feat: complete release preparation, 10+ ad mediation, CI/CD, and docker deployment

.github/workflows/ci.yml

@@ -0,0 +1,106 @@
+# .github/workflows/ci.yml
+# Continuous Integration Pipeline for D3RO Voice Monorepo
+
+name: CI Pipeline
+
+on:
+  push:
+    branches:
+      - main
+      - develop
+      - 'feature/**'
+      - 'fix/**'
+  pull_request:
+    branches:
+      - main
+      - develop
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  # ──────────────────────────────────────────────────────────────────
+  # 1. Code Quality, Linting & Typecheck
+  # ──────────────────────────────────────────────────────────────────
+  code-quality:
+    name: Code Quality & Typecheck
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout Code
+        uses: actions/checkout@v4
+
+      - name: Setup Node.js 20 LTS
+        uses: actions/setup-node@v4
+        with:
+          node-version: 20
+          cache: 'npm'
+
+      - name: Install Dependencies
+        run: npm ci
+
+      - name: Lint Check
+        run: npm run lint
+        continue-on-error: true
+
+      - name: Typecheck All Workspaces
+        run: npm run typecheck
+
+  # ──────────────────────────────────────────────────────────────────
+  # 2. Automated Test Matrix (Windows / macOS / Ubuntu)
+  # ──────────────────────────────────────────────────────────────────
+  test-matrix:
+    name: Test Suite (${{ matrix.os }})
+    needs: code-quality
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [windows-latest, macos-latest, ubuntu-latest]
+    runs-on: ${{ matrix.os }}
+    steps:
+      - name: Checkout Code
+        uses: actions/checkout@v4
+
+      - name: Setup Node.js 20 LTS
+        uses: actions/setup-node@v4
+        with:
+          node-version: 20
+          cache: 'npm'
+
+      - name: Install Dependencies
+        run: npm ci
+
+      - name: Run Monorepo Test Suites (Vitest)
+        run: npm test
+
+  # ──────────────────────────────────────────────────────────────────
+  # 3. Build Validation for All Workspaces
+  # ──────────────────────────────────────────────────────────────────
+  build-validation:
+    name: Build Validation (${{ matrix.target }})
+    needs: code-quality
+    strategy:
+      matrix:
+        include:
+          - target: desktop
+            os: windows-latest
+            cmd: npm run build --workspace=@d3ro/desktop
+          - target: admin
+            os: ubuntu-latest
+            cmd: npm run build --workspace=@d3ro/admin
+    runs-on: ${{ matrix.os }}
+    steps:
+      - name: Checkout Code
+        uses: actions/checkout@v4
+
+      - name: Setup Node.js 20 LTS
+        uses: actions/setup-node@v4
+        with:
+          node-version: 20
+          cache: 'npm'
+
+      - name: Install Dependencies
+        run: npm ci
+
+      - name: Build Target Workspace
+        run: ${{ matrix.cmd }}

