PicList/.github/workflows/main.yml

name:  Build for release

on:
  workflow_dispatch:

env:
  ELECTRON_OUTPUT_PATH: ./dist_electron
  CSC_LINK: ${{ secrets.BUILD_CERTIFICATE_BASE64 }}
  CSC_KEY_PASSWORD: ${{ secrets.P12_PASSWORD }}
  USE_HARD_LINKS: false

jobs:
  release:
    name: Build

    runs-on: ${{ matrix.os }}

    strategy:
      fail-fast: false
      matrix:
        os: [ubuntu-latest, macos-15-intel, windows-latest, windows-11-arm, macos-latest]

    steps:

      - name: Set up git config
        run: |
          git config --global core.autocrlf false

      - name: Check out git repository
        uses: actions/checkout@v4

      # step2: sign
      - name: Install the Apple certificates
        if: matrix.os == 'macos-15-intel' || matrix.os == 'macos-latest'
        run: |
          CERTIFICATE_PATH=$RUNNER_TEMP/build_certificate.p12
          echo -n "$BUILD_CERTIFICATE_BASE64" | base64 --decode -o $CERTIFICATE_PATH

      # step3: install node env
      - name: Install Node.js
        uses: actions/setup-node@v4
        with:
          node-version: '22.x'

      - name: Install system deps
        if: matrix.os == 'ubuntu-latest'
        run: |
          sudo apt-get install --no-install-recommends -y icnsutils graphicsmagick xz-utils

      # step3: yarn
      - name: Install dependencies (macOS)
        if: matrix.os == 'macos-15-intel' || matrix.os == 'macos-latest'
        run: |
          yarn config set ignore-engines true
          yarn
          yarn global add xvfb-maybe

      - name: Install dependencies (Windows)
        if: matrix.os == 'windows-latest' || matrix.os == 'windows-11-arm'
        run: |
          yarn config set ignore-engines true
          yarn
          yarn global add xvfb-maybe
        
      - name: Yarn install linux
        if: matrix.os == 'ubuntu-latest'
        run: |
          yarn config set ignore-engines true
          yarn
          yarn global add xvfb-maybe

      - name: Modify electron-builder.json for Windows x64
        if: matrix.os == 'windows-latest'
        run: |
          # Remove arm64 from the arch array, keep only x64
          $config = Get-Content electron-builder.json | ConvertFrom-Json
          $config.win.target[0].arch = @("x64", "ia32")
          $config | ConvertTo-Json -Depth 10 | Set-Content electron-builder.json

      - name: Modify electron-builder.json for Windows ARM64
        if: matrix.os == 'windows-11-arm'
        run: |
          # Remove x64 from the arch array, keep only arm64
          $config = Get-Content electron-builder.json | ConvertFrom-Json
          $config.win.target[0].arch = @("arm64")
          $config | ConvertTo-Json -Depth 10 | Set-Content electron-builder.json

      - name: Modify electron-builder.json for Macos x64
        if: matrix.os == 'macos-15-intel'
        run: |
          # Remove arm64 from the arch array, keep only x64
          jq '.mac.target[0].arch = ["x64"]' electron-builder.json > tmp.json && mv tmp.json electron-builder.json

      - name: Modify electron-builder.json for Macos ARM64
        if: matrix.os == 'macos-latest'
        run: |
          # Remove x64 from the arch array, keep only arm64
          jq '.mac.target[0].arch = ["arm64"]' electron-builder.json > tmp.json && mv tmp.json electron-builder.json

      
      - name: Build & release app (signed)
        if: matrix.os != 'windows-11-arm'
        run: |
          yarn release
          yarn upload-dist
        env:
          GH_TOKEN: ${{ secrets.GH_TOKEN }}
          AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
          AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
          R2_SECRET_ID: ${{ secrets.R2_SECRET_ID }}
          R2_SECRET_KEY: ${{ secrets.R2_SECRET_KEY }}
          R2_ACCOUNT_ID: ${{ secrets.R2_ACCOUNT_ID }}
          ELECTRON_SKIP_NOTARIZATION: ${{ secrets.ELECTRON_SKIP_NOTARIZATION }}
          XCODE_APP_LOADER_EMAIL: ${{ secrets.XCODE_APP_LOADER_EMAIL }}
          XCODE_APP_LOADER_PASSWORD: ${{ secrets.XCODE_APP_LOADER_PASSWORD }}
          XCODE_TEAM_ID: ${{ secrets.XCODE_TEAM_ID }}
          BUILD_CERTIFICATE_BASE64: ${{ secrets.BUILD_CERTIFICATE_BASE64 }}
          P12_PASSWORD: ${{ secrets.P12_PASSWORD }}
          BUILD_PROVISION_PROFILE_BASE64: ${{ secrets.BUILD_PROVISION_PROFILE_BASE64 }}
          KEYCHAIN_PASSWORD: ${{ secrets.KEYCHAIN_PASSWORD }}
          USE_HARD_LINKS: false
          CSC_LINK: ${{ secrets.BUILD_CERTIFICATE_BASE64 }}
          CSC_KEY_PASSWORD: ${{ secrets.P12_PASSWORD }}

