build-electron.yml

name: Build Electron App

on:
  # Trigger on version tags (e.g., v0.1.0, v1.2.3)
  push:
    tags:
      - 'v*.*.*'

jobs:
  build:
    name: Build Windows
    runs-on: windows-latest
    env:
      AZURE_CLIENT_ID: ${{ secrets.AZURE_CLIENT_ID }}
      AZURE_TENANT_ID: ${{ secrets.AZURE_TENANT_ID }}
      AZURE_CLIENT_SECRET: ${{ secrets.AZURE_CLIENT_SECRET }}
      AZURE_ENDPOINT: ${{ secrets.AZURE_ENDPOINT }}
      AZURE_TRUSTED_SIGNING_ACCOUNT_NAME: ${{ secrets.AZURE_TRUSTED_SIGNING_ACCOUNT_NAME }}
      AZURE_CERTIFICATE_PROFILE_NAME: ${{ secrets.AZURE_CERTIFICATE_PROFILE_NAME }}

    steps:
      - name: Checkout repository
        uses: actions/checkout@v4
        with:
          fetch-depth: 0  # Required for electron-builder to generate proper version info

      - name: Set up Node.js
        uses: actions/setup-node@v4
        with:
          node-version: '22.19.0'
          cache: 'npm'
          cache-dependency-path: |
            app/package-lock.json
            frontend/package-lock.json

      - name: Install frontend dependencies
        working-directory: ./frontend
        run: npm ci

      - name: Security audit - Frontend
        working-directory: ./frontend
        run: npm audit --audit-level=moderate
        continue-on-error: true  # Don't fail build on audit issues, but report them

      - name: Build frontend
        working-directory: ./frontend
        run: npm run build

      - name: Install app dependencies
        working-directory: ./app
        run: npm ci

      - name: Security audit - Electron App
        working-directory: ./app
        run: npm audit --audit-level=moderate
        continue-on-error: true  # Don't fail build on audit issues, but report them

      - name: Build application
        working-directory: ./app
        run: npm run compile

      - name: Build Electron app (Windows)
        working-directory: ./app
        run: npm run dist:win
        env:
          GH_TOKEN: ${{ secrets.GH_TOKEN }}

      - name: Sign files with Azure Trusted Signing
        if: env.AZURE_CLIENT_ID != ''
        uses: azure/trusted-signing-action@v0
        with:
          azure-tenant-id: ${{ secrets.AZURE_TENANT_ID }}
          azure-client-id: ${{ secrets.AZURE_CLIENT_ID }}
          azure-client-secret: ${{ secrets.AZURE_CLIENT_SECRET }}
          endpoint: ${{ secrets.AZURE_ENDPOINT }}
          trusted-signing-account-name: ${{ secrets.AZURE_TRUSTED_SIGNING_ACCOUNT_NAME }}
          certificate-profile-name: ${{ secrets.AZURE_CERTIFICATE_PROFILE_NAME }}
          files-folder: ${{ github.workspace }}\app\dist
          files-folder-filter: exe
          file-digest: SHA256
          timestamp-rfc3161: http://timestamp.acs.microsoft.com
          timestamp-digest: SHA256

      - name: Update latest.yml with signed exe checksum
        if: env.AZURE_CLIENT_ID != ''
        working-directory: ./app
        run: node build/update-latest-yml.js

      - name: Upload to GitHub Release
        if: startsWith(github.ref, 'refs/tags/v') && env.AZURE_CLIENT_ID != ''
        uses: softprops/action-gh-release@v1
        with:
          files: |
            app/dist/*.exe
            app/dist/latest.yml
          prerelease: ${{ contains(github.ref, '-alpha') || contains(github.ref, '-beta') || contains(github.ref, '-rc') }}
        env:
          GITHUB_TOKEN: ${{ secrets.GH_TOKEN }}