.github/workflows/release-signing-ca.yml

@@ -0,0 +1,97 @@
+name: Release & Code Signing CA Pipeline
+
+on:
+  push:
+    tags:
+      - 'v*'
+  workflow_dispatch:
+
+jobs:
+  build-and-sign-windows:
+    runs-on: windows-latest
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Setup Node.js 22
+        uses: actions/setup-node@v4
+        with:
+          node-version: 22
+          cache: 'npm'
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Typecheck & Test
+        run: |
+          npm run typecheck
+          npm run test --workspace=@d3ro/api-client
+
+      # Azure Trusted Signing (Artifact Signing) for SmartScreen Reputation
+      - name: Setup Azure Trusted Signing
+        if: env.AZURE_CLIENT_ID != ''
+        uses: azure/trusted-signing-action@v0.4.1
+        with:
+          azure-tenant-id: ${{ secrets.AZURE_TENANT_ID }}
+          azure-client-id: ${{ secrets.AZURE_CLIENT_ID }}
+          azure-client-secret: ${{ secrets.AZURE_CLIENT_SECRET }}
+          endpoint: ${{ secrets.AZURE_SIGNING_ENDPOINT }}
+          trusted-signing-account-name: ${{ secrets.AZURE_SIGNING_ACCOUNT }}
+          certificate-profile-name: ${{ secrets.AZURE_CERT_PROFILE }}
+
+      - name: Build and Package Windows (NSIS + RFC 3161 TSA)
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          RFC3161_TSA_SERVER: "http://timestamp.digicert.com"
+        run: |
+          npm run build --workspace=@d3ro/desktop
+          npx electron-builder --win --config apps/desktop/electron-builder.yml
+
+      - name: Upload Windows Artifacts
+        uses: actions/upload-artifact@v4
+        with:
+          name: d3ro-voice-windows
+          path: apps/desktop/release/*/*.exe
+
+  build-and-sign-macos:
+    runs-on: macos-latest
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Setup Node.js 22
+        uses: actions/setup-node@v4
+        with:
+          node-version: 22
+          cache: 'npm'
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Setup Apple Developer ID Certificate
+        if: env.APPLE_CERTIFICATE != ''
+        env:
+          APPLE_CERTIFICATE: ${{ secrets.MAC_CSC_LINK }}
+          APPLE_CERTIFICATE_PASSWORD: ${{ secrets.MAC_CSC_KEY_PASSWORD }}
+        run: |
+          echo "$APPLE_CERTIFICATE" | base64 --decode > certificate.p12
+          security create-keychain -p "" build.keychain
+          security default-keychain -s build.keychain
+          security unlock-keychain -p "" build.keychain
+          security import certificate.p12 -k build.keychain -P "$APPLE_CERTIFICATE_PASSWORD" -T /usr/bin/codesign
+          security set-key-partition-list -S apple-tool:,apple: -s -k "" build.keychain
+
+      - name: Build, Sign, and Notarize macOS (Gatekeeper CA)
+        env:
+          APPLE_ID: ${{ secrets.APPLE_ID }}
+          APPLE_APP_SPECIFIC_PASSWORD: ${{ secrets.APPLE_APP_SPECIFIC_PASSWORD }}
+          APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
+        run: |
+          npm run build --workspace=@d3ro/desktop
+          npx electron-builder --mac --config apps/desktop/electron-builder.yml
+
+      - name: Upload macOS Artifacts
+        uses: actions/upload-artifact@v4
+        with:
+          name: d3ro-voice-macos
+          path: apps/desktop/release/*/*.dmg

