desktop_auto_release.yml

name: Build Desktop Release Candidate

on:
  workflow_dispatch:
  # Continuous deployment: plan a beta candidate on every macOS-affecting merge to
  # main. The candidate flows through the two-machine qualification pipeline
  # (desktop_qualify_beta.yml: Codemagic primary lane + self-hosted qualify-m1-studio
  # and qualify-m4-mini fallbacks); on qualification success desktop_promote_beta.yml
  # advances the beta channel to the Codemagic-built, notarized, Sparkle-signed
  # artifact. The push filter is intentionally coarse (the planner does the precise
  # releasable-change check, excluding CHANGELOG/AGENTS/changelog/Backend-Rust); the
  # quiet-window, exact-SHA, and one-active-release fences still admit at most one
  # candidate at a time, so bursts collapse to the newest SHA. Keep these paths in
  # lockstep with DESKTOP_RELEASE_PATHS in plan-desktop-release.py; the alignment is
  # enforced by test_push_paths_cover_releasable_desktop_paths.
  push:
    branches: [main]
    paths:
      - 'desktop/macos/**'
      - 'codemagic.yaml'
      - '.github/scripts/plan-desktop-release.py'
      - '.github/workflows/desktop_auto_release.yml'
      - '.github/workflows/desktop-swift-ci.yml'
  schedule:
    # Poll every 15 min. The push trigger fires immediately on merge, but at that
    # instant the change is inside the quiet window AND its required CI checks
    # (Build & Tests / Release Compile / Release Eligibility, ~10-20 min) are not
    # yet green, so the planner fail-closes. This frequent backstop re-evaluates
    # shortly after those checks settle and the active-release fence clears, so a
    # candidate reliably cuts without waiting for the next hour. Builds stay
    # serialized by the one-active-release fence, so this cannot pile up builds.
    - cron: '*/15 * * * *'

permissions:
  contents: write
  pull-requests: write

jobs:
  plan-release:
    runs-on: ubuntu-latest
    concurrency:
      group: desktop-release-planner-main
      cancel-in-progress: false
    outputs:
      should_release: ${{ steps.plan.outputs.should_release }}
      reason: ${{ steps.plan.outputs.reason }}
      source_sha: ${{ steps.plan.outputs.source_sha }}
    steps:
      - name: Checkout
        uses: actions/checkout@v7
        with:
          fetch-depth: 0

      - name: Generate Omi Bot token
        id: app-token
        uses: actions/create-github-app-token@v3
        with:
          app-id: ${{ secrets.OMI_BOT_APP_ID }}
          private-key: ${{ secrets.OMI_BOT_PRIVATE_KEY }}

      - name: Plan desktop release
        id: plan
        env:
          GH_TOKEN: ${{ steps.app-token.outputs.token }}
        run: |
          python3 .github/scripts/plan-desktop-release.py \
            --repository "${{ github.repository }}"

      - name: Show release plan
        run: echo "${{ steps.plan.outputs.reason }}"

  # Continuous deployment: candidate creation is gated only by the cheap, hosted
  # CI checks the planner verifies (`Release Eligibility`, `Desktop Swift Build &
  # Tests`, `Desktop Swift Release Compile` on the exact source SHA). The heavy
  # validation runs AFTER the candidate exists, in the two-machine qualification
  # pipeline (desktop_qualify_beta.yml) — a candidate that fails qualification is
  # simply never promoted to Beta, so no self-hosted pre-candidate gate is needed.
  # (The former trusted-M1 pre-tag-readiness gate was a single point of failure in
  # front of immutable tag creation and contradicted "create on every change, then
  # qualify"; desktop/macos/scripts/pre-tag-readiness.sh remains for local use.)
  tag-release:
    needs: [plan-release]
    if: needs.plan-release.outputs.should_release == 'true'
    runs-on: ubuntu-latest
    concurrency:
      group: desktop-auto-release-tag-main
      cancel-in-progress: false
    steps:
      - name: Checkout
        uses: actions/checkout@v7
        with:
          fetch-depth: 0

      - name: Generate Omi Bot token
        id: app-token
        uses: actions/create-github-app-token@v3
        with:
          app-id: ${{ secrets.OMI_BOT_APP_ID }}
          private-key: ${{ secrets.OMI_BOT_PRIVATE_KEY }}

      - name: Recheck desktop release queue before tagging
        id: recheck
        env:
          GH_TOKEN: ${{ steps.app-token.outputs.token }}
        run: |
          if [ -z "${GH_TOKEN:-}" ]; then
            echo "Omi Bot token not available; cannot inspect previous release build status."
            exit 1
          fi

          python3 .github/scripts/plan-desktop-release.py \
            --repository "${{ github.repository }}"

