desktop-build.yml

name: Desktop App CI

on:
  push:
    branches: [ master ]
  pull_request:
    branches: [ master ]

jobs:
  build-macos:
    runs-on: macos-latest-xlarge
    strategy:
      matrix:
        target: [universal-apple-darwin]
    steps:
      - uses: actions/checkout@v4

      - name: Setup Bun
        uses: oven-sh/setup-bun@v1
        with:
          bun-version: 1.2.2

      - name: Install Rust
        uses: dtolnay/rust-toolchain@stable
        with:
          targets: aarch64-apple-darwin,x86_64-apple-darwin

      - name: Cache Homebrew
        uses: actions/cache@v4
        with:
          path: |
            ~/Library/Caches/Homebrew
            /opt/homebrew/Cellar/sccache
            /opt/homebrew/Cellar/openssl@3
          key: ${{ runner.os }}-brew-${{ hashFiles('.github/workflows/desktop-build.yml') }}
          restore-keys: |
            ${{ runner.os }}-brew-

      - name: Install sccache
        run: |
          brew install sccache
          brew link --overwrite --force sccache
          sccache --version

      - name: Cache sccache
        uses: actions/cache@v4
        with:
          path: ~/Library/Caches/Mozilla.sccache
          key: ${{ runner.os }}-sccache-macos-${{ hashFiles('**/Cargo.lock') }}
          restore-keys: |
            ${{ runner.os }}-sccache-macos-
            ${{ runner.os }}-sccache-

      - name: Install frontend dependencies
        working-directory: ./frontend
        run: bun install

      - name: Configure sccache
        run: |
          {
            echo "RUSTC_WRAPPER=sccache"
            echo "SCCACHE_CACHE_SIZE=2G"
          } >> "$GITHUB_ENV"

      - name: Import Apple Developer Certificate
        env:
          APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }}
          APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
          KEYCHAIN_PASSWORD: ${{ secrets.KEYCHAIN_PASSWORD }}
        run: |
          echo $APPLE_CERTIFICATE | base64 --decode > certificate.p12
          security create-keychain -p "$KEYCHAIN_PASSWORD" build.keychain
          security default-keychain -s build.keychain
          security unlock-keychain -p "$KEYCHAIN_PASSWORD" build.keychain
          security set-keychain-settings -t 3600 -u build.keychain
          security import certificate.p12 -k build.keychain -P "$APPLE_CERTIFICATE_PASSWORD" -T /usr/bin/codesign
          security set-key-partition-list -S apple-tool:,apple:,codesign: -s -k "$KEYCHAIN_PASSWORD" build.keychain
          security find-identity -v -p codesigning build.keychain

      - name: Verify Certificate
        run: |
          CERT_INFO=$(security find-identity -v -p codesigning build.keychain | grep "Developer ID Application")
          CERT_ID=$(echo "$CERT_INFO" | awk -F'"' '{print $2}')
          echo "CERT_ID=$CERT_ID" >> "$GITHUB_ENV"
          echo "Certificate imported."

      - name: Build Tauri App (macOS)
        uses: tauri-apps/tauri-action@v0
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
          TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
          APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }}
          APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
          APPLE_ID: ${{ secrets.APPLE_ID }}
          APPLE_PASSWORD: ${{ secrets.APPLE_ID_PASSWORD }}
          APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
          APPLE_SIGNING_IDENTITY: ${{ env.CERT_ID }}
          VITE_OPEN_SECRET_API_URL: ${{ github.event_name == 'pull_request' && 'https://enclave.secretgpt.ai' || 'https://enclave.trymaple.ai' }}
          VITE_MAPLE_BILLING_API_URL: ${{ github.event_name == 'pull_request' && 'https://billing-dev.opensecret.cloud' || 'https://billing.opensecret.cloud' }}
          VITE_CLIENT_ID: ba5a14b5-d915-47b1-b7b1-afda52bc5fc6
        with:
          projectPath: './frontend'
          args: --target ${{ matrix.target }}