.github/workflows/release.yml

@@ -0,0 +1,183 @@
+# .github/workflows/release.yml
+# Multi-Platform Automated Release Pipeline for D3RO Voice Desktop & Admin
+
+name: Release & Packaging Pipeline
+
+on:
+  push:
+    tags:
+      - 'v*.*.*'
+  workflow_dispatch:
+    inputs:
+      version:
+        description: 'Release version (e.g. 1.0.0)'
+        required: true
+        default: '1.0.0'
+
+permissions:
+  contents: write
+  packages: write
+
+jobs:
+  # ──────────────────────────────────────────────────────────────────
+  # 1. Package Windows Installer (.exe & .blockmap & latest.yml)
+  # ──────────────────────────────────────────────────────────────────
+  package-windows:
+    name: Package Windows Desktop App
+    runs-on: windows-latest
+    steps:
+      - name: Checkout Code
+        uses: actions/checkout@v4
+
+      - name: Setup Node.js 20 LTS
+        uses: actions/setup-node@v4
+        with:
+          node-version: 20
+          cache: 'npm'
+
+      - name: Install Dependencies
+        run: npm ci
+
+      - name: Build All Workspaces
+        run: |
+          npm run typecheck
+          npm run build --workspace=@d3ro/desktop
+
+      - name: Package with Electron Builder (NSIS x64)
+        run: |
+          cd apps/desktop
+          npx electron-builder --win --x64 --config electron-builder.yml
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          CSC_LINK: ${{ secrets.WIN_CSC_LINK }}
+          CSC_KEY_PASSWORD: ${{ secrets.WIN_CSC_KEY_PASSWORD }}
+
+      - name: Upload Windows Build Artifacts
+        uses: actions/upload-artifact@v4
+        with:
+          name: windows-release-assets
+          path: |
+            apps/desktop/release/*/*.exe
+            apps/desktop/release/*/*.blockmap
+            apps/desktop/release/*/latest.yml
+
+  # ──────────────────────────────────────────────────────────────────
+  # 2. Package macOS Desktop App (.dmg & .zip & latest-mac.yml)
+  # ──────────────────────────────────────────────────────────────────
+  package-macos:
+    name: Package macOS Desktop App
+    runs-on: macos-latest
+    steps:
+      - name: Checkout Code
+        uses: actions/checkout@v4
+
+      - name: Setup Node.js 20 LTS
+        uses: actions/setup-node@v4
+        with:
+          node-version: 20
+          cache: 'npm'
+
+      - name: Install Dependencies
+        run: npm ci
+
+      - name: Build All Workspaces
+        run: |
+          npm run typecheck
+          npm run build --workspace=@d3ro/desktop
+
+      - name: Package with Electron Builder (DMG & ZIP arm64)
+        run: |
+          cd apps/desktop
+          npx electron-builder --mac --arm64 --config electron-builder.yml
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          CSC_LINK: ${{ secrets.MAC_CSC_LINK }}
+          CSC_KEY_PASSWORD: ${{ secrets.MAC_CSC_KEY_PASSWORD }}
+          APPLE_ID: ${{ secrets.APPLE_ID }}
+          APPLE_APP_SPECIFIC_PASSWORD: ${{ secrets.APPLE_APP_SPECIFIC_PASSWORD }}
+          APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
+
+      - name: Upload macOS Build Artifacts
+        uses: actions/upload-artifact@v4
+        with:
+          name: macos-release-assets
+          path: |
+            apps/desktop/release/*/*.dmg
+            apps/desktop/release/*/*.zip
+            apps/desktop/release/*/*.blockmap
+            apps/desktop/release/*/latest-mac.yml
+
+  # ──────────────────────────────────────────────────────────────────
+  # 3. Build & Containerize Admin Dashboard
+  # ──────────────────────────────────────────────────────────────────
+  package-admin-docker:
+    name: Build & Publish Admin Docker Image
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout Code
+        uses: actions/checkout@v4
+
+      - name: Set up Docker Buildx
+        uses: actions/setup-buildx-action@v3
+
+      - name: Log in to GitHub Container Registry (GHCR)
+        uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Extract metadata (tags, labels) for Docker
+        id: meta
+        uses: docker/metadata-action@v5
+        with:
+          images: ghcr.io/${{ github.repository }}/admin-console
+
+      - name: Build and push Docker image
+        uses: docker/build-push-action@v5
+        with:
+          context: .
+          file: ./Dockerfile.admin
+          push: ${{ github.event_name != 'pull_request' }}
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}
+
+  # ──────────────────────────────────────────────────────────────────
+  # 4. Create GitHub Release & Upload Checksums
+  # ──────────────────────────────────────────────────────────────────
+  publish-release:
+    name: Publish Official GitHub Release
+    needs: [package-windows, package-macos, package-admin-docker]
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout Code
+        uses: actions/checkout@v4
+
+      - name: Download Windows Artifacts
+        uses: actions/download-artifact@v4
+        with:
+          name: windows-release-assets
+          path: release-dist/
+
+      - name: Download macOS Artifacts
+        uses: actions/download-artifact@v4
+        with:
+          name: macos-release-assets
+          path: release-dist/
+
+      - name: Generate SHA-256 Checksums
+        run: |
+          cd release-dist
+          sha256sum * > SHA256SUMS.txt || shasum -a 256 * > SHA256SUMS.txt
+          cat SHA256SUMS.txt
+
+      - name: Create GitHub Release
+        uses: softprops/action-gh-release@v2
+        with:
+          files: |
+            release-dist/*
+          draft: false
+          prerelease: false
+          generate_release_notes: true
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}