      - name: Build & release app (NO signing on Windows ARM)
        if: matrix.os == 'windows-11-arm'
        shell: pwsh
        run: |
          Remove-Item Env:CSC_LINK -ErrorAction SilentlyContinue
          Remove-Item Env:WIN_CSC_LINK -ErrorAction SilentlyContinue
          Remove-Item Env:CSC_KEY_PASSWORD -ErrorAction SilentlyContinue
          $env:CSC_IDENTITY_AUTO_DISCOVERY = "false"
          yarn release
          yarn upload-dist
        env:
          GH_TOKEN: ${{ secrets.GH_TOKEN }}
          AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
          AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
          R2_SECRET_ID: ${{ secrets.R2_SECRET_ID }}
          R2_SECRET_KEY: ${{ secrets.R2_SECRET_KEY }}
          R2_ACCOUNT_ID: ${{ secrets.R2_ACCOUNT_ID }}
          ELECTRON_SKIP_NOTARIZATION: ${{ secrets.ELECTRON_SKIP_NOTARIZATION }}
          USE_HARD_LINKS: false

      - name: Upload Windows x64 executables
        if: matrix.os == 'windows-latest'
        uses: actions/upload-artifact@v4
        with:
          name: windows-x64-executables
          path: |
            dist_electron/*
          retention-days: 30
          if-no-files-found: error

      - name: Upload Windows ARM64 executables
        if: matrix.os == 'windows-11-arm'
        uses: actions/upload-artifact@v4
        with:
          name: windows-arm64-executables
          path: |
            dist_electron/*
          retention-days: 30
          if-no-files-found: error

      - name: Upload macOS x64 packages
        if: matrix.os == 'macos-15-intel'
        uses: actions/upload-artifact@v4
        with:
          name: macos-x64-packages
          path: |
            dist_electron/*
          retention-days: 30
          if-no-files-found: error

      - name: Upload macOS ARM64 packages
        if: matrix.os == 'macos-latest'
        uses: actions/upload-artifact@v4
        with:
          name: macos-arm64-packages
          path: |
            dist_electron/*
          retention-days: 30
          if-no-files-found: error

      - name: Upload Linux packages
        if: matrix.os == 'ubuntu-latest'
        uses: actions/upload-artifact@v4
        with:
          name: linux-packages
          path: |
            dist_electron/*
          retention-days: 30
          if-no-files-found: ignore

      - name: Upload Windows x64 yml
        if: matrix.os == 'windows-latest'
        uses: actions/upload-artifact@v4
        with:
          name: windows-x64-yml
          path: |
            dist_electron/github/*
          retention-days: 30
          if-no-files-found: error

      - name: Upload Windows ARM64 yml
        if: matrix.os == 'windows-11-arm'
        uses: actions/upload-artifact@v4
        with:
          name: windows-arm64-yml
          path: |
            dist_electron/github/*
          retention-days: 30
          if-no-files-found: error

      - name: Upload macOS x64 yml
        if: matrix.os == 'macos-15-intel'
        uses: actions/upload-artifact@v4
        with:
          name: macos-x64-yml
          path: |
            dist_electron/github/*
          retention-days: 30
          if-no-files-found: error

      - name: Upload macOS ARM64 yml
        if: matrix.os == 'macos-latest'
        uses: actions/upload-artifact@v4
        with:
          name: macos-arm64-yml
          path: |
            dist_electron/github/*
          retention-days: 30
          if-no-files-found: error

      - name: Upload Linux yml
        if: matrix.os == 'ubuntu-latest'
        uses: actions/upload-artifact@v4
        with:
          name: linux-yml
          path: |
            dist_electron/github/*
          retention-days: 30
          if-no-files-found: ignore