openhuman/.github/workflows/package-and-publish.yml

# Terms:
# "build" - Compile web project using webpack.
# "package" - Produce a distributive package for a specific platform as a workflow artifact.
# "publish" - Send a package to corresponding store and GitHub release page.
# "release" - build + package + publish
#
# Jobs in this workflow will skip the "publish" step when `SHOULD_PUBLISH` is not set.

name: Package and publish (Legacy)

on:
  workflow_dispatch:
  # pull_request:
  #   branches:
  #     - main

env:
  IS_PR: ${{ github.event_name == 'pull_request' }}
  SHOULD_PUBLISH: ${{ github.event_name != 'pull_request' && github.ref == 'refs/heads/main' }}
  PUBLISH_REPO: openhumanxyz/openhuman
  XGH_TOKEN: ${{ secrets.XGH_TOKEN }}
  GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

jobs:
  get-version:
    runs-on: ubuntu-latest
    outputs:
      package-version: ${{ steps.extract-version.outputs.package-version }}
      tag-name: ${{ steps.extract-version.outputs.tag-name }}
      should-publish: ${{ steps.extract-version.outputs.should-publish }}
      release-name: ${{ steps.extract-version.outputs.release-name }}
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 1
          ref: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.ref || github.ref }}
          token: ${{ secrets.XGH_TOKEN_READ }}

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: 20.x

      - name: Extract version and tag
        id: extract-version
        run: |
          PACKAGE_VERSION=$(node -p "require('./package.json').version")
          TAG_NAME="v${PACKAGE_VERSION}"
          RELEASE_NAME="OpenHuman v${PACKAGE_VERSION}"
          echo "package-version=$PACKAGE_VERSION" >> $GITHUB_OUTPUT
          echo "tag-name=$TAG_NAME" >> $GITHUB_OUTPUT
          echo "release-name=$RELEASE_NAME" >> $GITHUB_OUTPUT
          echo "should-publish=$SHOULD_PUBLISH" >> $GITHUB_OUTPUT
          echo "Extracted version: $PACKAGE_VERSION"
          echo "Generated tag: $TAG_NAME"
          echo "Generated release name: $RELEASE_NAME"

  check-version:
    runs-on: ubuntu-latest
    needs: get-version
    environment: ${{ github.ref == 'refs/heads/main' && 'Production' || '' }}
    outputs:
      should-skip: ${{ steps.check-release.outputs.should-skip }}
    steps:
      - name: Check if release already exists
        id: check-release
        env:
          PACKAGE_VERSION: ${{ needs.get-version.outputs.package-version }}
          TAG_NAME: ${{ needs.get-version.outputs.tag-name }}
        run: |
          # For non-main branches or when publishing is disabled, always continue
          if [ -z "$SHOULD_PUBLISH" ]; then
            echo "🚧 Publishing disabled (non-main branch)"
            echo "should-skip=false" >> $GITHUB_OUTPUT
            exit 0
          fi

          echo "Checking if release already exists for tag: $TAG_NAME"

          RESPONSE=$(curl -s -w "\n%{http_code}" -H "Authorization: Bearer $XGH_TOKEN" \
            -H "Accept: application/vnd.github.v3+json" \
            "https://api.github.com/repos/$PUBLISH_REPO/releases/tags/$TAG_NAME")
          HTTP_CODE=$(echo "$RESPONSE" | tail -n1)
          BODY=$(echo "$RESPONSE" | sed '$d')

          if [ "$HTTP_CODE" = "404" ]; then
            echo "🆕 No release found for version $PACKAGE_VERSION, will create new release"
            echo "should-skip=false" >> $GITHUB_OUTPUT
          elif [ "$HTTP_CODE" != "200" ]; then
            echo "⚠️ Warning: Failed to check release (HTTP $HTTP_CODE). Response: $BODY"
            echo "Continuing anyway..."
            echo "should-skip=false" >> $GITHUB_OUTPUT
          elif echo "$BODY" | jq -e '.tag_name' > /dev/null; then
            IS_DRAFT=$(echo "$BODY" | jq -r '.draft')
            if [ "$IS_DRAFT" = "false" ]; then
              echo "✅ Published release already exists for version $PACKAGE_VERSION"
              echo "should-skip=true" >> $GITHUB_OUTPUT
            else
              echo "📝 Draft release exists for version $PACKAGE_VERSION, will continue"
              echo "should-skip=false" >> $GITHUB_OUTPUT
            fi
          else
            echo "🆕 No release found for version $PACKAGE_VERSION, will create new release"
            echo "should-skip=false" >> $GITHUB_OUTPUT
          fi

