fork-release.yml

name: Fork release

# Publishes installers for this fork as a GitHub Release on every push to main.
# release.yml needs upstream's Blacksmith runners, signing identities, and
# deploy secrets, so this reuses only its per-platform packaging
# (release-desktop.yml) on GitHub-hosted runners.
#
# Builds are unsigned and carry a -preview.YYYYMMDD.N version, which ships no
# update feed (see isDesktopPreviewVersion in scripts/build-desktop-artifact.ts).
# An install never auto-updates, so it cannot jump to an upstream build; install
# a newer release to update.

on:
  push:
    branches: [main]
  workflow_dispatch:

concurrency:
  group: fork-release
  cancel-in-progress: true

permissions:
  # release-desktop.yml's Windows job lists this run's artifacts to wait for the
  # Linux CLI archive it embeds.
  actions: read
  contents: read

jobs:
  bundle:
    name: Build JS bundle
    if: github.repository != 'pingdotgg/t3code'
    runs-on: ubuntu-24.04
    timeout-minutes: 60
    outputs:
      version: ${{ steps.meta.outputs.version }}
      clerk_publishable_key: ${{ steps.meta.outputs.clerk_publishable_key }}
      clerk_jwt_template: ${{ steps.meta.outputs.clerk_jwt_template }}
      clerk_cli_oauth_client_id: ${{ steps.meta.outputs.clerk_cli_oauth_client_id }}
      relay_url: ${{ steps.meta.outputs.relay_url }}
    steps:
      # checkout's credential cleanup runs submodule foreach, which fails on the
      # orphaned gitlinks in the vendored .repos tree.
      - name: Checkout
        shell: bash
        env:
          GIT_TERMINAL_PROMPT: "0"
        run: |
          set -euo pipefail
          git init .
          git remote add origin "${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}.git"
          git fetch --no-tags --depth=1 origin "$GITHUB_SHA"
          git sparse-checkout set --no-cone '/*' '!/.repos/'
          git checkout --detach FETCH_HEAD

      - name: Setup Vite+
        uses: voidzero-dev/setup-vp@250f29ce396baf5e8f24498e17c0dfdebabc26eb # v1
        with:
          node-version-file: package.json
          cache: true
          run-install: false

      - name: Install bundle dependencies
        run: vp install --filter=t3... --filter=@t3tools/web... --filter=@t3tools/desktop... --filter=@t3tools/scripts...

      # .env.example holds the public T3 Connect identifiers that official
      # builds bake in. release-desktop.yml takes them as inputs.
      - id: meta
        name: Resolve version and public configuration
        shell: bash
        run: |
          set -euo pipefail
          base_version="$(node -p "require('./apps/desktop/package.json').version")"
          version="${base_version}-preview.$(date -u +%Y%m%d).${GITHUB_RUN_NUMBER}"
          node scripts/update-release-package-versions.ts "$version"
          echo "version=$version" >> "$GITHUB_OUTPUT"

          cp .env.example .env
          for key in clerk_publishable_key:T3CODE_CLERK_PUBLISHABLE_KEY clerk_jwt_template:T3CODE_CLERK_JWT_TEMPLATE clerk_cli_oauth_client_id:T3CODE_CLERK_CLI_OAUTH_CLIENT_ID relay_url:T3CODE_RELAY_URL; do
            value="$(sed -n "s/^${key##*:}=//p" .env.example | head -n 1)"
            echo "${key%%:*}=${value}" >> "$GITHUB_OUTPUT"
          done

      - uses: ./.github/actions/setup-apt-mirrors

      - name: Install browser secret helper build libraries
        run: sudo apt-get update && sudo apt-get install -y libsecret-1-dev pkg-config

      - name: Setup Rust for server addons
        uses: dtolnay/rust-toolchain@6bed0761d98439e5a578e2877258200ad565ba87 # stable
        with:
          toolchain: stable

      - name: Build JS bundle
        run: vp run build:desktop

      # Same layout as release.yml's js-bundle so release-desktop.yml can
      # package it unchanged.
      - name: Upload JS bundle
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        with:
          name: js-bundle
          path: |
            apps/server/dist
            apps/desktop/dist-electron
          if-no-files-found: error
          retention-days: 1

  desktop:
    name: Desktop
    needs: bundle
    strategy:
      fail-fast: false
      matrix:
        include:
          - label: macOS arm64
            runner: macos-26
            platform: mac
            target: dmg
            arch: arm64
            rust_target: aarch64-apple-darwin
            resource_key: darwin-arm64
          # The Windows job waits for this job's CLI archive by its label.
          - label: Linux x64
            runner: ubuntu-24.04
            platform: linux
            target: AppImage
            arch: x64
            rust_target: x86_64-unknown-linux-gnu
            resource_key: linux-x64
          - label: Linux arm64
            runner: ubuntu-24.04-arm
            platform: linux
            target: AppImage
            arch: arm64
            rust_target: aarch64-unknown-linux-gnu
            resource_key: linux-arm64
          - label: Windows x64
            runner: windows-2025
            platform: win
            target: nsis
            arch: x64
            rust_target: x86_64-pc-windows-msvc
            resource_key: win32-x64
    uses: ./.github/workflows/release-desktop.yml
    with:
      version: ${{ needs.bundle.outputs.version }}
      ref: ${{ github.sha }}
      release_channel: preview
      relay_client_tracing: false
      clerk_publishable_key: ${{ needs.bundle.outputs.clerk_publishable_key }}
      clerk_jwt_template: ${{ needs.bundle.outputs.clerk_jwt_template }}
      clerk_cli_oauth_client_id: ${{ needs.bundle.outputs.clerk_cli_oauth_client_id }}
      relay_url: ${{ needs.bundle.outputs.relay_url }}
      label: ${{ matrix.label }}
      runner: ${{ matrix.runner }}
      platform: ${{ matrix.platform }}
      target: ${{ matrix.target }}
      arch: ${{ matrix.arch }}
      rust_target: ${{ matrix.rust_target }}
      resource_key: ${{ matrix.resource_key }}
      cli_archive: true

  publish:
    name: Publish GitHub Release
    needs: [bundle, desktop]
    runs-on: ubuntu-24.04
    timeout-minutes: 15
    permissions:
      contents: write
    steps:
      - name: Download desktop installers
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
        with:
          pattern: desktop-*
          path: assets
          merge-multiple: true

      - name: Download CLI archives
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
        with:
          pattern: cli-*
          path: assets
          merge-multiple: true

      - name: Publish release
        shell: bash
        env:
          GH_TOKEN: ${{ github.token }}
          VERSION: ${{ needs.bundle.outputs.version }}
        run: |
          set -euo pipefail
          short_sha="${GITHUB_SHA:0:12}"
          cat > notes.md <<EOF
          Built from ${GITHUB_REPOSITORY}@${short_sha}.

          These builds are unsigned and do not update themselves. To update, install a newer release.

          - **macOS (Apple silicon):** open the \`.dmg\` and drag the app to Applications. If macOS says the app is damaged, run \`xattr -dr com.apple.quarantine "/Applications/T3 Code (Beta).app"\`.
          - **Windows:** run the \`.exe\`. If SmartScreen blocks it, choose **More info**, then **Run anyway**.
          - **Linux:** \`chmod +x\` the \`.AppImage\`, then run it.
          - **CLI / headless server:** extract the \`t3\` archive for your platform.
          EOF
          gh release create "fork-v${VERSION}" assets/* \
            --repo "$GITHUB_REPOSITORY" \
            --target "$GITHUB_SHA" \
            --title "T3 Code ${VERSION}" \
            --notes-file notes.md \
            --latest