release.yml

name: Release

on:
  workflow_dispatch:
    inputs:
      create_release:
        description: "create release"
        type: boolean
        default: false
      push_update_manifests:
        description: "push update manifests"
        type: boolean
        default: false
      updates_branch:
        description: "updates branch"
        type: string
        default: "main"
      sign:
        description: "sign"
        type: boolean
        default: false
      linux:
        description: "linux"
        type: boolean
        default: true
      macos:
        description: "macos"
        type: boolean
        default: true
      windows:
        description: "windows"
        type: boolean
        default: true

jobs:
  metadata:
    name: metadata
    runs-on: ubuntu-latest

    outputs:
      version: ${{ steps.version.outputs.version }}
      build_id: ${{ steps.get_build_id.outputs.build_id }}

    steps:
      - name: Inputs
        run: echo $INPUTS
        env:
          INPUTS: ${{ toJSON(inputs) }}

      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false

      - name: Configure git
        run: |
          git config --global \
            url."https://github.com/mozilla-firefox/firefox.git".insteadOf \
            "git@github.com:mozilla-firefox/firefox.git"

      - uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5.0.0

      - name: Setup Node.js
        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
        with:
          node-version: "24"
          cache: "pnpm"

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      - name: Get version
        id: version
        run: |
          echo "version=$(pnpm --silent tsn scripts/version.mts)" >> $GITHUB_OUTPUT

      - id: get_build_id
        run: |
          build_date=`date +"%Y%m%d%I%M%S"`
          echo "build_id=${build_date}" >> $GITHUB_OUTPUT
          echo "build_id=${build_date}"

      - name: Create draft release
        if: ${{ inputs.create_release }}
        run: |
          if gh release view $VERSION > /dev/null 2>&1; then
            gh release edit $VERSION --draft --title "$VERSION" --target "$RELEASE_SHA"
          else
            gh release create $VERSION --draft --title "$VERSION" --target "$RELEASE_SHA"
          fi
        env:
          GH_TOKEN: ${{ secrets.REPO_ACCESS_TOKEN }}
          VERSION: ${{ steps.version.outputs.version }}
          RELEASE_SHA: ${{ github.sha }}

  linux:
    if: ${{ inputs.linux }}

    name: Linux build
    uses: ./.github/workflows/linux-build.yml
    needs: [metadata]
    with:
      upload: true
      MOZ_BUILD_DATE: ${{ needs.metadata.outputs.build_id }}

  macos:
    if: ${{ inputs.macos }}

    name: macOS build
    uses: ./.github/workflows/macos-build.yml
    needs: [metadata]
    with:
      artifacts: true
      MOZ_BUILD_DATE: ${{ needs.metadata.outputs.build_id }}

  macos-sign:
    if: ${{ inputs.sign && inputs.macos }}

    name: macOS sign
    needs: [macos]
    uses: ./.github/workflows/macos-sign.yml

    secrets:
      MACOS_P12_BASE64: ${{ secrets.MACOS_P12_BASE64 }}
      MACOS_P12_PASSWORD: ${{ secrets.MACOS_P12_PASSWORD }}
      REPO_ACCESS_TOKEN: ${{ secrets.REPO_ACCESS_TOKEN }}
      APPLE_DEVELOPER_ID: ${{ secrets.APPLE_DEVELOPER_ID }}
      APPLE_ACCOUNT_ID: ${{ secrets.APPLE_ACCOUNT_ID }}
      APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
      APPLE_APP_ID_PASSWORD: ${{ secrets.APPLE_APP_ID_PASSWORD }}
      PROVISIONING_PROFILE_BASE64: ${{ secrets.PROVISIONING_PROFILE_BASE64 }}
    with:
      artifacts: true

  windows:
    if: ${{ inputs.windows }}

    name: Windows build
    uses: ./.github/workflows/windows-build.yml
    needs: [metadata]
    with:
      MOZ_BUILD_DATE: ${{ needs.metadata.outputs.build_id }}

  source:
    name: source
    runs-on: ubuntu-latest
    needs: [metadata]

    steps:
      - name: Checkout repository
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false

      - name: Configure git
        run: |
          git config --global \
            url."https://github.com/mozilla-firefox/firefox.git".insteadOf \
            "git@github.com:mozilla-firefox/firefox.git"

      - uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5.0.0

      - name: Setup Node.js
        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
        with:
          node-version: "24"
          cache: "pnpm"

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      - name: Bootstrap repo
        run: |
          pnpm bootstrap

      - name: Compress
        run: |
          tar \
            --exclude='./.git' \
            --use-compress-program=zstd \
            -hcf glide.source.tar.zst \
            -C engine .

