d3ro-voice/.github/workflows/release.yml

# .github/workflows/release.yml
# Multi-Platform Automated Release Pipeline for D3RO Voice Desktop & Admin

name: Release & Packaging Pipeline

on:
  push:
    tags:
      - 'v*.*.*'
  workflow_dispatch:
    inputs:
      version:
        description: 'Release version (e.g. 1.0.0)'
        required: true
        default: '1.0.0'

permissions:
  contents: write
  packages: write

jobs:
  # ──────────────────────────────────────────────────────────────────
  # 1. Package Windows Installer (.exe & .blockmap & latest.yml)
  # ──────────────────────────────────────────────────────────────────
  package-windows:
    name: Package Windows Desktop App
    runs-on: windows-latest
    steps:
      - name: Checkout Code
        uses: actions/checkout@v4

      - name: Setup Node.js 20 LTS
        uses: actions/setup-node@v4
        with:
          node-version: 20
          cache: 'npm'

      - name: Install Dependencies
        run: npm ci

      - name: Build All Workspaces
        run: |
          npm run typecheck
          npm run build --workspace=@d3ro/desktop

      - name: Package with Electron Builder (NSIS x64)
        run: |
          cd apps/desktop
          npx electron-builder --win --x64 --config electron-builder.yml
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          CSC_LINK: ${{ secrets.WIN_CSC_LINK }}
          CSC_KEY_PASSWORD: ${{ secrets.WIN_CSC_KEY_PASSWORD }}

      - name: Upload Windows Build Artifacts
        uses: actions/upload-artifact@v4
        with:
          name: windows-release-assets
          path: |
            apps/desktop/release/*/*.exe
            apps/desktop/release/*/*.blockmap
            apps/desktop/release/*/latest.yml

  # ──────────────────────────────────────────────────────────────────
  # 2. Package macOS Desktop App (.dmg & .zip & latest-mac.yml)
  # ──────────────────────────────────────────────────────────────────
  package-macos:
    name: Package macOS Desktop App
    runs-on: macos-latest
    steps:
      - name: Checkout Code
        uses: actions/checkout@v4

      - name: Setup Node.js 20 LTS
        uses: actions/setup-node@v4
        with:
          node-version: 20
          cache: 'npm'

      - name: Install Dependencies
        run: npm ci

      - name: Build All Workspaces
        run: |
          npm run typecheck
          npm run build --workspace=@d3ro/desktop

      - name: Package with Electron Builder (DMG & ZIP arm64)
        run: |
          cd apps/desktop
          npx electron-builder --mac --arm64 --config electron-builder.yml
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          CSC_LINK: ${{ secrets.MAC_CSC_LINK }}
          CSC_KEY_PASSWORD: ${{ secrets.MAC_CSC_KEY_PASSWORD }}
          APPLE_ID: ${{ secrets.APPLE_ID }}
          APPLE_APP_SPECIFIC_PASSWORD: ${{ secrets.APPLE_APP_SPECIFIC_PASSWORD }}
          APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}

      - name: Upload macOS Build Artifacts
        uses: actions/upload-artifact@v4
        with:
          name: macos-release-assets
          path: |
            apps/desktop/release/*/*.dmg
            apps/desktop/release/*/*.zip
            apps/desktop/release/*/*.blockmap
            apps/desktop/release/*/latest-mac.yml

  # ──────────────────────────────────────────────────────────────────
  # 3. Build & Containerize Admin Dashboard
  # ──────────────────────────────────────────────────────────────────
  package-admin-docker:
    name: Build & Publish Admin Docker Image
    runs-on: ubuntu-latest
    steps:
      - name: Checkout Code
        uses: actions/checkout@v4

      - name: Set up Docker Buildx
        uses: actions/setup-buildx-action@v3

      - name: Log in to GitHub Container Registry (GHCR)
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Extract metadata (tags, labels) for Docker
        id: meta
        uses: docker/metadata-action@v5
        with:
          images: ghcr.io/${{ github.repository }}/admin-console

      - name: Build and push Docker image
        uses: docker/build-push-action@v5
        with:
          context: .
          file: ./Dockerfile.admin
          push: ${{ github.event_name != 'pull_request' }}
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}

  # ──────────────────────────────────────────────────────────────────
  # 4. Create GitHub Release & Upload Checksums
  # ──────────────────────────────────────────────────────────────────
  publish-release:
    name: Publish Official GitHub Release
    needs: [package-windows, package-macos, package-admin-docker]
    runs-on: ubuntu-latest
    steps:
      - name: Checkout Code
        uses: actions/checkout@v4

      - name: Download Windows Artifacts
        uses: actions/download-artifact@v4
        with:
          name: windows-release-assets
          path: release-dist/

      - name: Download macOS Artifacts
        uses: actions/download-artifact@v4
        with:
          name: macos-release-assets
          path: release-dist/

      - name: Generate SHA-256 Checksums
        run: |
          cd release-dist
          sha256sum * > SHA256SUMS.txt || shasum -a 256 * > SHA256SUMS.txt
          cat SHA256SUMS.txt

      - name: Create GitHub Release
        uses: softprops/action-gh-release@v2
        with:
          files: |
            release-dist/*
          draft: false
          prerelease: false
          generate_release_notes: true
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}