  create-release:
    runs-on: ubuntu-latest
    needs: [get-version, check-version]
    environment: ${{ github.ref == 'refs/heads/main' && 'Production' || '' }}
    if: github.ref == 'refs/heads/main' && needs.get-version.outputs.should-publish == 'true' && needs.check-version.outputs.should-skip != 'true'
    permissions:
      contents: write
    outputs:
      releaseId: ${{ steps.create-release.outputs.releaseId }}
    steps:
      - name: Create draft release
        id: create-release
        env:
          PACKAGE_VERSION: ${{ needs.get-version.outputs.package-version }}
          TAG_NAME: ${{ needs.get-version.outputs.tag-name }}
          RELEASE_NAME: ${{ needs.get-version.outputs.release-name }}
          XGH_TOKEN: ${{ secrets.XGH_TOKEN }}
        run: |
          echo "Creating draft release for tag: $TAG_NAME"
          echo "Repository: $PUBLISH_REPO"
          RELEASE_BODY="See the assets below to download this version."
          RESPONSE=$(curl -s -w "\n%{http_code}" -X POST \
            -H "Authorization: Bearer $XGH_TOKEN" \
            -H "Accept: application/vnd.github.v3+json" \
            -d '{"tag_name": "'"$TAG_NAME"'", "name": "'"$RELEASE_NAME"'", "draft": true, "body": "'"$RELEASE_BODY"'"}' \
            "https://api.github.com/repos/$PUBLISH_REPO/releases")
          HTTP_CODE=$(echo "$RESPONSE" | tail -n1)
          BODY=$(echo "$RESPONSE" | sed '$d')
          echo "HTTP Status Code: $HTTP_CODE"
          echo "Response body: $BODY"
          if [ "$HTTP_CODE" != "201" ]; then
            echo "Error: Failed to create release. HTTP $HTTP_CODE"
            echo "Response: $BODY"
            exit 1
          fi
          RELEASE_ID=$(echo "$BODY" | jq -r '.id')
          echo "Extracted Release ID: $RELEASE_ID"
          if [ "$RELEASE_ID" = "null" ] || [ -z "$RELEASE_ID" ]; then
            echo "Error: Failed to extract release ID. Response was: $BODY"
            exit 1
          fi
          echo "releaseId=$RELEASE_ID" >> $GITHUB_OUTPUT

  package-tauri:
    name: Build, package and publish Tauri
    needs: [get-version, check-version, create-release]
    if: ${{ !failure() && !cancelled() && needs.check-version.outputs.should-skip != 'true' }}
    environment: ${{ github.ref == 'refs/heads/main' && 'Production' || '' }}
    env:
      GITHUB_TOKEN: ${{ secrets.XGH_TOKEN }}
    permissions:
      contents: write
    strategy:
      fail-fast: false
      matrix:
        settings:
          - platform: 'macos-latest'
            args: '--target aarch64-apple-darwin'
            target: 'aarch64-apple-darwin'
          - platform: 'macos-latest'
            args: '--target x86_64-apple-darwin'
            target: 'x86_64-apple-darwin'
          - platform: 'ubuntu-22.04'
            args: '--target x86_64-unknown-linux-gnu'
            target: 'x86_64-unknown-linux-gnu'
    runs-on: ${{ matrix.settings.platform }}
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          fetch-depth: 1
          submodules: true
          token: ${{ secrets.XGH_TOKEN_READ }}
          ref: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.ref || github.ref }}

