_ID: ${{ vars.ACE_NOTARY_KEY_ID }}
      ACE_NOTARY_ISSUER: ${{ vars.ACE_NOTARY_ISSUER }}
      ACE_RELEASE_CHANNEL: ${{ inputs.channel }}
      ACE_RELEASE_REVISION: ${{ inputs.revision || github.sha }}
    steps:
      - name: Validate source revision
        run: |
          if [[ ! "$ACE_RELEASE_REVISION" =~ ^[a-f0-9]{40}$ ]]; then
            echo "::error::The release revision must be a full commit SHA."
            exit 1
          fi
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          ref: ${{ env.ACE_RELEASE_REVISION }}
      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
        with:
          bun-version: 1.4.0
      - run: bun install --frozen-lockfile
      - run: bun types && bun run ci
      - name: Import release credentials
        run: bun apps/desktop/scripts/credentials.ts
        env:
          ACE_CERTIFICATE_P12: ${{ secrets.ACE_CERTIFICATE_P12 }}
          ACE_CERTIFICATE_PASSWORD: ${{ secrets.ACE_CERTIFICATE_PASSWORD }}
          ACE_NOTARY_PRIVATE_KEY: ${{ secrets.ACE_NOTARY_PRIVATE_KEY }}
      - name: Build, sign, notarize, and verify
        run: bun desktop release "$ACE_RELEASE_CHANNEL"
        env:
          ACE_SPARKLE_PRIVATE_KEY: ${{ secrets.ACE_SPARKLE_PRIVATE_KEY }}
      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: ace-${{ inputs.channel }}-macos-arm64
          path: apps/desktop/artifacts/sparkle/
          if-no-files-found: error
      - name: Publish downloads and GitHub release, then the feed
        if: inputs.publish
        run: bun desktop publish
        env:
          GH_TOKEN: ${{ github.token }}
          ACE_SPARKLE_PRIVATE_KEY: ${{ secrets.ACE_SPARKLE_PRIVATE_KEY }}
          ACE_UPDATE_BUCKET: ${{ vars.ACE_UPDATE_BUCKET }}
          CLOUDFLARE_ACCOUNT_ID: ${{ vars.CLOUDFLARE_ACCOUNT_ID }}
          R2_ACCESS_KEY_ID: ${{ secrets.R2_ACCESS_KEY_ID }}
          R2_SECRET_ACCESS_KEY: ${{ secrets.R2_SECRET_ACCESS_KEY }}
      - name: Remove signing credentials
        if: always()
        run: bun apps/desktop/scripts/credentials.ts clean