maka/.github/workflows/desktop-nightly.yml

# Licensed to the Apache Software Foundation (ASF) under one
# or more contributor license agreements.  See the NOTICE file
# distributed with this work for additional information
# regarding copyright ownership.  The ASF licenses this file
# to you under the Apache License, Version 2.0 (the
# "License"); you may not use this file except in compliance
# with the License.  You may obtain a copy of the License at
#
#     http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing,
# software distributed under the License is distributed on an
# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
# KIND, either express or implied.  See the License for the
# specific language governing permissions and limitations
# under the License.

name: Desktop Nightly

on:
  workflow_run:
    workflows:
      - npm publication
    types:
      - completed

permissions:
  actions: read
  contents: read

concurrency:
  group: desktop-nightly
  cancel-in-progress: false

jobs:
  identity:
    if: >-
      vars.DESKTOP_NIGHTLY_ENABLED == 'true' &&
      github.event.workflow_run.conclusion == 'success' &&
      github.event.workflow_run.head_branch == 'main' &&
      github.event.workflow_run.display_title == 'npm nightly publication'
    runs-on: ubuntu-24.04
    timeout-minutes: 10
    outputs:
      source_commit: ${{ github.event.workflow_run.head_sha }}
      version: ${{ steps.identity.outputs.version }}
    steps:
      - name: Reject in-place workflow reruns
        if: github.run_attempt != 1
        run: |
          echo "Desktop Nightly retries require a fresh npm Nightly dispatch" >&2
          exit 1

      - name: Check out the published Nightly source
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          ref: ${{ github.event.workflow_run.head_sha }}
          persist-credentials: false

      - name: Require the successful Apache npm Nightly run
        env:
          UPSTREAM_REPOSITORY: ${{ github.event.workflow_run.head_repository.full_name }}
        run: |
          test "$GITHUB_REPOSITORY" = apache/maka
          test "$UPSTREAM_REPOSITORY" = apache/maka

      - name: Download the published Nightly version
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: product-nightly-version
          path: ${{ runner.temp }}/product-nightly-version
          github-token: ${{ github.token }}
          repository: ${{ github.repository }}
          run-id: ${{ github.event.workflow_run.id }}

      - name: Bind Desktop to the exact npm Nightly version
        id: identity
        env:
          VERSION_PATH: ${{ runner.temp }}/product-nightly-version/version.txt
        run: |
          node scripts/product-nightly.mjs inspect-version "$VERSION_PATH" "$GITHUB_OUTPUT"

  desktop:
    needs: identity
    strategy:
      fail-fast: false
      matrix:
        include:
          - platform: macos
            runner: macos-15
          - platform: windows
            runner: windows-2025
    runs-on: ${{ matrix.runner }}
    environment: nightly
    timeout-minutes: 75
    defaults:
      run:
        shell: bash
    env:
      MAKA_DESKTOP_NIGHTLY_VERSION: ${{ needs.identity.outputs.version }}
    steps:
      - name: Reject in-place workflow reruns
        if: github.run_attempt != 1
        run: |
          echo "Desktop Nightly retries require a fresh npm Nightly dispatch" >&2
          exit 1

      - name: Check out the exact Nightly source
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          ref: ${{ needs.identity.outputs.source_commit }}
          persist-credentials: false

      - name: Set up Node.js
        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version: '24'
          cache: npm

      - name: Install dependencies
        run: npm ci

      - name: Audit the shipped Desktop dependency closure
        run: |
          npm audit --omit=dev --audit-level=moderate
          node scripts/audit-shipped-dependencies.mjs

      - name: Update stable Rust for native Desktop artifacts
        run: rustup update stable --no-self-update

      - name: Write the App Store Connect API key
        if: matrix.platform == 'macos'
        env:
          APPLE_API_KEY_CONTENT: ${{ secrets.APPLE_API_KEY }}
          APPLE_API_KEY_PATH: ${{ runner.temp }}/AuthKey_Maka.p8
        run: |
          umask 077
          printf '%s' "$APPLE_API_KEY_CONTENT" > "$APPLE_API_KEY_PATH"