      - name: Set Xcode version
        if: matrix.settings.platform == 'macos-latest'
        uses: maxim-lobanov/setup-xcode@v1
        with:
          xcode-version: latest-stable

      - name: Setup Node.js 24.x
        uses: actions/setup-node@v4
        with:
          node-version: 24.x
          cache: 'yarn'

      - name: Install Rust stable
        uses: dtolnay/rust-toolchain@stable
        with:
          targets: ${{ matrix.settings.platform == 'macos-latest' && 'aarch64-apple-darwin,x86_64-apple-darwin' || '' }}

      - name: Install Tauri dependencies (ubuntu only)
        if: matrix.settings.platform == 'ubuntu-22.04'
        run: |
          sudo apt-get update
          sudo apt-get install -y libgtk-3-dev libwebkit2gtk-4.1-dev libappindicator3-dev librsvg2-dev patchelf

      # OpenMP is now disabled via Cargo.toml (default-features = false for llama-cpp-2)
      # This avoids cross-compilation issues where Homebrew ARM64 OpenMP can't be used for x86_64 builds

      - name: Cache Cargo registry
        uses: actions/cache@v4
        with:
          path: |
            ~/.cargo/registry
            ~/.cargo/git
          key: ${{ runner.os }}-cargo-${{ hashFiles('src-tauri/Cargo.lock') }}
          restore-keys: |
            ${{ runner.os }}-cargo-

      - name: Cache Cargo build artifacts
        uses: actions/cache@v4
        with:
          path: src-tauri/target
          key: ${{ runner.os }}-cargo-target-${{ matrix.settings.platform }}-${{ hashFiles('src-tauri/Cargo.lock') }}
          restore-keys: |
            ${{ runner.os }}-cargo-target-${{ matrix.settings.platform }}-

      - name: Cache node modules
        id: yarn-cache
        uses: actions/cache@v4
        with:
          path: node_modules
          key: ${{ runner.os }}-build-${{ hashFiles('**/yarn.lock') }}
          restore-keys: |
            ${{ runner.os }}-build-

      - name: Install dependencies
        if: steps.yarn-cache.outputs.cache-hit != 'true'
        run: yarn install --frozen-lockfile

      - name: Cache skills node modules
        id: skills-yarn-cache
        uses: actions/cache@v4
        with:
          path: skills/node_modules
          key: ${{ runner.os }}-skills-${{ hashFiles('skills/yarn.lock') }}
          restore-keys: |
            ${{ runner.os }}-skills-

      - name: Install skills dependencies
        if: steps.skills-yarn-cache.outputs.cache-hit != 'true'
        run: cd skills && yarn install --frozen-lockfile

      - name: Build skills
        run: cd skills && yarn build

      - name: Extract repository owner and name
        id: repository-info
        if: needs.get-version.outputs.should-publish != ''
        shell: bash
        run: |
          echo "owner=${PUBLISH_REPO%%/*}" >> $GITHUB_OUTPUT
          echo "repo=${PUBLISH_REPO#*/}" >> $GITHUB_OUTPUT

      - name: Define Tauri configuration overrides
        id: config-overrides
        uses: actions/github-script@v7
        env:
          BASE_URL: ${{ vars.BASE_URL }}
          UPDATER_PUBLIC_KEY: ${{ secrets.UPDATER_PUBLIC_KEY }}
          WITH_UPDATER: ${{ needs.get-version.outputs.should-publish != '' && 'true' || 'false' }}
        with:
          script: |
            const workspacePath = process.env.GITHUB_WORKSPACE.replace(/\\/g, '/');
            const prefix = workspacePath.startsWith('/') ? 'file://' : 'file:///';
            const moduleUrl = `${prefix}${workspacePath}/scripts/prepareTauriConfig.js`;
            const { default: prepareTauriConfig } = await import(moduleUrl)
            const config = prepareTauriConfig();

            const configJson = JSON.stringify(config);
            console.log(configJson);

            core.setOutput("json", configJson);

