release.yml

name: release

# Bundles are built from a tag, on the platform they target.
#
# Cross-compiling would be cheaper and would be wrong here: the recognition build links ONNX Runtime
# and sherpa-onnx, both C++ libraries whose prebuilt artefacts are per-platform, and a cross build
# that "succeeds" tends to produce a binary that fails to load them on the machine it was built for.
# Native runners cost minutes and remove a whole class of report we could not reproduce.
on:
  push:
    tags: ["v*"]
  # Buildable on demand, because the first time anyone finds out the release job is broken should
  # not be the day of a release.
  workflow_dispatch:

permissions:
  contents: write

jobs:
  bundle:
    strategy:
      # One platform failing should not cancel the others: a macOS toolchain problem is not a reason
      # to withhold the Linux build somebody is waiting for.
      fail-fast: false
      matrix:
        include:
          - os: ubuntu-latest
            target: x86_64-unknown-linux-gnu
          - os: ubuntu-24.04-arm
            target: aarch64-unknown-linux-gnu
          - os: macos-latest
            target: aarch64-apple-darwin
          - os: windows-latest
            target: x86_64-pc-windows-msvc
          # `aarch64-pc-windows-msvc` is absent on purpose — see the note in `ci.yml`. Opus has no
          # ARM64 Windows build in `audiopus_sys`, so the target cannot be produced at all yet.
          #
          # `x86_64-apple-darwin` is absent for a different reason, and not one we chose: ONNX
          # Runtime no longer ships a build for it. Microsoft's 1.28 and 1.29 releases carry
          # `onnxruntime-osx-arm64` and nothing else, and `ort-sys` 2.0.0-rc.13's prebuilt table
          # lists nine targets of which Intel macOS is not one. So the release job for it failed
          # with `no prebuilt binaries available for target x86_64-apple-darwin`.
          #
          # Pinning back to `ort` 2.0.0-rc.10, which did have Intel macOS binaries, does not work
          # either — that version has no `tls-rustls` feature, which `summo-vad` uses. The routes
          # left are building ONNX Runtime from source for one legacy platform, or dropping the
          # `models` feature there and shipping a build that cannot detect speech. Neither is worth
          # doing before somebody asks: Apple stopped selling Intel Macs in 2023, and an Intel Mac
          # user can still build from source, where cargo will tell them the same thing.

    runs-on: ${{ matrix.os }}
    steps:
      - uses: actions/checkout@v4

      - uses: dtolnay/rust-toolchain@stable

      - uses: pnpm/action-setup@v4
      - uses: actions/setup-node@v4
        with:
          node-version: 22
          cache: pnpm

      # ALSA headers: `summo-audio` links cpal, which needs them to build even though this bundle
      # never opens a microphone on CI.
      - name: System dependencies
        if: runner.os == 'Linux'
        run: sudo apt-get update && sudo apt-get install -y libasound2-dev autoconf automake libtool

      # Opus is built from source and linked in (`OPUS_STATIC=1` in `bundle.sh`), so the tarball
      # does not depend on a libopus that happens to be installed on the build machine. Building it
      # needs autotools, which no runner image ships.
      - name: Autotools, for building Opus from source
        if: runner.os == 'macOS'
        run: brew install autoconf automake libtool

      # No cache here, on purpose.
      #
      # A release is built from scratch. The first two attempts at this workflow failed on macOS and
      # Windows with `search path … not found` and `cannot open input file 'cargs.lib'` — a restored
      # `target/` that recorded paths into ONNX Runtime and sherpa-onnx caches which live in
      # `~/Library/Caches` on macOS and `AppData\Local` on Windows, and were not restored with it.
      #
      # That class of failure is worth ten minutes per platform to remove entirely. A cache exists
      # to make an answer arrive sooner; here the answer is an artefact somebody downloads, and one
      # built from a half-restored state is a download that fails on a stranger's machine. `ci.yml`
      # keeps its caches — being wrong there costs a re-run, not a release.

      # Bash on every platform, including Windows, where the runner ships Git Bash. One script that
      # knows the three differences (`.exe`, how to ask the linker for its libraries, which checksum
      # tool exists) beats three scripts that drift.
      - name: Bundle
        shell: bash
        run: ./scripts/bundle.sh

      # The smaller build, for anyone who wants the vault and the agent without 15 MB of ONNX
      # Runtime — a server, a container, a machine that will never record anything.
      - name: Bundle without recognition
        shell: bash
        run: ./scripts/bundle.sh --no-models

      # The claim the product is sold on, checked on the artefact that is about to be published
      # rather than on a debug build from a developer's machine.
      # `pnpm -C apps/web exec`, not `npx`. Playwright is a dev dependency of the web package, so in
      # a pnpm workspace its binary is in `apps/web/node_modules/.bin` and nowhere else — `npx`,
      # run from the repository root, found nothing and this step exited 127. It has done that on
      # every release run there has ever been, including the one that produced `v0.1.0`: a release
      # is the one workflow whose failures nobody sees until they need it.
      - name: First run
        if: runner.os == 'Linux'
        run: |
          pnpm -C apps/web exec playwright install --with-deps chromium
          node apps/web/e2e/first-run.mjs \
            "dist/summo-$(sed -n 's/^version = "\(.*\)"/\1/p' Cargo.toml | head -1)-${{ matrix.target }}/summo"

