Modrinth-plus/.gitea/workflows/build.yml

name: Build

on:
  push:
    branches:
      - main
      - master
  workflow_dispatch:

jobs:
  build-windows:
    runs-on: ubuntu-latest
    env:
      MODRINTH_URL: https://modrinth.com/
      MODRINTH_API_BASE_URL: https://api.modrinth.com/
      MODRINTH_ARCHON_BASE_URL: https://archon.modrinth.com/
      MODRINTH_API_URL: https://api.modrinth.com/v2/
      MODRINTH_API_URL_V3: https://api.modrinth.com/v3/
      MODRINTH_SOCKET_URL: wss://api.modrinth.com/
      MODRINTH_LAUNCHER_META_URL: https://launcher-meta.modrinth.com/
      REGISTRY_TOKEN: ${{ secrets.REGISTRY_TOKEN }}
      MRTRUST_CODE_SIGNING_PFX_BASE64: ${{ secrets.MRTRUST_CODE_SIGNING_PFX_BASE64 }}
      MRTRUST_PFX_PASSWORD: ${{ secrets.MRTRUST_PFX_PASSWORD }}
      TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
      TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
      TAURI_SIGNING_PUBLIC_KEY: ${{ secrets.TAURI_SIGNING_PUBLIC_KEY }}
      XWIN_CACHE_DIR: .xwin-cache
      JSIGN_VERSION: "7.4"
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Setup Node
        uses: actions/setup-node@v4
        with:
          node-version-file: .nvmrc

      - name: Setup pnpm
        uses: pnpm/action-setup@v4
        with:
          version: 9.15.0

      - name: Setup Rust
        uses: dtolnay/rust-toolchain@stable
        with:
          targets: x86_64-pc-windows-msvc

      - name: Setup Java
        uses: actions/setup-java@v4
        with:
          distribution: temurin
          java-version: "21"

      - name: Install Windows cross-build dependencies
        run: |
          sudo apt-get update
          sudo apt-get install -y \
            clang \
            lld \
            llvm \
            nsis

      - name: Install cargo-xwin
        run: cargo install --locked cargo-xwin

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      - name: Install Windows Rust target
        run: rustup target add x86_64-pc-windows-msvc

      - name: Prepare MrTrust Windows code signing
        shell: bash
        run: |
          if [ -z "${MRTRUST_CODE_SIGNING_PFX_BASE64}" ] || [ -z "${MRTRUST_PFX_PASSWORD}" ]; then
            echo "::error::MRTRUST_CODE_SIGNING_PFX_BASE64 and MRTRUST_PFX_PASSWORD are required so MrTrust-installed users can trust Modrinth Plus."
            exit 1
          fi

          mkdir -p .signing
          printf '%s' "${MRTRUST_CODE_SIGNING_PFX_BASE64}" | base64 --decode > .signing/MrSphay-CodeSigning.pfx
          chmod 600 .signing/MrSphay-CodeSigning.pfx

          curl --fail-with-body --location \
            --output .signing/jsign.jar \
            "https://github.com/ebourg/jsign/releases/download/${JSIGN_VERSION}/jsign-${JSIGN_VERSION}.jar"

          echo "MRTRUST_PFX_PATH=${GITHUB_WORKSPACE}/.signing/MrSphay-CodeSigning.pfx" >> "${GITHUB_ENV}"
          echo "JSIGN_JAR=${GITHUB_WORKSPACE}/.signing/jsign.jar" >> "${GITHUB_ENV}"

      - name: Prepare Modrinth Plus update metadata
        shell: bash
        run: |
          build_version="1.0.${GITHUB_RUN_NUMBER}"
          node -e "const fs=require('fs'); const path='apps/app-frontend/package.json'; const pkg=JSON.parse(fs.readFileSync(path,'utf8')); pkg.version=process.argv[1]; fs.writeFileSync(path, JSON.stringify(pkg,null,'\\t')+'\\n');" "${build_version}"
          if [ -n "${TAURI_SIGNING_PRIVATE_KEY}" ] && [ -n "${TAURI_SIGNING_PUBLIC_KEY}" ]; then
            node -e "const fs=require('fs'); const path='apps/app/tauri-release.conf.json'; const config=JSON.parse(fs.readFileSync(path,'utf8')); config.plugins.updater.pubkey=process.env.TAURI_SIGNING_PUBLIC_KEY; fs.writeFileSync(path, JSON.stringify(config,null,'\\t')+'\\n');"
          else
            echo "::error::TAURI_SIGNING_PRIVATE_KEY and TAURI_SIGNING_PUBLIC_KEY are required for release/update builds."
            exit 1
          fi

      - name: Build Windows desktop client
        run: pnpm --filter @modrinth/app exec tauri build --config tauri-release.conf.json --runner cargo-xwin --target x86_64-pc-windows-msvc --bundles "nsis,updater"

