synor/.github/workflows/release-wallet.yml

name: Release Desktop Wallet

on:
  push:
    tags:
      - 'wallet-v*'
  workflow_dispatch:
    inputs:
      draft:
        description: 'Create as draft release'
        required: false
        default: true
        type: boolean

env:
  CARGO_TERM_COLOR: always

permissions:
  contents: write

jobs:
  build-tauri:
    name: Build Wallet (${{ matrix.platform }})
    strategy:
      fail-fast: false
      matrix:
        include:
          - platform: macos-latest
            target: aarch64-apple-darwin
            artifact-suffix: macos-aarch64
          - platform: macos-latest
            target: x86_64-apple-darwin
            artifact-suffix: macos-x86_64
          - platform: windows-latest
            target: x86_64-pc-windows-msvc
            artifact-suffix: windows-x86_64

    runs-on: ${{ matrix.platform }}

    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: 20

      - name: Install pnpm
        run: npm install -g pnpm

      - name: Setup Rust
        uses: dtolnay/rust-action@stable
        with:
          targets: ${{ matrix.target }}

      - name: Install dependencies (macOS)
        if: matrix.platform == 'macos-latest'
        run: |
          brew install rocksdb

      - name: Cache cargo registry
        uses: actions/cache@v4
        with:
          path: |
            ~/.cargo/bin/
            ~/.cargo/registry/index/
            ~/.cargo/registry/cache/
            ~/.cargo/git/db/
          key: ${{ runner.os }}-${{ matrix.target }}-cargo-wallet-${{ hashFiles('**/Cargo.lock') }}
          restore-keys: |
            ${{ runner.os }}-${{ matrix.target }}-cargo-wallet-

      - name: Cache pnpm store
        uses: actions/cache@v4
        with:
          path: ~/.pnpm-store
          key: ${{ runner.os }}-pnpm-store-${{ hashFiles('apps/desktop-wallet/pnpm-lock.yaml') }}
          restore-keys: |
            ${{ runner.os }}-pnpm-store-

      - name: Install frontend dependencies
        working-directory: apps/desktop-wallet
        run: pnpm install

      - name: Build Tauri app
        uses: tauri-apps/tauri-action@v0
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          # macOS code signing (optional - set these secrets in GitHub)
          APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }}
          APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
          APPLE_SIGNING_IDENTITY: ${{ secrets.APPLE_SIGNING_IDENTITY }}
          APPLE_ID: ${{ secrets.APPLE_ID }}
          APPLE_PASSWORD: ${{ secrets.APPLE_PASSWORD }}
          APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
          # Tauri updater signing (optional - for auto-updates)
          TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
          TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
        with:
          projectPath: apps/desktop-wallet
          tagName: wallet-v__VERSION__
          releaseName: 'Synor Wallet v__VERSION__'
          releaseBody: |
            ## Synor Desktop Wallet

            A secure desktop wallet for the Synor blockchain network with post-quantum cryptography support (Dilithium3).

            ### Installation

            **macOS:**
            - Download the `.dmg` file for your architecture (Intel or Apple Silicon)
            - Open the DMG and drag Synor Wallet to Applications
            - First launch: Right-click → Open (to bypass Gatekeeper if not code-signed)

            **Windows:**
            - Download the `.msi` installer
            - Run the installer and follow the prompts
            - Or download the `.exe` for portable installation

            ### Features
            - 24-word BIP39 mnemonic generation
            - Post-quantum Dilithium3 signatures
            - OS keychain integration (macOS Keychain, Windows Credential Manager)
            - System tray support
            - Auto-updates (when signed)

            ### Security Note
            Always verify the checksums of downloaded files.
          releaseDraft: ${{ github.event.inputs.draft || true }}
          prerelease: ${{ contains(github.ref, 'alpha') || contains(github.ref, 'beta') || contains(github.ref, 'rc') }}
          args: --target ${{ matrix.target }}

  # Build Linux AppImage separately (needs different runner config)
  build-linux:
    name: Build Wallet (Linux)
    runs-on: ubuntu-22.04

    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: 20

      - name: Install pnpm
        run: npm install -g pnpm

      - name: Setup Rust
        uses: dtolnay/rust-action@stable

      - name: Install system dependencies
        run: |
          sudo apt-get update
          sudo apt-get install -y \
            libgtk-3-dev \
            libwebkit2gtk-4.0-dev \
            libappindicator3-dev \
            librsvg2-dev \
            patchelf \
            libclang-dev \
            llvm-dev

      - name: Cache cargo registry
        uses: actions/cache@v4
        with:
          path: |
            ~/.cargo/bin/
            ~/.cargo/registry/index/
            ~/.cargo/registry/cache/
            ~/.cargo/git/db/
          key: ${{ runner.os }}-cargo-wallet-${{ hashFiles('**/Cargo.lock') }}
          restore-keys: |
            ${{ runner.os }}-cargo-wallet-

      - name: Cache pnpm store
        uses: actions/cache@v4
        with:
          path: ~/.pnpm-store
          key: ${{ runner.os }}-pnpm-store-${{ hashFiles('apps/desktop-wallet/pnpm-lock.yaml') }}
          restore-keys: |
            ${{ runner.os }}-pnpm-store-

      - name: Install frontend dependencies
        working-directory: apps/desktop-wallet
        run: pnpm install

      - name: Build Tauri app
        uses: tauri-apps/tauri-action@v0
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
          TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
        with:
          projectPath: apps/desktop-wallet
          tagName: wallet-v__VERSION__
          releaseName: 'Synor Wallet v__VERSION__'
          releaseBody: ''
          releaseDraft: ${{ github.event.inputs.draft || true }}
          prerelease: ${{ contains(github.ref, 'alpha') || contains(github.ref, 'beta') || contains(github.ref, 'rc') }}