      - name: Checkout exact releasable desktop source
        if: steps.recheck.outputs.should_release == 'true'
        uses: actions/checkout@v7
        with:
          ref: ${{ steps.recheck.outputs.source_sha }}
          fetch-depth: 0

      - name: Compute next version and consolidate changelog
        if: steps.recheck.outputs.should_release == 'true'
        id: version
        run: |
          # Get latest desktop release tag
          LATEST=$(git tag -l 'v*-macos' | sort -V | tail -1)

          if [ -z "$LATEST" ]; then
            VERSION="0.0.1"
          else
            # Strip v prefix and +build-macos suffix  e.g. v0.11.11+11011-macos -> 0.11.11
            VER=$(echo "$LATEST" | sed -E 's/^v([0-9.]+)\+[0-9]+-macos$/\1/')
            MAJOR=$(echo "$VER" | cut -d. -f1)
            MINOR=$(echo "$VER" | cut -d. -f2)
            PATCH=$(echo "$VER" | cut -d. -f3)
            PATCH=$((${PATCH:-0} + 1))
            VERSION="$MAJOR.$MINOR.$PATCH"
          fi

          # Build number: 0.11.12 -> 11012  (each component * 1000, summed)
          BUILD_NUMBER=$(echo "$VERSION" | tr '.' '\n' | awk '{s=s*1000+$1}END{print s}')
          RELEASE_TAG="v${VERSION}+${BUILD_NUMBER}-macos"

          echo "Latest tag : ${LATEST:-none}"
          echo "New version: $VERSION"
          echo "New tag    : $RELEASE_TAG"

          echo "version=$VERSION" >> "$GITHUB_OUTPUT"
          echo "release_tag=$RELEASE_TAG" >> "$GITHUB_OUTPUT"

          # Consolidate unreleased changelog fragments into a versioned release
          TODAY=$(date -u +%Y-%m-%d)
          python3 .github/scripts/desktop-changelog.py consolidate \
            --version "$VERSION" \
            --date "$TODAY" \
            --write

      - name: Commit changelog and create tag
        if: steps.recheck.outputs.should_release == 'true'
        run: |
          VERSION="${{ steps.version.outputs.version }}"
          RELEASE_TAG="${{ steps.version.outputs.release_tag }}"

          git config user.name "github-actions[bot]"
          git config user.email "github-actions[bot]@users.noreply.github.com"
          git add desktop/macos/CHANGELOG.json desktop/macos/changelog
          git commit -m "chore: consolidate changelog for v${VERSION}" || echo "No changelog changes to commit"

          # The planner checked and this job checked out the newest queued
          # releasable desktop source SHA.
          # Tag this commit so Codemagic receives the consolidated release notes too.
          # NOTE: commit message must NOT contain [skip ci].
          git tag "$RELEASE_TAG"
          git push origin "$RELEASE_TAG"

      - name: Create and auto-merge PR to sync changelog back to main
        if: steps.recheck.outputs.should_release == 'true'
        env:
          GH_TOKEN: ${{ steps.app-token.outputs.token }}
        run: |
          if [ -z "${GH_TOKEN:-}" ]; then
            echo "Omi Bot token not available; cannot auto-merge changelog PR."
            exit 1
          fi

          VERSION="${{ steps.version.outputs.version }}"
          BRANCH="changelog/v${VERSION}"

          git checkout -B "$BRANCH"
          git push --force-with-lease origin "$BRANCH"

          PR_NUMBER=$(gh pr list \
            --head "$BRANCH" \
            --base main \
            --state open \
            --json number \
            --jq '.[0].number')

          if [ -z "$PR_NUMBER" ]; then
            PR_URL=$(gh pr create \
              --title "Update desktop changelog for v${VERSION} [skip ci]" \
              --body "Auto-generated: consolidates unreleased changelog fragments into v${VERSION} and regenerates CHANGELOG.json." \
              --base main \
              --head "$BRANCH")
            PR_NUMBER=$(echo "$PR_URL" | awk -F/ '{print $NF}')
          fi

          # Merge changelog PR in protected branches:
          # 1) admin merge if allowed, 2) auto-merge if repo supports it, 3) regular merge if already mergeable.
          gh pr merge "$PR_NUMBER" --merge --admin || \
          gh pr merge "$PR_NUMBER" --merge --auto || \
          gh pr merge "$PR_NUMBER" --merge || \
          echo "Changelog PR #$PR_NUMBER requires manual merge."