Moku/.github/workflows/build-macos.yml

name: Build macOS

on:
  workflow_dispatch:
    inputs:
      version:
        description: "Version to build (e.g. 0.4.0)"
        required: true

jobs:
  frontend:
    name: Build frontend
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - uses: pnpm/action-setup@v4
        with:
          version: latest

      - uses: actions/setup-node@v4
        with:
          node-version: 22
          cache: pnpm

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      - name: Build
        run: pnpm build

      - name: Upload dist
        uses: actions/upload-artifact@v4
        with:
          name: frontend-dist
          path: dist/
          retention-days: 1

  tauri:
    name: Tauri (macOS)
    needs: frontend
    runs-on: macos-latest
    permissions:
      contents: write

    steps:
      - uses: actions/checkout@v4

      - name: Download frontend dist
        uses: actions/download-artifact@v4
        with:
          name: frontend-dist
          path: dist/

      - name: Install Rust
        uses: dtolnay/rust-toolchain@stable
        with:
          targets: aarch64-apple-darwin,x86_64-apple-darwin

      - name: Rust cache
        uses: Swatinem/rust-cache@v2
        with:
          workspaces: src-tauri

      - uses: pnpm/action-setup@v4
        with:
          version: latest

      - uses: actions/setup-node@v4
        with:
          node-version: 22
          cache: pnpm

      - name: Install JS dependencies
        run: pnpm install --frozen-lockfile

      - name: Download Suwayomi binaries
        run: |
          download_suwayomi() {
            local asset="$1" sha="$2" outdir="$3"
            curl -fsSL \
              "https://github.com/Suwayomi/Suwayomi-Server/releases/download/v2.1.1867/${asset}" \
              -o "${outdir}.tar.gz"
            echo "${sha}  ${outdir}.tar.gz" | shasum -a 256 -c -
            mkdir -p "${outdir}"
            tar -xzf "${outdir}.tar.gz" -C "${outdir}" --strip-components=1
          }

          download_suwayomi \
            "Suwayomi-Server-v2.1.1867-macOS-arm64.tar.gz" \
            "c80abdbba29f7895e9556c6c9481368557d5f930b5f69bcb30639ba498925f3c" \
            "suwayomi-arm64"

          download_suwayomi \
            "Suwayomi-Server-v2.1.1867-macOS-x64.tar.gz" \
            "c7590aeb645dd7135a05b9f3ea1fee384a4abeb465c0b3638d5b738d20dfe174" \
            "suwayomi-x64"

      - name: Stage Suwayomi sidecars
        run: |
          mkdir -p src-tauri/binaries

          stage_arch() {
            local srcdir="$1"
            local arch="$2"
            local sidecar="src-tauri/binaries/suwayomi-server-${arch}"
            local bundle_dest="src-tauri/binaries/suwayomi-bundle-${arch}"

            JAR=$(find "$srcdir" -name "Suwayomi-Server.jar" | head -1)
            JAVA=$(find "$srcdir" -path "*/jre/bin/java" | head -1)

            if [ -z "$JAR" ]; then
              echo "ERROR: Suwayomi-Server.jar not found in $srcdir"
              find "$srcdir" -type f | head -30
              exit 1
            fi
            if [ -z "$JAVA" ]; then
              echo "ERROR: jre/bin/java not found in $srcdir"
              find "$srcdir" -type f | head -30
              exit 1
            fi

            echo "${arch}: jar=${JAR}  java=${JAVA}"

            cp -r "$srcdir" "$bundle_dest"

            # The launcher script is committed at src-tauri/binaries/suwayomi-launcher.sh
            # to avoid embedding a heredoc in YAML (which breaks GitHub Actions parsing).
            cp src-tauri/binaries/suwayomi-launcher.sh "$sidecar"
            chmod +x "$sidecar"
            echo "Staged sidecar: $sidecar"
          }

          stage_arch suwayomi-arm64 aarch64-apple-darwin
          stage_arch suwayomi-x64   x86_64-apple-darwin

      - name: Patch tauri.conf.json for CI
        run: |
          sed -i '' 's/"beforeBuildCommand": "pnpm build"/"beforeBuildCommand": ""/' src-tauri/tauri.conf.json

      # ── aarch64 build ──────────────────────────────────────────────────────
      - name: Swap bundle for aarch64
        run: |
          rm -rf src-tauri/binaries/suwayomi-bundle
          cp -r src-tauri/binaries/suwayomi-bundle-aarch64-apple-darwin \
                src-tauri/binaries/suwayomi-bundle

      - name: Build Tauri app (aarch64)
        run: pnpm tauri build --target aarch64-apple-darwin --config src-tauri/tauri.macos.conf.json
        env:
          # Ad-hoc signing ("-") ships without a Developer ID.
          # Gatekeeper will quarantine the app on other Macs — users must run:
          #   xattr -rd com.apple.quarantine Moku.app
          # To fix this properly, set APPLE_SIGNING_IDENTITY to your
          # "Developer ID Application: ..." cert name and add
          # APPLE_CERTIFICATE / APPLE_CERTIFICATE_PASSWORD / APPLE_ID /
          # APPLE_TEAM_ID / APPLE_APP_SPECIFIC_PASSWORD secrets for notarisation.
          APPLE_SIGNING_IDENTITY: ${{ secrets.APPLE_SIGNING_IDENTITY || '-' }}

      # ── x86_64 build ───────────────────────────────────────────────────────
      - name: Swap bundle for x86_64
        run: |
          rm -rf src-tauri/binaries/suwayomi-bundle
          cp -r src-tauri/binaries/suwayomi-bundle-x86_64-apple-darwin \
                src-tauri/binaries/suwayomi-bundle

      - name: Build Tauri app (x86_64)
        run: pnpm tauri build --target x86_64-apple-darwin --config src-tauri/tauri.macos.conf.json
        env:
          APPLE_SIGNING_IDENTITY: ${{ secrets.APPLE_SIGNING_IDENTITY || '-' }}

      # ── upload artifacts ───────────────────────────────────────────────────
      - name: Upload arm64 .dmg
        uses: actions/upload-artifact@v4
        with:
          name: moku-macos-arm64-${{ github.event.inputs.version }}
          path: src-tauri/target/aarch64-apple-darwin/release/bundle/dmg/*.dmg
          retention-days: 7

      - name: Upload x64 .dmg
        uses: actions/upload-artifact@v4
        with:
          name: moku-macos-x64-${{ github.event.inputs.version }}
          path: src-tauri/target/x86_64-apple-darwin/release/bundle/dmg/*.dmg
          retention-days: 7