      - name: Package the signed and notarized macOS Nightly
        if: matrix.platform == 'macos'
        env:
          CSC_LINK: ${{ secrets.CSC_LINK }}
          CSC_KEY_PASSWORD: ${{ secrets.CSC_KEY_PASSWORD }}
          APPLE_API_KEY: ${{ runner.temp }}/AuthKey_Maka.p8
          APPLE_API_KEY_ID: ${{ secrets.APPLE_API_KEY_ID }}
          APPLE_API_ISSUER: ${{ secrets.APPLE_API_ISSUER }}
        run: npm run package:macos-arm64

      - name: Notarize and verify the macOS Nightly
        if: matrix.platform == 'macos'
        env:
          APPLE_API_KEY: ${{ runner.temp }}/AuthKey_Maka.p8
          APPLE_API_KEY_ID: ${{ secrets.APPLE_API_KEY_ID }}
          APPLE_API_ISSUER: ${{ secrets.APPLE_API_ISSUER }}
          DMG_PATH: apps/desktop/release/Maka-${{ needs.identity.outputs.version }}-mac-arm64.dmg
        run: |
          xcrun notarytool submit "$DMG_PATH" \
            --key "$APPLE_API_KEY" \
            --key-id "$APPLE_API_KEY_ID" \
            --issuer "$APPLE_API_ISSUER" \
            --wait
          xcrun stapler staple "$DMG_PATH"
          npm run verify:macos-arm64 -- "$DMG_PATH"

      - name: Package the Windows Nightly
        if: matrix.platform == 'windows'
        run: npm run package:windows-x64

      - name: Verify the Windows Nightly
        if: matrix.platform == 'windows'
        run: >-
          npm run verify:windows-x64 --
          "apps/desktop/release/Maka-${{ needs.identity.outputs.version }}-win-x64.exe"

      - name: Stage the exact Nightly artifacts
        env:
          NIGHTLY_VERSION: ${{ needs.identity.outputs.version }}
          STAGE_DIRECTORY: ${{ runner.temp }}/desktop-nightly
        run: |
          mkdir -p "$STAGE_DIRECTORY"
          if [[ "${{ matrix.platform }}" = macos ]]; then
            cp -- \
              "apps/desktop/release/Maka-$NIGHTLY_VERSION-mac-arm64.dmg" \
              "apps/desktop/release/Maka-$NIGHTLY_VERSION-mac-arm64.zip" \
              "apps/desktop/release/Maka-$NIGHTLY_VERSION-mac-arm64.zip.blockmap" \
              apps/desktop/release/dev-mac.yml \
              "$STAGE_DIRECTORY/"
          else
            cp -- \
              "apps/desktop/release/Maka-$NIGHTLY_VERSION-win-x64.exe" \
              "apps/desktop/release/Maka-$NIGHTLY_VERSION-win-x64.exe.blockmap" \
              "apps/desktop/release/Maka-$NIGHTLY_VERSION-win-x64.zip" \
              apps/desktop/release/dev.yml \
              "$STAGE_DIRECTORY/"
          fi

      - name: Preserve the verified Nightly artifacts
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: desktop-nightly-${{ matrix.platform }}
          path: ${{ runner.temp }}/desktop-nightly
          if-no-files-found: error
          compression-level: 0
          retention-days: 30

  publish:
    needs: [identity, desktop]
    runs-on: ubuntu-24.04
    environment: nightly
    timeout-minutes: 20
    permissions:
      artifact-metadata: write
      attestations: write
      contents: write
      id-token: write
    steps:
      - name: Reject in-place workflow reruns
        if: github.run_attempt != 1
        run: |
          echo "Desktop Nightly retries require a fresh npm Nightly dispatch" >&2
          exit 1

      - name: Check out the Nightly publisher
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          ref: ${{ needs.identity.outputs.source_commit }}
          persist-credentials: false