      - name: Build frontend
        run: yarn build
        env:
          NODE_ENV: production
          VITE_BACKEND_URL: ${{ vars.VITE_BACKEND_URL }}
          VITE_SENTRY_DSN: ${{ secrets.VITE_SENTRY_DSN }}
          VITE_DEBUG: ${{ vars.VITE_DEBUG }}

      - name: Build sidecar core binary
        shell: bash
        run: |
          cargo build \
            --manifest-path rust-core/Cargo.toml \
            --release \
            --target "$MATRIX_TARGET" \
            --bin openhuman-core
        env:
          MATRIX_TARGET: ${{ matrix.settings.target }}

      - name: Stage sidecar for Tauri bundler
        shell: bash
        run: |
          mkdir -p src-tauri/binaries
          SOURCE="rust-core/target/$MATRIX_TARGET/release/openhuman-core"
          DEST="src-tauri/binaries/openhuman-core-$MATRIX_TARGET"
          cp "$SOURCE" "$DEST"
          chmod +x "$DEST"
        env:
          MATRIX_TARGET: ${{ matrix.settings.target }}

      - name: Build, package and publish
        uses: tauri-apps/tauri-action@v0.6.2
        id: build-tauri
        env:
          APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE_BASE64 }}
          APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
          APPLE_SIGNING_IDENTITY: ${{ secrets.APPLE_SIGNING_IDENTITY }}
          APPLE_ID: ${{ secrets.APPLE_ID }}
          APPLE_PASSWORD: ${{ secrets.APPLE_APP_SPECIFIC_PASSWORD }}
          APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
          BASE_URL: ${{ vars.BASE_URL }}
          TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.UPDATER_PRIVATE_KEY }}
          TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.UPDATER_PRIVATE_KEY_PASSWORD }}
          WITH_UPDATER: ${{ needs.get-version.outputs.should-publish != '' && 'true' || 'false' }}
          # macOS 10.15+ required for std::filesystem used by llama.cpp
          MACOSX_DEPLOYMENT_TARGET: ${{ matrix.settings.platform == 'macos-latest' && '10.15' || '' }}
        with:
          args: '-c ${{ steps.config-overrides.outputs.json }} ${{ matrix.settings.args }} -- -- --bin OpenHuman'
          includeDebug: ${{ needs.get-version.outputs.should-publish == '' && inputs.forceRelease != 'true' }}
          includeRelease: ${{ needs.get-version.outputs.should-publish != '' || inputs.forceRelease == 'true' }}
          # TDLib dylibs are now bundled natively via build.rs + tauri.conf.json macOS.frameworks
          # No post-build scripts needed - Tauri bundler handles copying and signing
          releaseId: ${{ needs.create-release.outputs.releaseId }}
          owner: openhumanxyz
          repo: openhuman

      - name: Get file info
        id: file-info
        shell: bash
        run: |
          FULL_PATH=$(echo "${{ fromJSON(steps.build-tauri.outputs.artifactPaths)[0] }}")
          FILENAME=$(basename "$FULL_PATH")
          NAME_WITH_EXT="${FILENAME%.*}"
          VERSION="${{ needs.get-version.outputs.package-version }}"
          TAG_NAME="${{ needs.get-version.outputs.tag-name }}"

          # Remove version/tag patterns from name
          # Patterns to remove: v0.14.0-1, 0.14.0-1, v0.14.0, 0.14.0, etc.
          # Package managers add release numbers like -1, -2, etc.
          NAME="$NAME_WITH_EXT"

          # Remove version-release pattern (0.14.0-1, 0.14.0-2, etc.) - escape dots for regex
          VERSION_ESCAPED=$(echo "$VERSION" | sed 's/\./\\./g')
          NAME=$(echo "$NAME" | sed -E "s/[_-]?${VERSION_ESCAPED}-[0-9]+[_-]?//g")

          # Remove tag-release pattern (v0.14.0-1, v0.14.0-2, etc.)
          TAG_ESCAPED=$(echo "$TAG_NAME" | sed 's/\./\\./g')
          NAME=$(echo "$NAME" | sed -E "s/[_-]?${TAG_ESCAPED}-[0-9]+[_-]?//g")

