firezone/.github/workflows/_tauri.yml

name: Tauri
on:
  workflow_call:
    inputs:
      release_tag:
        required: false
        type: string
  workflow_dispatch:

permissions:
  # For saving to release
  contents: write
  id-token: write

defaults:
  run:
    working-directory: ./rust/gui-client

# Never tolerate warnings. Source of truth is `_rust.yml`
env:
  RUSTFLAGS: "-Dwarnings"
  RUSTDOCFLAGS: "-D warnings"

jobs:
  build-gui:
    name: build-gui-${{ matrix.runs-on }}
    runs-on: ${{ matrix.runs-on }}
    strategy:
      fail-fast: false
      matrix:
        include:
          - runs-on: ubuntu-22.04
            arch: x86_64
            os: linux
            pkg-extension: deb
          - runs-on: ubuntu-22.04-arm
            arch: aarch64
            os: linux
            pkg-extension: deb
          - runs-on: windows-2019
            arch: x86_64
            os: windows
            pkg-extension: msi
    env:
      # mark:next-gui-version
      ARTIFACT_SRC: ./rust/gui-client/firezone-client-gui-${{ matrix.os }}_1.4.1_${{ matrix.arch }}
      # mark:next-gui-version
      ARTIFACT_DST: firezone-client-gui-${{ matrix.os }}_1.4.1_${{ matrix.arch }}
      AZURE_KEY_VAULT_URI: ${{ secrets.AZURE_KEY_VAULT_URI }}
      AZURE_CLIENT_ID: ${{ secrets.AZURE_CLIENT_ID }}
      AZURE_TENANT_ID: ${{ secrets.AZURE_TENANT_ID }}
      AZURE_CLIENT_SECRET: ${{ secrets.AZURE_CLIENT_SECRET }}
      AZURE_CERT_NAME: ${{ secrets.AZURE_CERT_NAME }}
      # mark:next-gui-version
      BINARY_DEST_PATH: firezone-client-gui-${{ matrix.os }}_1.4.1_${{ matrix.arch }}
      # Seems like there's no way to de-dupe env vars that depend on each other
      # mark:next-gui-version
      FIREZONE_GUI_VERSION: 1.4.1
      RENAME_SCRIPT: ../../scripts/build/tauri-rename-${{ matrix.os }}.sh
      TARGET_DIR: ../target
      UPLOAD_SCRIPT: ../../scripts/build/tauri-upload-${{ matrix.os }}.sh
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-tags: true # Otherwise we cannot embed the correct version into the build.
      - uses: ./.github/actions/setup-node
      - uses: ./.github/actions/setup-rust
      - uses: ./.github/actions/setup-tauri-v2
        # Installing new packages can take time
        timeout-minutes: 10
      - uses: matbour/setup-sentry-cli@v2
        with:
          token: ${{ secrets.SENTRY_AUTH_TOKEN }}
          organization: firezone-inc
      - name: Install pnpm deps
        run: pnpm install
      - name: Install AzureSignTool
        if: ${{ runner.os == 'Windows' }}
        shell: bash
        # AzureSignTool >= 5 needs .NET 8. windows-2019 runner only has .NET 7.
        run: dotnet tool install --global AzureSignTool --version 4.0.1
      - name: Check if swap needed
        if: ${{ runner.os == 'Linux' }}
        run: free -m
      - name: Enable swap
        if: ${{ runner.os == 'Linux' }}
        run: sudo fallocate -l 8G /swapfile && sudo chmod 600 /swapfile && sudo mkswap /swapfile && sudo swapon /swapfile && free -m
      - name: Build release exe and MSI / deb
        env:
          CARGO_PROFILE_RELEASE_LTO: thin # Fat LTO is getting too slow / RAM-hungry on Tauri builds
        # Signs the exe before bundling it into the MSI
        run: pnpm build
      - name: Ensure unmodified Git workspace
        run: git diff --exit-code
      # We need to sign the exe inside the MSI. Currently
      # we do this in a "beforeBundleCommand" hook in tauri.windows.conf.json.
      # But this will soon be natively supported in Tauri.
      # TODO: Use Tauri's native MSI signing with support for EV certs
      # See https://github.com/tauri-apps/tauri/pull/8718
      - name: Sign the MSI
        if: ${{ runner.os == 'Windows' }}
        shell: bash
        run: ../../scripts/build/sign.sh ../target/release/bundle/msi/Firezone_${{ env.FIREZONE_GUI_VERSION }}_x64_en-US.msi
      - name: Rename artifacts and compute SHA256
        shell: bash
        run: ${{ env.RENAME_SCRIPT }}
      - name: Upload debug symbols to Sentry
        if: ${{ github.ref_name == 'main' }}
        run: |
          sentry-cli debug-files upload --log-level info --project gui-client-gui --include-sources ../target
          sentry-cli debug-files upload --log-level info --project gui-client-ipc-service --include-sources ../target
      - name: Upload package
        uses: actions/upload-artifact@v4
        with:
          name: ${{ env.ARTIFACT_DST }}-pkg
          path: ${{ env.ARTIFACT_SRC }}.${{ matrix.pkg-extension }}
          if-no-files-found: error
      - name: Upload rpm package
        if: ${{ runner.os == 'Linux' }}
        uses: actions/upload-artifact@v4
        with:
          name: ${{ env.ARTIFACT_DST }}-rpm
          path: ${{ env.ARTIFACT_SRC }}.rpm
          if-no-files-found: error
      - name: Upload Release Assets
        # Only upload the GUI Client build to the drafted release on main builds
        if: ${{ github.ref_name == 'main' }}
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          REPOSITORY: ${{ github.repository }}
          TAG_NAME: gui-client-${{ env.FIREZONE_GUI_VERSION }}
        shell: bash
        run: ${{ env.UPLOAD_SCRIPT }}