      - uses: actions/upload-artifact@v4
        with:
          name: summo-${{ matrix.target }}
          path: |
            dist/*.tar.gz
            dist/*.zip
            dist/*.sha256

      - name: Publish
        if: startsWith(github.ref, 'refs/tags/')
        uses: softprops/action-gh-release@v2
        with:
          files: |
            dist/*.tar.gz
            dist/*.zip
            dist/*.sha256
          # Written by hand. A changelog generated from commit subjects tells a user what changed in
          # the code; they want to know what changed for them.
          draft: true

  # The installers.
  #
  # This job did not exist, and the consequence was quiet: `scripts/sidecar.sh` and the whole desktop
  # shell were built by CI on every pull request and shipped to nobody. Every release of this
  # product so far has been a tarball with a command in it — which is the right thing for a server
  # and the wrong thing for the audience the app is drawn for.
  #
  # Separate from `bundle` rather than folded into it: a Tauri build needs the platform's webview
  # development libraries, it is the slower of the two, and a failure in it should not withhold the
  # tarball that has been shipping for months.
  installers:
    strategy:
      fail-fast: false
      matrix:
        include:
          - os: ubuntu-latest
            target: x86_64-unknown-linux-gnu
          - os: macos-latest
            target: aarch64-apple-darwin
          - os: windows-latest
            target: x86_64-pc-windows-msvc

    runs-on: ${{ matrix.os }}
    steps:
      - uses: actions/checkout@v4
      - uses: dtolnay/rust-toolchain@stable
      - uses: pnpm/action-setup@v4
      - uses: actions/setup-node@v4
        with:
          node-version: 22
          cache: pnpm

      - name: System dependencies
        if: runner.os == 'Linux'
        run: |
          sudo apt-get update
          sudo apt-get install -y libwebkit2gtk-4.1-dev libgtk-3-dev libayatana-appindicator3-dev \
            librsvg2-dev libasound2-dev autoconf automake libtool patchelf
      - name: Autotools, for building Opus from source
        if: runner.os == 'macOS'
        run: brew install autoconf automake libtool

      - run: pnpm install --frozen-lockfile

      # No cache, for the reason the tarball job gives at length: a release is built from scratch.
      #
      # `beforeBuildCommand` in `tauri.conf.json` builds the interface and stages the daemon, so
      # this one command produces the whole thing.
      - name: Build the installers
        # AppImage's tooling is itself an AppImage, and mounting one needs FUSE, which the runner
        # images stopped shipping. `linuxdeploy` then fails with nothing but "failed to run
        # linuxdeploy". The variable is the AppImage runtime's own answer: unpack and run instead
        # of mounting. Harmless everywhere else.
        env:
          APPIMAGE_EXTRACT_AND_RUN: 1
        run: pnpm -C apps/desktop exec tauri build

      # Started, before it is offered to anybody.
      #
      # Linux only, because that is the platform this can be done on without a signed build and a
      # logged-in session: the AppImage runs under a virtual display, spawns its daemon and answers.
      # It is the check that would have caught the version of this bundle whose daemon exited on a
      # missing library — which was published, downloaded, and opened a window with nothing in it.
      #
      # macOS and Windows go out with the contents checked and nothing run. Saying which is which
      # is better than implying both were tested.
      - name: The app starts, and its daemon answers
        if: runner.os == 'Linux'
        run: |
          sudo apt-get install -y xvfb
          ./scripts/smoke-desktop.sh \
            "$(find apps/desktop/src-tauri/target/release/bundle/appimage -name '*.AppImage' | head -1)"

      # The same check on the Mac, which is the only Mac this project has.
      #
      # A user opened the 0.2.0 build and was told "Summo is damaged and can't be opened". Not a
      # warning about an unknown developer — a refusal: Apple Silicon will not run a binary with no
      # signature at all, and the bundle had none, because the sidecar daemon and its libraries are
      # copied in as resources. The bundle is ad-hoc signed now, and this runs the result: the
      # signature is verified and the app is started, which is the pair of facts nobody had checked
      # on this platform.
      - name: The Mac app is signed, starts, and its daemon answers
        if: runner.os == 'macOS'
        run: |
          ./scripts/smoke-desktop.sh \
            "$(find apps/desktop/src-tauri/target/release/bundle/macos -maxdepth 1 -name '*.app' | head -1)"

