tauri-build.yml

name: "tauri-build"

on:
  workflow_dispatch:
  push:

jobs:
  publish-tauri:
    permissions:
      contents: write
    strategy:
      fail-fast: false
      matrix:
        include:
          - platform: "macos-latest" # for Arm based macs (M1 and above).
            name: macos-arm
            args: "--target aarch64-apple-darwin"
          - platform: "macos-latest" # for Intel based macs.
            name: macos-intel
            args: "--target x86_64-apple-darwin"
          - platform: "ubuntu-22.04"
            name: linux
            args: ""
          - platform: "windows-latest"
            name: windows
            args: ""

    runs-on: ${{ matrix.platform }}
    steps:
      - uses: actions/checkout@v4

      - name: install dependencies (ubuntu only)
        if: matrix.platform == 'ubuntu-22.04' # This must match the platform value defined above.
        run: |
          sudo apt-get update
          sudo apt-get install -y libwebkit2gtk-4.1-dev libappindicator3-dev librsvg2-dev libudev-dev patchelf

      - name: install dependencies (windows only)
        if: matrix.platform == 'windows-latest'
        run: |
          nuget.exe install Microsoft.Trusted.Signing.Client -Version 1.0.53 -x
          dir *

      - name: setup node
        uses: actions/setup-node@v4
        with:
          node-version: lts/*
          cache: "npm" # Set this to npm, yarn or pnpm.

      - name: install Rust stable
        uses: dtolnay/rust-toolchain@stable # Set this to dtolnay/rust-toolchain@nightly
        with:
          # Those targets are only used on macos runners so it's in an `if` to slightly speed up windows and linux builds.
          targets: ${{ matrix.platform == 'macos-latest' && 'aarch64-apple-darwin,x86_64-apple-darwin' || '' }}

      - name: Rust cache
        uses: swatinem/rust-cache@v2
        with:
          workspaces: "./src-tauri -> target"

      - name: install frontend dependencies
        # If you don't have `beforeBuildCommand` configured you may want to build your frontend here too.
        run: npm ci

      - uses: tauri-apps/tauri-action@v0
        name: build
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }}
          APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
          APPLE_SIGNING_IDENTITY: ${{ secrets.APPLE_SIGNING_IDENTITY }}
          APPLE_ID: ${{ secrets.APPLE_ID }}
          APPLE_PASSWORD: ${{ secrets.APPLE_PASSWORD }}
          APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
        with:
          args: ${{ matrix.args }}

      - name: Sign files with Trusted Signing
        uses: azure/trusted-signing-action@v0.4.0
        if: matrix.platform == 'windows-latest'
        with:
          azure-tenant-id: ${{ secrets.AZURE_TENANT_ID }}
          azure-client-id: ${{ secrets.AZURE_CLIENT_ID }}
          azure-client-secret: ${{ secrets.AZURE_CLIENT_SECRET }}
          endpoint: https://eus.codesigning.azure.net/
          trusted-signing-account-name: ZMKStudio
          certificate-profile-name: ZMKStudioCertProfile
          files-folder: ${{ github.workspace }}\src-tauri\target\release\
          files-folder-filter: exe,msi
          file-digest: SHA256
          timestamp-rfc3161: http://timestamp.acs.microsoft.com
          timestamp-digest: SHA256
      - uses: actions/upload-artifact@v4
        with:
          name: zmk-studio-${{ matrix.name }}
          path: |
            src-tauri/target/release/bundle/**/*.deb
            src-tauri/target/release/bundle/**/*.AppImage
            src-tauri/target/*/release/bundle/**/*.dmg
            src-tauri/target/*/release/bundle/**/*.app
            src-tauri/target/release/bundle/**/*.msi
            src-tauri/target/release/bundle/**/*.exe