      - name: Show sccache stats
        run: sccache --show-stats

      - name: Upload macOS Build
        uses: actions/upload-artifact@v4
        with:
          name: maple-macos-universal
          path: |
            frontend/src-tauri/target/universal-apple-darwin/release/bundle/dmg/*.dmg
            frontend/src-tauri/target/universal-apple-darwin/release/bundle/macos/*.app
          retention-days: 5

  build-linux:
    runs-on: ubuntu-latest-8-cores
    steps:
      - uses: actions/checkout@v4

      - name: Setup Bun
        uses: oven-sh/setup-bun@v1
        with:
          bun-version: 1.2.2

      - name: Install Rust
        uses: dtolnay/rust-toolchain@stable

      - name: Install sccache
        run: |
          SCCACHE_VERSION=0.8.2
          SCCACHE_URL="https://github.com/mozilla/sccache/releases/download/v${SCCACHE_VERSION}/sccache-v${SCCACHE_VERSION}-x86_64-unknown-linux-musl.tar.gz"
          curl -L "$SCCACHE_URL" | tar xz
          sudo mv sccache-v${SCCACHE_VERSION}-x86_64-unknown-linux-musl/sccache /usr/local/bin/
          chmod +x /usr/local/bin/sccache
          sccache --version

      - name: Cache sccache
        uses: actions/cache@v4
        with:
          path: ~/.cache/sccache
          key: ${{ runner.os }}-sccache-linux-${{ hashFiles('**/Cargo.lock') }}
          restore-keys: |
            ${{ runner.os }}-sccache-linux-
            ${{ runner.os }}-sccache-

      - name: Cache Cargo bin (Tauri CLI)
        uses: actions/cache@v4
        with:
          path: ~/.cargo/bin/
          key: ${{ runner.os }}-cargo-bin-tauri-cli-2.9.2
          restore-keys: |
            ${{ runner.os }}-cargo-bin-tauri-cli-
            ${{ runner.os }}-cargo-bin-

      - name: Install Linux dependencies
        run: |
          sudo apt-get update
          sudo apt-get install -y libwebkit2gtk-4.1-dev \
              libssl-dev \
              libgtk-3-dev \
              libayatana-appindicator3-dev \
              librsvg2-dev

      - name: Install frontend dependencies
        working-directory: ./frontend
        run: bun install

      - name: Install Tauri CLI
        run: |
          if ! command -v cargo-tauri &> /dev/null; then
            cargo install tauri-cli --version "2.9.2" --locked
          else
            echo "Tauri CLI already installed"
          fi
        env:
          CARGO_CFG_TARGET_OS: linux

      - name: Configure sccache
        run: |
          {
            echo "RUSTC_WRAPPER=sccache"
            echo "SCCACHE_DIR=$HOME/.cache/sccache"
            echo "SCCACHE_CACHE_SIZE=2G"
          } >> "$GITHUB_ENV"

      - name: Build Tauri App (Linux)
        working-directory: ./frontend
        run: cargo tauri build
        env:
          TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
          TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
          VITE_OPEN_SECRET_API_URL: ${{ github.event_name == 'pull_request' && 'https://enclave.secretgpt.ai' || 'https://enclave.trymaple.ai' }}
          VITE_MAPLE_BILLING_API_URL: ${{ github.event_name == 'pull_request' && 'https://billing-dev.opensecret.cloud' || 'https://billing.opensecret.cloud' }}
          VITE_CLIENT_ID: ba5a14b5-d915-47b1-b7b1-afda52bc5fc6

      - name: Show sccache stats
        run: sccache --show-stats

      - name: Upload Linux Builds
        uses: actions/upload-artifact@v4
        with:
          name: maple-linux
          path: |
            frontend/src-tauri/target/release/bundle/appimage/*.AppImage
            frontend/src-tauri/target/release/bundle/deb/*.deb
          retention-days: 5