package-app-prod.yml

# .github/workflows/publish-app.yml
name: "Package and Publish Desktop App"

on:
  workflow_dispatch:
    inputs:
      bypass_is_release:
        type: boolean
        required: false
        description: Bypass is release job
        default: false
  push:
    paths:
      - packages/app/**
    branches: [app-stable]

concurrency: production

jobs:
  check-app-workflows:
    name: Lints workflow
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3
      - name: Download actionlint
        id: download-actionlint
        run: bash <(curl https://raw.githubusercontent.com/rhysd/actionlint/7fdc9630cc360ea1a469eed64ac6d78caeda1234/scripts/download-actionlint.bash) 1.6.22
        shell: bash
      - name: Check workflow files
        run: ${{ steps.download-actionlint.outputs.executable }} -color .github/workflows/package-app-prod.yml
        shell: bash

  is-release:
    name: Determine whether this is a release merge commit
    runs-on: ubuntu-latest
    outputs:
      IS_RELEASE: ${{ steps.is-release.outputs.IS_RELEASE }}
    steps:
      - id: is-release
        if:  ${{ !github.event.inputs.bypass_is_release }}
        uses: MetaMask/action-is-release@v1
        with:
          commit-starts-with: 'Release App [version]'

  publish-app-release-draft:
    runs-on: ubuntu-latest
    needs: is-release
    if: ${{ needs.is-release.outputs.IS_RELEASE == 'true' || github.event.inputs.bypass_is_release }}
    permissions:
      contents: write
    steps:
      - uses: actions/checkout@v3
        with:
          ref: ${{ github.sha }}
      - name: Create Tag and Github Release
        id: tag-and-release
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        shell: bash
        run: |
          PACKAGE_JSON="./packages/app/package.json"
          RELEASE_VERSION="$(jq --raw-output .version $PACKAGE_JSON)"
          echo "v@$RELEASE_VERSION"
          gh release create "v$RELEASE_VERSION" -t "MetaMask Desktop v$RELEASE_VERSION" -F packages/app/CHANGELOG.md -d --target app-stable

  package-prod:
    needs: publish-app-release-draft
    environment: production
    runs-on: ${{ matrix.os }}
    strategy:
      matrix:
        os: [ubuntu-latest, windows-latest, macos-latest]
    permissions:
      contents: write
    steps:
      - name: Checkout Git Repository
        uses: actions/checkout@v3
        with:
          submodules: true
      - name: Setup Node.js
        uses: actions/setup-node@v3
        with:
          node-version-file: '.nvmrc'
      - name: Install deps
        shell: bash
        run: yarn install --immutable
      - name: Run common build
        shell: bash
        run: yarn common build
      - name: Run extension install deps
        shell: bash
        run: yarn extension
      - name: Setup desktop ui build
        shell: bash
        run: yarn setup:ui:build
      - name: Build desktop ui
        shell: bash
        run: yarn app build:ui:lavamoat:ci
        env:
          SENTRY_DSN: ${{ secrets.SENTRY_DSN }}
      - name: Build desktop app
        shell: bash
        run: yarn app build:app:prod
        env:
          INFURA_PROJECT_ID: ${{ secrets.INFURA_PROJECT_ID }}
          METAMASK_ENVIRONMENT: 'production'
          SEGMENT_WRITE_KEY: ${{ secrets.SEGMENT_WRITE_KEY }}
          SENTRY_DSN: ${{ secrets.SENTRY_DSN }}
          DESKTOP_ENABLE_UPDATES: ${{ vars.DESKTOP_ENABLE_UPDATES }}
          DESKTOP_POPUP: ${{ vars.DESKTOP_POPUP }}
          DISABLE_EXTENSION_POPUP: ${{ vars.DISABLE_EXTENSION_POPUP }}
      - name: Package app for ${{ matrix.os }}
        shell: bash
        run:  |
              if [ "$RUNNER_OS" == "Linux" ]; then
                yarn app package:linux:ci -p always
              elif [ "$RUNNER_OS" == "Windows" ]; then
                yarn app package:win:ci -p always
              elif [ "$RUNNER_OS" == "macOS" ]; then
                yarn app package:mac:ci -p always
              else
                echo "$RUNNER_OS not supported"
                exit 1
              fi
        env:
          WIN_CSC_LINK: ${{ secrets.MMD_WIN_CERT_BASE64 }}
          WIN_CSC_KEY_PASSWORD: ${{ secrets.MMD_WIN_CERT_PASSWORD }}
          CSC_LINK: ${{ secrets.MMD_MAC_CSC_BASE64 }}
          CSC_KEY_PASSWORD: ${{ secrets.MMD_MAC_CSC_KEY_PASSWORD }}
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          APPLE_ID: ${{ secrets.APPLE_ID }}
          APPLE_ID_PASSWORD: ${{ secrets.APPLE_ID_PASSWORD }}
          APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}