Build macOS and Windows installers for release 0.3.0

.github/workflows/release.yml

@@ -0,0 +1,182 @@
+name: Release installers
+
+on:
+  push:
+    tags: ["v*"]
+  workflow_dispatch:
+    inputs:
+      tag:
+        description: "Existing release tag, for example v0.3.0"
+        required: true
+        type: string
+
+permissions:
+  contents: read
+
+concurrency:
+  group: release-${{ inputs.tag || github.ref_name }}
+  cancel-in-progress: false
+
+jobs:
+  prepare:
+    runs-on: ubuntu-latest
+    outputs:
+      version: ${{ steps.version.outputs.version }}
+      tag: ${{ steps.version.outputs.tag }}
+      commit: ${{ steps.commit.outputs.sha }}
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          ref: ${{ inputs.tag && format('refs/tags/{0}', inputs.tag) || github.ref }}
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 24
+      - name: Check release versions
+        id: version
+        env:
+          RELEASE_TAG: ${{ inputs.tag || github.ref_name }}
+        run: node scripts/check-release-version.mjs "$RELEASE_TAG"
+      - name: Pin every build to this commit
+        id: commit
+        run: echo "sha=$(git rev-parse HEAD)" >> "$GITHUB_OUTPUT"
+
+  build:
+    name: Build ${{ matrix.platform }}
+    needs: prepare
+    runs-on: ${{ matrix.runner }}
+    timeout-minutes: 60
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - platform: macos-arm64
+            runner: macos-15
+          - platform: macos-x64
+            runner: macos-15-intel
+          - platform: windows-x64
+            runner: windows-2022
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          ref: ${{ needs.prepare.outputs.commit }}
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 24
+          cache: npm
+      - uses: dtolnay/rust-toolchain@stable
+        with:
+          components: clippy, rustfmt
+      - uses: Swatinem/rust-cache@v2
+        with:
+          workspaces: src-tauri
+          key: release-${{ matrix.platform }}
+      - run: npm ci
+      - run: npm test
+      - run: npm run build
+      - run: cargo test --locked --manifest-path src-tauri/Cargo.toml --all-targets
+      - run: cargo clippy --locked --manifest-path src-tauri/Cargo.toml --all-targets -- -D warnings
+      - name: Build macOS DMG
+        if: runner.os == 'macOS'
+        env:
+          APPLE_SIGNING_IDENTITY: "-"
+        run: npm run tauri:build:mac
+      - name: Build Windows EXE
+        if: runner.os == 'Windows'
+        run: npm run tauri:build:windows
+      - name: Collect versioned installer
+        env:
+          RELEASE_PLATFORM: ${{ matrix.platform }}
+        run: node scripts/collect-release.mjs
+      - uses: actions/upload-artifact@v4
+        with:
+          name: installer-${{ matrix.platform }}
+          path: release-artifacts/*
+          if-no-files-found: error
+          retention-days: 30
+
+  release:
+    name: Create draft release
+    needs: [prepare, build]
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    steps:
+      - uses: actions/download-artifact@v4
+        with:
+          pattern: installer-*
+          path: release-artifacts
+          merge-multiple: true
+      - name: Attach all installers to a draft release
+        uses: actions/github-script@v7
+        env:
+          RELEASE_VERSION: ${{ needs.prepare.outputs.version }}
+          RELEASE_TAG: ${{ needs.prepare.outputs.tag }}
+          RELEASE_COMMIT: ${{ needs.prepare.outputs.commit }}
+        with:
+          script: |
+            const fs = require('node:fs');
+            const path = require('node:path');
+            const crypto = require('node:crypto');
+            const { owner, repo } = context.repo;
+            const version = process.env.RELEASE_VERSION;
+            const tag = process.env.RELEASE_TAG;
+            const directory = 'release-artifacts';
+            const names = [
+              `Ker-Finance_${version}_macos-arm64.dmg`,
+              `Ker-Finance_${version}_macos-x64.dmg`,
+              `Ker-Finance_${version}_windows-x64-setup.exe`,
+            ];
+            for (const name of names) {
+              if (!fs.statSync(path.join(directory, name)).size) throw new Error(`Empty installer: ${name}`);
+            }
+            const sums = names.map(name => {
+              const data = fs.readFileSync(path.join(directory, name));
+              return `${crypto.createHash('sha256').update(data).digest('hex')}  ${name}`;
+            }).join('\n') + '\n';
+            fs.writeFileSync(path.join(directory, 'SHA256SUMS.txt'), sums);
+            names.push('SHA256SUMS.txt');
+            // A release tag must still point to the exact commit we built.
+            let tagged = (await github.rest.git.getRef({ owner, repo, ref: `tags/${tag}` })).data.object;
+            while (tagged.type === 'tag') {
+              tagged = (await github.rest.git.getTag({ owner, repo, tag_sha: tagged.sha })).data.object;
+            }
+            if (tagged.type !== 'commit' || tagged.sha !== process.env.RELEASE_COMMIT) {
+              throw new Error('Release tag changed during the build.');
+            }
+            let release;
+            try {
+              release = (await github.rest.repos.getReleaseByTag({ owner, repo, tag })).data;
+            } catch (error) {
+              if (error.status !== 404) throw error;
+              // The tag endpoint only returns published releases; find an existing draft before retrying.
+              const releases = await github.paginate(github.rest.repos.listReleases, { owner, repo });
+              release = releases.find(item => item.tag_name === tag);
+              if (!release) release = (await github.rest.repos.createRelease({
+                owner, repo, tag_name: tag, target_commitish: process.env.RELEASE_COMMIT,
+                name: `Kër Finance ${version}`, draft: true, prerelease: false,
+                body: [
+                  'Installateurs Kër Finance pour macOS (Apple Silicon et Intel) et Windows x64.',
+                  '',
+                  '- macos-arm64.dmg : Mac avec puce Apple Silicon.',
+                  '- macos-x64.dmg : Mac Intel.',
+                  '- windows-x64-setup.exe : installateur Windows 64 bits.',
+                  '- SHA256SUMS.txt : sommes de contrôle des trois installateurs.',
+                  '',
+                  'Les DMG sont signés ad hoc, sans notarisation Apple. L’EXE Windows ne possède pas de signature éditeur.',
+                  'Vérifiez les installateurs avant de publier ce brouillon.',
+                ].join('\n'),
+              })).data;
+            }
+            if (!release.draft) throw new Error('This release is already published; refusing to replace its assets.');
+            const existing = await github.paginate(github.rest.repos.listReleaseAssets, { owner, repo, release_id: release.id });
+            for (const name of names) {
+              const previous = existing.find(asset => asset.name === name);
+              if (previous) await github.rest.repos.deleteReleaseAsset({ owner, repo, asset_id: previous.id });
+              await github.rest.repos.uploadReleaseAsset({
+                owner, repo, release_id: release.id, name,
+                data: fs.readFileSync(path.join(directory, name)),
+              });
+            }
+            await core.summary.addHeading(`Kër Finance ${version}`)
+              .addLink('Review the draft release', release.html_url)
+              .addList(names).write();

.gitignore

@@ -6,3 +6,4 @@ src-tauri/target/
 .env
 .idea/
 .vscode/
+release-artifacts/