veritas-kanban/.github/workflows/desktop-artifacts.yml

name: Desktop Artifacts

on:
  push:
    branches: [main]
    paths:
      - 'desktop/**'
      - 'server/**'
      - 'web/**'
      - 'shared/**'
      - 'docs/DESKTOP-RELEASE.md'
      - 'scripts/desktop-after-pack.mjs'
      - 'scripts/prepare-desktop-release.mjs'
      - 'package.json'
      - 'pnpm-lock.yaml'
      - 'pnpm-workspace.yaml'
      - '.github/workflows/desktop-artifacts.yml'
  pull_request:
    branches: [main]
    paths:
      - 'desktop/**'
      - 'docs/DESKTOP-RELEASE.md'
      - 'scripts/desktop-after-pack.mjs'
      - 'scripts/prepare-desktop-release.mjs'
      - 'package.json'
      - 'pnpm-lock.yaml'
      - 'pnpm-workspace.yaml'
      - '.github/workflows/desktop-artifacts.yml'
  workflow_dispatch:

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

env:
  NODE_VERSION: '22'

jobs:
  mac-unsigned:
    name: Unsigned macOS Artifact
    runs-on: macos-15
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10

      - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0
        with:
          node-version: ${{ env.NODE_VERSION }}
          cache: pnpm

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      - name: Build workspace
        run: pnpm build

      - name: Prepare desktop runtime payload
        run: pnpm --filter @veritas-kanban/desktop package:prepare

      - name: Build unsigned macOS DMG and update metadata
        working-directory: desktop
        env:
          CSC_IDENTITY_AUTO_DISCOVERY: 'false'
        run: node ./node_modules/electron-builder/cli.js --mac dmg zip --publish never --config.mac.identity=null --config.mac.notarize=false

      - name: Upload desktop artifacts
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: veritas-kanban-mac-unsigned
          path: |
            desktop/release/*.dmg
            desktop/release/*.zip
            desktop/release/*.yml
            desktop/release/*.blockmap
          if-no-files-found: error
          retention-days: 14

  linux-unsigned:
    name: Unsigned Linux Artifacts
    runs-on: ubuntu-24.04
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10

      - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0
        with:
          node-version: ${{ env.NODE_VERSION }}
          cache: pnpm

      - name: Install Linux packaging tools
        run: sudo apt-get update && sudo apt-get install -y --no-install-recommends fakeroot libarchive-tools rpm

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      - name: Build workspace
        run: pnpm build

      - name: Prepare desktop runtime payload
        run: pnpm --filter @veritas-kanban/desktop package:prepare

      - name: Build unsigned Linux preview AppImage, deb, and rpm artifacts
        working-directory: desktop
        env:
          CSC_IDENTITY_AUTO_DISCOVERY: 'false'
        run: node ./node_modules/electron-builder/cli.js --linux AppImage deb rpm --x64 --publish never

      - name: Upload Linux preview desktop artifacts
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: veritas-kanban-linux-unsigned
          path: |
            desktop/release/*.AppImage
            desktop/release/*.deb
            desktop/release/*.rpm
            desktop/release/*.yml
            desktop/release/*.blockmap
          if-no-files-found: error
          retention-days: 14

  windows-unsigned:
    name: Unsigned Windows Artifacts
    runs-on: windows-2025
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10

      - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0
        with:
          node-version: ${{ env.NODE_VERSION }}
          cache: pnpm

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      - name: Build workspace
        run: pnpm build

      - name: Prepare desktop runtime payload
        run: pnpm --filter @veritas-kanban/desktop package:prepare

      - name: Build unsigned Windows preview NSIS and ZIP artifacts
        working-directory: desktop
        env:
          CSC_IDENTITY_AUTO_DISCOVERY: 'false'
        run: node ./node_modules/electron-builder/cli.js --win nsis zip --x64 --publish never

      - name: Upload Windows preview desktop artifacts
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: veritas-kanban-windows-unsigned
          path: |
            desktop/release/*.exe
            desktop/release/*.zip
            desktop/release/*.yml
            desktop/release/*.blockmap
          if-no-files-found: error
          retention-days: 14