desktop-tauri.yml

name: "Reusable desktop tauri build workflow"

on:
  workflow_call:
    inputs:
      tagName:
        required: false
        type: string
      releaseBody:
        required: false
        type: string
      releaseName:
        required: false
        type: string
    secrets:
      TAURI_PRIVATE_KEY:
        required: true
      TAURI_KEY_PASSWORD:
        required: true
jobs:
  build:
    strategy:
      fail-fast: false
      matrix:
        include:
          - os: "macos-latest" # for Arm based macs (M1 and above).
            args: "--target aarch64-apple-darwin"
            symbol: 🍏
          - os: "macos-latest" # for Intel based macs.
            args: "--target x86_64-apple-darwin"
            symbol: 🍎
          - os: "ubuntu-22.04"
            symbol: 🐧
            install: |
              sudo apt-get update
              sudo apt-get install -y libwebkit2gtk-4.1-dev libappindicator3-dev librsvg2-dev patchelf python3-pip
          - os: "windows-latest"
            symbol: 🪟
            install: |
              choco install wget -y

    name: ${{matrix.symbol}}
    runs-on: ${{ matrix.os }}
    steps:
      - name: 🔄 Checkout
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4

      - name: 🦀 Install rust stable
        uses: dtolnay/rust-toolchain@stable
        with:
          components: rustfmt, clippy
          targets: ${{ matrix.os == 'macos-latest' && 'aarch64-apple-darwin,x86_64-apple-darwin,wasm32-unknown-unknown' || 'wasm32-unknown-unknown' }}

      - name: 🌍 Export GitHub Actions cache environment variables windows
        if: contains(matrix.os, 'windows')
        uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7
        with:
          script: |
            core.exportVariable('ACTIONS_CACHE_URL', process.env.ACTIONS_CACHE_URL || '');
            core.exportVariable('ACTIONS_RUNTIME_TOKEN', process.env.ACTIONS_RUNTIME_TOKEN || '');

      - name: 🛠️ Setup | Install dependencies
        if: matrix.install != ''
        run: ${{ matrix.install }}

      - name: 📝 Check spelling using typos-action
        uses: crate-ci/typos@11ca4583f2f3f74c7e7785c0ecb20fe2c99a4308 # v1.29.5

      - name: 📥 Cached install leptosfmt (macos only)
        if: contains(matrix.os, 'macos')
        uses: baptiste0928/cargo-install@91c5da15570085bcde6f4d7aed98cb82d6769fd3 # v3
        with:
          crate: leptosfmt
          version: 0.1.33
          locked: true

      - name: 📐 Run leptosfmt and fail if any warnings (macos only)
        if: contains(matrix.os, 'macos')
        run: |
          leptosfmt --check src

      - name: 📐 Run rustfmt and fail if any warnings (macos only)
        if: contains(matrix.os, 'macos')
        run: |
          cargo fmt -- --check
          cd src-tauri
          cargo fmt -- --check

      - name: 📎 Run clippy and fail if any warnings (macos only)
        if: contains(matrix.os, 'macos')
        run: |
          cargo clippy -- -D warnings
          cd src-tauri
          cargo clippy -- -D warnings

      - name: ✅ Run tests (macos only)
        if: contains(matrix.os, 'macos')
        run: |
          cargo test --all

      - name: 📥 Cached Install trunk
        uses: baptiste0928/cargo-install@91c5da15570085bcde6f4d7aed98cb82d6769fd3 # v3
        with:
          crate: trunk
          version: 0.21.7
          locked: true
          args: --no-default-features
          features: rustls

      - name: 📥 Cached install cargo-auditable
        uses: baptiste0928/cargo-install@91c5da15570085bcde6f4d7aed98cb82d6769fd3 # v3
        with:
          crate: cargo-auditable
          version: 0.6.6
          locked: true

      - name: 📥 Cached install tauri-cli
        uses: baptiste0928/cargo-install@91c5da15570085bcde6f4d7aed98cb82d6769fd3 # v3
        with:
          crate: tauri-cli
          version: 2.2.7
          locked: true

      - name: 🔑 Import windows signing certificate
        if: contains(matrix.os, 'windows')
        env:
          WINDOWS_CERTIFICATE: ${{ secrets.WINDOWS_CERTIFICATE }}
          WINDOWS_CERTIFICATE_PASSWORD: ${{ secrets.WINDOWS_CERTIFICATE_PASSWORD }}
        run: |
          New-Item -ItemType directory -Path certificate
          Set-Content -Path certificate/tempCert.txt -Value $env:WINDOWS_CERTIFICATE
          certutil -decode certificate/tempCert.txt certificate/certificate.pfx
          Remove-Item -path certificate -include tempCert.txt
          Import-PfxCertificate -FilePath certificate/certificate.pfx -CertStoreLocation Cert:\CurrentUser\My -Password (ConvertTo-SecureString -String $env:WINDOWS_CERTIFICATE_PASSWORD -Force -AsPlainText)

      - name: 🔨 Build using tauri action (publish artifacts on release)
        uses: tauri-apps/tauri-action@94571df7fd79dbe2aee6d279c0a6b66d086d3b3b # v0.5.19
        env:
          RUSTFLAGS: "-D warnings"
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_PRIVATE_KEY }}
          TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_KEY_PASSWORD }}
        with:
          tagName: ${{ inputs.tagName }}
          releaseBody: ${{ inputs.releaseBody }}
          releaseName: ${{ inputs.releaseName }}
          releaseDraft: false
          prerelease: false
          tauriScript: cargo --locked auditable tauri
          args: ${{ matrix.args }}

      - name: 📤 Upload build artifacts (push or pr builds only)
        if: (inputs.tagName == '')
        uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08 # v4.6.0
        with:
          name: "bundles-${{matrix.os}}${{matrix.args}}"
          path: |
            target/**/release/bundle
            target/**/release/mdns-browser*

      - name: 🛡️ Attest build provenance (publish release only)
        if: inputs.tagName != ''
        uses: actions/attest-build-provenance@520d128f165991a6c774bcb264f323e3d70747f4 # v2.2.0
        with:
          subject-path: |
            target/release/bundle/nsis/*
            target/**/release/bundle/macos/*.tar.gz*
            target/**/release/bundle/dmg/*.dmg
            target/release/bundle/deb/*.deb
            target/release/bundle/rpm/*.rpm
            target/**/release/mdns-browser
            target/release/mdns-browser.exe

      - name: 📜 Create SBOM
        uses: anchore/sbom-action@f325610c9f50a54015d37c8d16cb3b0e2c8f4de0 # v0
        with:
          format: "spdx-json"
          output-file: "sbom.spdx.json"
          artifact-name: "${{ matrix.os }}${{ matrix.args }}.sbom.spdx.json"

      - name: 🛡️ Attest SBOM
        if: inputs.tagName != ''
        uses: actions/attest-sbom@115c3be05ff3974bcbd596578934b3f9ce39bf68 # v2
        with:
          subject-path: ${{
            contains(matrix.os, 'ubuntu') && 'target/release/mdns-browser' ||
            contains(matrix.os, 'windows') && 'target/release/mdns-browser.exe' ||
            (contains(matrix.os, 'macos') && contains(matrix.args, 'x86_64')) && 'target/x86_64-apple-darwin/release/mdns-browser' ||
            (contains(matrix.os, 'macos') && contains(matrix.args, 'aarch64')) && 'target/aarch64-apple-darwin/release/mdns-browser'
            }}
          sbom-path: "sbom.spdx.json"