      - name: Upload Windows desktop client
        uses: actions/upload-artifact@v3
        with:
          name: modrinth-plus-windows
          path: target/x86_64-pc-windows-msvc/release/bundle/nsis/**
          if-no-files-found: error

      - name: Publish Windows client to Gitea package registry
        shell: bash
        run: |
          app_version="$(node -p "require('./apps/app-frontend/package.json').version")"
          package_version="${app_version}-${GITHUB_SHA::7}"
          package_name="modrinth-plus"
          repository_owner="${GITHUB_REPOSITORY%%/*}"
          if [ -z "${repository_owner}" ] || [ "${repository_owner}" = "${GITHUB_REPOSITORY}" ]; then
            repository_owner="MrSphay"
          fi
          gitea_server="${GITHUB_SERVER_URL:-https://git.wilkensxl.de}"
          gitea_server="${gitea_server%/}"
          package_dir="package-registry"
          latest_url="${gitea_server}/api/packages/${repository_owner}/generic/${package_name}/latest"

          mapfile -d '' artifacts < <(find target/x86_64-pc-windows-msvc/release/bundle/nsis -maxdepth 1 -type f -name '*.exe' -print0)
          if [ "${#artifacts[@]}" -eq 0 ]; then
            echo "No Windows installer found to publish"
            exit 1
          fi

          mapfile -d '' updater_bundles < <(find target/x86_64-pc-windows-msvc/release/bundle/nsis -maxdepth 1 -type f -name '*.nsis.zip' -print0)
          updater_bundle=""
          updater_signature=""
          if [ "${#updater_bundles[@]}" -gt 0 ]; then
            updater_bundle="${updater_bundles[0]}"
            updater_signature="${updater_bundle}.sig"
            if [ ! -f "${updater_signature}" ]; then
              echo "::warning::No Windows updater signature found at ${updater_signature}; skipping self-update metadata publishing."
              updater_bundle=""
            fi
          else
            echo "::warning::No Windows updater bundle found; skipping self-update metadata publishing."
          fi

          rm -rf "${package_dir}"
          mkdir -p "${package_dir}/versioned" "${package_dir}/latest"
          cp "${artifacts[0]}" "${package_dir}/versioned/Modrinth-Plus-Windows-Setup-${package_version}.exe"

          curl --fail-with-body \
            --user "${repository_owner}:${REGISTRY_TOKEN}" \
            --upload-file "${package_dir}/versioned/Modrinth-Plus-Windows-Setup-${package_version}.exe" \
            "${gitea_server}/api/packages/${repository_owner}/generic/${package_name}/${package_version}/Modrinth-Plus-Windows-Setup-${package_version}.exe"

          if [ -n "${updater_bundle}" ]; then
            cp "${updater_bundle}" "${package_dir}/versioned/Modrinth-Plus-Windows-Update-${package_version}.nsis.zip"
            update_url="${gitea_server}/api/packages/${repository_owner}/generic/${package_name}/${package_version}/Modrinth-Plus-Windows-Update-${package_version}.nsis.zip"
            curl --fail-with-body \
              --user "${repository_owner}:${REGISTRY_TOKEN}" \
              --upload-file "${package_dir}/versioned/Modrinth-Plus-Windows-Update-${package_version}.nsis.zip" \
              "${update_url}"
          fi

          curl --silent --show-error --user "${repository_owner}:${REGISTRY_TOKEN}" --request DELETE "${latest_url}" || true
          cp "${artifacts[0]}" "${package_dir}/latest/Modrinth-Plus-Windows-Setup.exe"
          if [ -n "${updater_bundle}" ]; then
            signature="$(cat "${updater_signature}")"
            node -e "const fs=require('fs'); const [version, url, signature]=process.argv.slice(1); const metadata={version, notes:'Modrinth Plus launcher update', pub_date:new Date().toISOString(), platforms:{'windows-x86_64':{signature,url}}}; fs.writeFileSync('package-registry/latest/latest.json', JSON.stringify(metadata,null,2)+'\\n');" "${app_version}" "${update_url}" "${signature}"
          fi

          curl --fail-with-body \
            --user "${repository_owner}:${REGISTRY_TOKEN}" \
            --upload-file "${package_dir}/latest/Modrinth-Plus-Windows-Setup.exe" \
            "${latest_url}/Modrinth-Plus-Windows-Setup.exe"

          if [ -f "${package_dir}/latest/latest.json" ]; then
            curl --fail-with-body \
              --user "${repository_owner}:${REGISTRY_TOKEN}" \
              --upload-file "${package_dir}/latest/latest.json" \
              "${latest_url}/latest.json"
          fi

      - name: Clean signing material
        if: always()
        shell: bash
        run: rm -rf .signing