      - name: Upload artifact
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
        with:
          retention-days: 10
          name: glide.source.tar.zst
          path: ./glide.source.tar.zst

  release:
    if: ${{ inputs.create_release && !failure() && !cancelled() }}

    name: Release
    runs-on: ubuntu-latest
    needs: [metadata, linux, macos, macos-sign, windows, source]
    environment: release

    steps:
      - name: Check release is not published
        run: |
          if gh release view $VERSION --json isDraft --jq '.isDraft' | grep -q 'false'; then
            echo -e "Error: Release $VERSION is already published. Refusing to continue."
            exit 1
          fi
        env:
          GH_TOKEN: ${{ secrets.REPO_ACCESS_TOKEN }}
          VERSION: ${{ needs.metadata.outputs.version }}

      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false

      - name: Download Linux build (aarch64)
        if: ${{ inputs.linux }}
        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
        with:
          name: glide.linux-aarch64.tar.xz

      - name: Download Linux build (x86_64)
        if: ${{ inputs.linux }}
        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
        with:
          name: glide.linux-x86_64.tar.xz

      - name: Download signed macOS DMG (aarch64)
        if: ${{ inputs.macos }}
        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
        with:
          name: glide.macos-aarch64.signed.dmg

      - name: Download signed macOS DMG (x86_64)
        if: ${{ inputs.macos }}
        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
        with:
          name: glide.macos-x86_64.signed.dmg

      - name: Download macOS MAR (aarch64)
        if: ${{ inputs.macos }}
        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
        with:
          name: macos-aarch64.mar

      - name: Download macOS MAR (x86_64)
        if: ${{ inputs.macos }}
        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
        with:
          name: macos-x86_64.mar

      - name: Download Windows installer (x86_64)
        if: ${{ inputs.windows }}
        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
        with:
          name: windows-x86_64.installer.exe

      - name: Download Windows installer (aarch64)
        if: ${{ inputs.windows }}
        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
        with:
          name: windows-aarch64.installer.exe

      - name: Download Windows MAR (x86_64)
        if: ${{ inputs.windows }}
        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
        with:
          name: windows-x86_64.mar

      - name: Download Windows MAR (aarch64)
        if: ${{ inputs.windows }}
        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
        with:
          name: windows-aarch64.mar

      - name: Download source tarball
        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
        with:
          name: glide.source.tar.zst

      - name: Upload artifacts to the release
        run: |
          upload() {
            enabled="$1"
            filename="$2"

            if [[ $enabled == "true" ]]; then
              echo "uploading $filename"
              gh release upload $VERSION $filename --clobber
            else
              echo "not uploading $filename as it was skipped"
            fi
          }

          upload $WINDOWS ./glide.windows-aarch64.installer.exe
          upload $WINDOWS ./glide.windows-x86_64.installer.exe
          upload $LINUX ./glide.linux-aarch64.tar.xz
          upload $LINUX ./glide.linux-x86_64.tar.xz
          upload $MACOS ./glide.macos-aarch64.dmg
          upload $MACOS ./glide.macos-x86_64.dmg
          upload true ./glide.source.tar.zst

          # MAR files
          upload $MACOS ./macos-aarch64.mar
          upload $MACOS ./macos-x86_64.mar
          upload $WINDOWS ./windows-aarch64.mar
          upload $WINDOWS ./windows-x86_64.mar
        env:
          MACOS: ${{ inputs.macos }}
          LINUX: ${{ inputs.linux }}
          WINDOWS: ${{ inputs.windows }}
          GH_TOKEN: ${{ secrets.REPO_ACCESS_TOKEN }}
          VERSION: ${{ needs.metadata.outputs.version }}

  push-update-manifests:
    if: ${{ inputs.push_update_manifests && !failure() && !cancelled() && (inputs.macos || inputs.windows) }}

    name: Push update manifests
    runs-on: ubuntu-latest
    needs: [release, metadata]

    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false

      - name: Checkout update-server repository
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          repository: glide-browser/update-server
          token: ${{ secrets.REPO_ACCESS_TOKEN }}
          path: update-server
          ref: ${{ inputs.updates_branch }}
          persist-credentials: true
          # zizmor: ignore[artipacked]
          # we push to the repo, so we do need to persist credentials

      - name: Download macOS updates (aarch64)
        if: ${{ inputs.macos }}
        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
        with:
          name: macos-aarch64-updates
          path: artifacts/macos-aarch64/

      - name: Download macOS updates (x86_64)
        if: ${{ inputs.macos }}
        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
        with:
          name: macos-x86_64-updates
          path: artifacts/macos-x86_64/

      - name: Download Windows updates (x86_64)
        if: ${{ inputs.windows }}
        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
        with:
          name: windows-x86_64-updates
          path: artifacts/windows-x86_64/

      - name: Download Windows updates (aarch64)
        if: ${{ inputs.windows }}
        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
        with:
          name: windows-aarch64-updates
          path: artifacts/windows-aarch64/

      - name: Debug
        run: |
          tree -Dh artifacts/

      - name: Copy update files to update-server
        run: |
          set -ex
          mkdir -p update-server/public/versions/latest/

          if [[ "$MACOS" == "true" ]]; then
            cp -r artifacts/macos-aarch64/* update-server/public/versions/latest/
            cp -r artifacts/macos-x86_64/* update-server/public/versions/latest/
          fi

          if [[ "$WINDOWS" == "true" ]]; then
            cp -r artifacts/windows-x86_64/* update-server/public/versions/latest/
            cp -r artifacts/windows-aarch64/* update-server/public/versions/latest/
          fi
        env:
          MACOS: ${{ inputs.macos }}
          WINDOWS: ${{ inputs.windows }}

      - name: Debug
        run: |
          tree -Dh update-server/public/

      - name: Commit and push updates
        working-directory: update-server
        run: |
          git config user.name "glide-updater"
          git config user.email "updates@glide-browser.app"

          git add -A .

          if git diff --staged --quiet; then
            echo "No changes to commit"
          else
            git commit -m "Add update files for version ${VERSION}"
            git push
          fi
        env:
          VERSION: "${{ needs.metadata.outputs.version }}"