Repository navigation

Release #18

	name: Release

	on:
	push:
	tags: ["v*"]

	jobs:
	publish-macos:
	runs-on: macos-latest
	permissions:
	contents: write
	steps:
	- uses: actions/checkout@v4

	- uses: actions/setup-node@v4
	with:
	node-version: 20
	cache: npm

	- name: Check versions match tag
	run: \|
	TAG="${GITHUB_REF_NAME#v}"
	for PKG in package.json apps/desktop/package.json apps/cli/package.json apps/web/package.json; do
	V="$(node -p "require('./$PKG').version")"
	if [ "$V" != "$TAG" ]; then
	echo "Version mismatch in $PKG: $V, tag is $TAG"
	exit 1
	fi
	done

	- run: npm ci

	- name: Provide client env for web build
	run: cp apps/web/.env.example apps/web/.env

	- name: Import signing certificate
	env:
	MACOS_CERT_P12: ${{ secrets.MACOS_CERT_P12 }}
	MACOS_CERT_PASSWORD: ${{ secrets.MACOS_CERT_PASSWORD }}
	run: \|
	KEYCHAIN_PASSWORD="$(uuidgen)"
	security create-keychain -p "$KEYCHAIN_PASSWORD" build.keychain
	security default-keychain -s build.keychain
	security unlock-keychain -p "$KEYCHAIN_PASSWORD" build.keychain
	echo "$MACOS_CERT_P12" \| base64 --decode > cert.p12
	security import cert.p12 -k build.keychain -P "$MACOS_CERT_PASSWORD" -T /usr/bin/codesign
	rm cert.p12
	security set-key-partition-list -S apple-tool:,apple: -s -k "$KEYCHAIN_PASSWORD" build.keychain

	- name: Build, notarize, and publish draft release
	env:
	GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
	APPLE_ID: ${{ secrets.APPLE_ID }}
	APPLE_PASSWORD: ${{ secrets.APPLE_PASSWORD }}
	APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
	run: npm run publish --workspace=@diffusionstudio/desktop