      - name: Set up Node.js
        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version: '24'
          cache: npm

      - name: Install publisher dependencies
        run: npm ci --ignore-scripts

      - name: Download both verified Desktop builds
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          pattern: desktop-nightly-*
          path: ${{ github.workspace }}/.nightly-input
          merge-multiple: true

      - name: Stage the exact GitHub Release assets
        env:
          NIGHTLY_VERSION: ${{ needs.identity.outputs.version }}
        run: |
          node scripts/desktop-nightly.mjs stage \
            "$GITHUB_WORKSPACE/.nightly-input" \
            "$GITHUB_WORKSPACE/.nightly-stage" \
            "$NIGHTLY_VERSION"

      - name: Attest every GitHub Nightly asset subject
        id: attest
        uses: actions/attest@1e69f48acb82d1966a394da916b4c1698aa569d6 # v4.2.2
        with:
          subject-path: ${{ github.workspace }}/.nightly-stage/release/*

      - name: Verify the issued Nightly provenance
        env:
          ATTESTATION_BUNDLE: ${{ steps.attest.outputs.bundle-path }}
          CERTIFICATE_IDENTITY: https://github.com/${{ github.repository }}/.github/workflows/desktop-nightly.yml@refs/heads/main
          GH_TOKEN: ${{ github.token }}
        run: |
          verified=0
          while IFS= read -r -d '' artifact; do
            gh attestation verify "$artifact" \
              --bundle "$ATTESTATION_BUNDLE" \
              --repo "$GITHUB_REPOSITORY" \
              --cert-identity "$CERTIFICATE_IDENTITY" \
              --cert-oidc-issuer https://token.actions.githubusercontent.com
            verified=$((verified + 1))
          done < <(find "$GITHUB_WORKSPACE/.nightly-stage/release" -maxdepth 1 -type f -print0)
          if (( verified != 8 )); then
            echo "Expected 8 verified Desktop Nightly subjects, found $verified" >&2
            exit 1
          fi

      - name: Add the one offline provenance bundle
        env:
          ATTESTATION_BUNDLE: ${{ steps.attest.outputs.bundle-path }}
          NIGHTLY_VERSION: ${{ needs.identity.outputs.version }}
        run: |
          node scripts/desktop-nightly.mjs add-attestation \
            "$GITHUB_WORKSPACE/.nightly-stage" \
            "$NIGHTLY_VERSION" \
            "$ATTESTATION_BUNDLE"

      - name: Ensure the exact versioned Nightly tag
        env:
          GH_TOKEN: ${{ github.token }}
          NIGHTLY_VERSION: ${{ needs.identity.outputs.version }}
          SOURCE_COMMIT: ${{ needs.identity.outputs.source_commit }}
        run: |
          gh auth setup-git
          node scripts/product-release-tag.mjs ensure "v$NIGHTLY_VERSION" "$SOURCE_COMMIT"

      - name: Prepare and verify the draft GitHub Prerelease
        env:
          GH_TOKEN: ${{ github.token }}
          NIGHTLY_VERSION: ${{ needs.identity.outputs.version }}
          SOURCE_COMMIT: ${{ needs.identity.outputs.source_commit }}
        run: |
          node scripts/desktop-nightly-release.mjs prepare \
            "$GITHUB_WORKSPACE/.nightly-stage/release" \
            "$NIGHTLY_VERSION" \
            "$SOURCE_COMMIT" \
            "$GITHUB_REPOSITORY"

      - name: Publish the complete GitHub Prerelease
        env:
          GH_TOKEN: ${{ github.token }}
          NIGHTLY_VERSION: ${{ needs.identity.outputs.version }}
          SOURCE_COMMIT: ${{ needs.identity.outputs.source_commit }}
        run: |
          node scripts/desktop-nightly-release.mjs publish \
            "$GITHUB_WORKSPACE/.nightly-stage/release" \
            "$NIGHTLY_VERSION" \
            "$SOURCE_COMMIT" \
            "$GITHUB_REPOSITORY"