          # Remove tag name (v0.14.0) with various separators
          NAME=$(echo "$NAME" | sed -E "s/[_-]?${TAG_ESCAPED}[_-]?//g")

          # Remove version (0.14.0) with various separators
          NAME=$(echo "$NAME" | sed -E "s/[_-]?${VERSION_ESCAPED}[_-]?//g")

          # Remove version with dots replaced by separators (0_14_0, 0-14-0)
          VERSION_DASH=$(echo "$VERSION" | tr '.' '-')
          VERSION_UNDERSCORE=$(echo "$VERSION" | tr '.' '_')
          NAME=$(echo "$NAME" | sed -E "s/[_-]?v?${VERSION_DASH}[_-]?//g")
          NAME=$(echo "$NAME" | sed -E "s/[_-]?v?${VERSION_UNDERSCORE}[_-]?//g")

          # Clean up any double separators or trailing/leading separators
          NAME=$(echo "$NAME" | sed -E 's/[_-]{2,}/_/g' | sed 's/^[_-]//' | sed 's/[_-]$//')

          FILE_PATH=$(cd "$(dirname "$FULL_PATH")" && pwd)
          # Extract architecture from target (e.g., aarch64-apple-darwin -> aarch64)
          ARCHITECTURE=$(echo "${{ matrix.settings.target }}" | cut -d'-' -f1)
          echo "name=$NAME" >> $GITHUB_OUTPUT
          echo "filename=$FILENAME" >> $GITHUB_OUTPUT
          echo "architecture=$ARCHITECTURE" >> $GITHUB_OUTPUT
          echo "path=$FILE_PATH" >> $GITHUB_OUTPUT

      # MacOS release — upload the DMG after TDLib bundling and re-signing
      - name: Upload release asset (MacOS)
        if: matrix.settings.platform == 'macos-latest' && needs.get-version.outputs.should-publish != ''
        shell: bash
        run: |
          SANITIZED_FILENAME=$(echo "${{ steps.file-info.outputs.name }}" | sed 's/ /./g')
          PUBLISH_FILE_NAME="$SANITIZED_FILENAME-${{ steps.file-info.outputs.architecture }}.dmg"
          FILE_PATH="${{ steps.file-info.outputs.path }}/${{ steps.file-info.outputs.filename }}"
          RELEASE_ID="${{ needs.create-release.outputs.releaseId }}"
          curl -X POST -H "Authorization: Bearer $XGH_TOKEN" \
            -H "Content-Type: application/octet-stream" \
            --data-binary "@$FILE_PATH" \
            "https://uploads.github.com/repos/$PUBLISH_REPO/releases/$RELEASE_ID/assets?name=$PUBLISH_FILE_NAME"

      - name: Upload artifact (MacOS)
        if: matrix.settings.platform == 'macos-latest'
        uses: actions/upload-artifact@v4
        with:
          name: ${{ steps.file-info.outputs.name }}-${{ steps.file-info.outputs.architecture }}.dmg
          path: ${{ steps.file-info.outputs.path }}/${{ steps.file-info.outputs.filename }}

      # Linux release
      - name: Upload Linux artifact (Linux)
        if: matrix.settings.platform == 'ubuntu-22.04'
        uses: actions/upload-artifact@v4
        with:
          name: ${{ steps.file-info.outputs.filename }}
          path: ${{ steps.file-info.outputs.path }}/${{ steps.file-info.outputs.filename }}

  publish-release:
    runs-on: ubuntu-latest
    # needs: [get-version, check-version, create-release, package-tauri, package-android]
    needs: [get-version, check-version, create-release, package-tauri]
    environment: ${{ github.ref == 'refs/heads/main' && 'Production' || '' }}
    if: github.ref == 'refs/heads/main' && needs.get-version.outputs.should-publish == 'true' && needs.check-version.outputs.should-skip != 'true'
    permissions:
      contents: write
    env:
      RELEASE_ID: ${{ needs.create-release.outputs.releaseId }}
      XGH_TOKEN: ${{ secrets.XGH_TOKEN }}
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 1
          ref: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.ref || github.ref }}