      # No certificate on any platform, and two different consequences.
      #
      # Windows shows a SmartScreen warning and lets the user through. macOS is stricter and the
      # first version of this comment got it wrong: on Apple Silicon an *unsigned* binary is not
      # "unverified", it is refused outright — "Summo is damaged and can't be opened", which is what
      # a user was actually shown. The bundle is now ad-hoc signed (`signingIdentity: "-"`), which
      # is free and takes it back to the warning it should have been: right-click → Open, once.
      # Removing the warning entirely needs a Developer ID certificate and notarisation, which is a
      # paid Apple account and a decision for whoever owns it.
      #
      # Until then a user who double-clicks still meets Gatekeeper's quarantine flag, so the release
      # notes carry the one-line way past it:
      #   xattr -dr com.apple.quarantine /Applications/Summo.app
      - uses: actions/upload-artifact@v4
        with:
          name: summo-installers-${{ matrix.target }}
          path: |
            apps/desktop/src-tauri/target/release/bundle/deb/*.deb
            apps/desktop/src-tauri/target/release/bundle/appimage/*.AppImage
            apps/desktop/src-tauri/target/release/bundle/dmg/*.dmg
            apps/desktop/src-tauri/target/release/bundle/msi/*.msi
            apps/desktop/src-tauri/target/release/bundle/nsis/*.exe

      - name: Publish
        if: startsWith(github.ref, 'refs/tags/')
        uses: softprops/action-gh-release@v2
        with:
          files: |
            apps/desktop/src-tauri/target/release/bundle/deb/*.deb
            apps/desktop/src-tauri/target/release/bundle/appimage/*.AppImage
            apps/desktop/src-tauri/target/release/bundle/dmg/*.dmg
            apps/desktop/src-tauri/target/release/bundle/msi/*.msi
            apps/desktop/src-tauri/target/release/bundle/nsis/*.exe
          draft: true

  # The phone build, published only when there is a key to sign it with.
  #
  # An unsigned `.apk` attached to a release is worse than none: it downloads, and then the phone
  # refuses to install it, and the person who tried has no way to know why. So this job produces one
  # on every tag and attaches it only if it was signed.
  android:
    runs-on: ubuntu-latest
    timeout-minutes: 90
    steps:
      - uses: actions/checkout@v4
      - uses: dtolnay/rust-toolchain@stable
      - run: rustup target add aarch64-linux-android
      - uses: actions/setup-java@v4
        with:
          distribution: temurin
          java-version: 21
      - uses: android-actions/setup-android@v3
      - name: The NDK
        run: |
          sdkmanager --install "ndk;27.2.12479018" > /dev/null
          echo "NDK_HOME=$ANDROID_HOME/ndk/27.2.12479018" >> "$GITHUB_ENV"
          # bindgen runs its own clang, and it does not inherit the cross-compiler's header paths.
          # `sherpa-rs-sys` generates bindings, so without this it reads the *host's*
          # `/usr/include` and dies on `bits/libc-header-start.h` — several hundred crates into an
          # otherwise correct Android build, and only since recognition was enabled for arm64.
          sysroot="$ANDROID_HOME/ndk/27.2.12479018/toolchains/llvm/prebuilt/linux-x86_64/sysroot"
          echo "BINDGEN_EXTRA_CLANG_ARGS_aarch64_linux_android=--sysroot=$sysroot --target=aarch64-linux-android26" >> "$GITHUB_ENV"
      - name: Opus for arm64
        run: |
          echo "OPUS_LIB_DIR=$(./scripts/opus-android.sh arm64-v8a | tail -1)" >> "$GITHUB_ENV"
          echo "OPUS_STATIC=1" >> "$GITHUB_ENV"
      - uses: pnpm/action-setup@v4
      - uses: actions/setup-node@v4
        with:
          node-version: 22
          cache: pnpm
      - run: pnpm install --frozen-lockfile

      - name: The signing key, if this repository has one
        id: key
        env:
          KEYSTORE: ${{ secrets.ANDROID_KEYSTORE_BASE64 }}
        if: env.KEYSTORE != ''
        run: |
          echo "$KEYSTORE" | base64 -d > "$RUNNER_TEMP/summo.keystore"
          echo "ANDROID_KEYSTORE=$RUNNER_TEMP/summo.keystore" >> "$GITHUB_ENV"
          echo "ANDROID_KEYSTORE_PASSWORD=${{ secrets.ANDROID_KEYSTORE_PASSWORD }}" >> "$GITHUB_ENV"
          echo "ANDROID_KEY_ALIAS=${{ secrets.ANDROID_KEY_ALIAS }}" >> "$GITHUB_ENV"
          echo "ANDROID_KEY_PASSWORD=${{ secrets.ANDROID_KEY_PASSWORD }}" >> "$GITHUB_ENV"
          echo "signed=true" >> "$GITHUB_OUTPUT"

      - run: pnpm -C apps/mobile exec tauri android init --skip-targets-install
      - run: pnpm -C apps/mobile exec tauri android build --apk --target aarch64

      - uses: actions/upload-artifact@v4
        with:
          name: summo-android-arm64
          path: apps/mobile/src-tauri/gen/android/app/build/outputs/apk/**/*.apk

      - name: Publish
        if: startsWith(github.ref, 'refs/tags/') && steps.key.outputs.signed == 'true'
        uses: softprops/action-gh-release@v2
        with:
          files: apps/mobile/src-tauri/gen/android/app/build/outputs/apk/**/*.apk
          draft: true