      - name: Upload artifacts
        uses: actions/upload-artifact@v4
        with:
          name: windows-artifacts
          path: |
            app/dist/**/*
          retention-days: 30
          if-no-files-found: error

  build-macos:
    name: Build macOS
    runs-on: macos-latest
    env:
      # Map CI_MACOS_* secrets to env vars used by certificate import and electron-builder
      MACOS_SIGNING_IDENTITY: ${{ secrets.CI_MACOS_CERTIFICATE_ID }}
      MACOS_SIGNING_CERT: ${{ secrets.CI_MACOS_CERTIFICATE_BASE64 }}
      MACOS_SIGNING_CERT_PASSWORD: ${{ secrets.CI_MACOS_CERTIFICATE_PASSWORD }}
      MACOS_NOTARIZATION_USERNAME: ${{ secrets.CI_MACOS_NOTARIZATION_USER }}
      MACOS_NOTARIZATION_PASSWORD: ${{ secrets.CI_MACOS_NOTARIZATION_PASSWORD }}

    steps:
      - name: Checkout repository
        uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Set up Node.js
        uses: actions/setup-node@v4
        with:
          node-version: '22.19.0'
          cache: 'npm'
          cache-dependency-path: |
            app/package-lock.json
            frontend/package-lock.json

      - name: Install frontend dependencies
        working-directory: ./frontend
        run: npm ci

      - name: Security audit - Frontend
        working-directory: ./frontend
        run: npm audit --audit-level=moderate
        continue-on-error: true

      - name: Build frontend
        working-directory: ./frontend
        run: npm run build

      - name: Install app dependencies
        working-directory: ./app
        run: npm ci

      - name: Security audit - Electron App
        working-directory: ./app
        run: npm audit --audit-level=moderate
        continue-on-error: true

      - name: Build application
        working-directory: ./app
        run: npm run compile

      - name: Import Apple Developer ID certificate
        if: env.MACOS_SIGNING_CERT != ''
        run: |
          # Create a temporary keychain
          KEYCHAIN_PATH=$RUNNER_TEMP/app-signing.keychain-db
          KEYCHAIN_PASSWORD=$(openssl rand -base64 32)

          security create-keychain -p "$KEYCHAIN_PASSWORD" "$KEYCHAIN_PATH"
          security set-keychain-settings -lut 21600 "$KEYCHAIN_PATH"
          security unlock-keychain -p "$KEYCHAIN_PASSWORD" "$KEYCHAIN_PATH"

          # Import certificate
          CERT_PATH=$RUNNER_TEMP/certificate.p12
          echo "$MACOS_SIGNING_CERT" | base64 --decode > "$CERT_PATH"
          security import "$CERT_PATH" \
            -P "$MACOS_SIGNING_CERT_PASSWORD" \
            -A \
            -t cert \
            -f pkcs12 \
            -k "$KEYCHAIN_PATH"
          rm "$CERT_PATH"

          # Set keychain to be searched first
          security list-keychain -d user -s "$KEYCHAIN_PATH" login.keychain-db
          security set-key-partition-list -S apple-tool:,apple: -s -k "$KEYCHAIN_PASSWORD" "$KEYCHAIN_PATH"

      - name: Build Electron app (macOS)
        working-directory: ./app
        run: npm run dist:mac
        env:
          GH_TOKEN: ${{ secrets.GH_TOKEN }}
          # Skip code signing when no certificate is available
          CSC_IDENTITY_AUTO_DISCOVERY: ${{ env.MACOS_SIGNING_CERT != '' }}

      - name: Generate latest-mac.yml
        working-directory: ./app
        run: node build/update-latest-yml.js --platform mac

      - name: Upload to GitHub Release
        if: startsWith(github.ref, 'refs/tags/v') && env.MACOS_SIGNING_CERT != ''
        uses: softprops/action-gh-release@v1
        with:
          files: |
            app/dist/DaydreamScope-arm64.dmg
            app/dist/*.zip
            app/dist/latest-mac.yml
          prerelease: ${{ contains(github.ref, '-alpha') || contains(github.ref, '-beta') || contains(github.ref, '-rc') }}
        env:
          GITHUB_TOKEN: ${{ secrets.GH_TOKEN }}

      - name: Clean up keychain
        if: always()
        run: |
          KEYCHAIN_PATH=$RUNNER_TEMP/app-signing.keychain-db
          if [ -f "$KEYCHAIN_PATH" ]; then
            security delete-keychain "$KEYCHAIN_PATH"
          fi

      - name: Upload artifacts
        uses: actions/upload-artifact@v4
        with:
          name: macos-artifacts
          path: |
            app/dist/**/*
          retention-days: 30
          if-no-files-found: error