      - name: Publish release
        run: |
          RESPONSE=$(curl -s -w "\n%{http_code}" -X PATCH \
            -H "Authorization: Bearer $XGH_TOKEN" \
            -H "Accept: application/vnd.github.v3+json" \
            -d '{"draft": false}' \
            "https://api.github.com/repos/$PUBLISH_REPO/releases/$RELEASE_ID")
          HTTP_CODE=$(echo "$RESPONSE" | tail -n1)
          BODY=$(echo "$RESPONSE" | sed '$d')
          if [ "$HTTP_CODE" != "200" ]; then
            echo "Error: Failed to publish release. HTTP $HTTP_CODE"
            echo "Response: $BODY"
            exit 1
          fi
          echo "Release published successfully"

      - name: Update Gist with JSON
        run: |
          ASSET_ID=$(curl -s -H "Authorization: Bearer $XGH_TOKEN" \
            -H "Accept: application/vnd.github.v3+json" \
            "https://api.github.com/repos/$PUBLISH_REPO/releases/$RELEASE_ID/assets" | jq -r '.[] | select(.name == "latest.json") | .id')
          JSON_CONTENT=$(curl -sSL -H "Accept: application/octet-stream" \
            -H "Authorization: Bearer $XGH_TOKEN" \
            "https://api.github.com/repos/$PUBLISH_REPO/releases/assets/$ASSET_ID")
          GIST_CONTENT=$(jq -n --arg json "$JSON_CONTENT" '{"files":{"updater.json":{"content":$json}}}')
          curl -X PATCH -H "Authorization: Bearer $XGH_TOKEN" \
            -H "Accept: application/vnd.github.v3+json" \
            -d "$GIST_CONTENT" \
            "https://api.github.com/gists/$UPDATER_GIST_ID"

  delete-release-on-failure:
    name: Delete draft release on build/publish failure
    runs-on: ubuntu-latest
    needs: [get-version, create-release, package-tauri, publish-release]
    if: failure() && needs.create-release.result == 'success' && needs.create-release.outputs.releaseId != ''
    permissions:
      contents: write
    env:
      RELEASE_ID: ${{ needs.create-release.outputs.releaseId }}
      TAG_NAME: ${{ needs.get-version.outputs.tag-name }}
      XGH_TOKEN: ${{ secrets.XGH_TOKEN }}
    steps:
      - name: Delete draft release
        run: |
          echo "Deleting draft release $RELEASE_ID after build or publish failure"
          RESPONSE=$(curl -s -w "\n%{http_code}" -X DELETE \
            -H "Authorization: Bearer $XGH_TOKEN" \
            -H "Accept: application/vnd.github.v3+json" \
            "https://api.github.com/repos/$PUBLISH_REPO/releases/$RELEASE_ID")
          HTTP_CODE=$(echo "$RESPONSE" | tail -n1)
          BODY=$(echo "$RESPONSE" | sed '$d')
          if [ "$HTTP_CODE" = "204" ] || [ "$HTTP_CODE" = "404" ]; then
            echo "Release deleted (or already gone)"
          else
            echo "Warning: Delete release returned HTTP $HTTP_CODE. Response: $BODY"
          fi
      - name: Delete tag
        run: |
          echo "Deleting tag $TAG_NAME"
          RESPONSE=$(curl -s -w "\n%{http_code}" -X DELETE \
            -H "Authorization: Bearer $XGH_TOKEN" \
            -H "Accept: application/vnd.github.v3+json" \
            "https://api.github.com/repos/$PUBLISH_REPO/git/refs/tags/$TAG_NAME")
          HTTP_CODE=$(echo "$RESPONSE" | tail -n1)
          if [ "$HTTP_CODE" = "204" ] || [ "$HTTP_CODE" = "404" ]; then
            echo "Tag deleted (or already gone)"
          else
            echo "Warning: Delete tag returned HTTP $HTTP_CODE"
          fi