feedBack-desktop/.github/workflows/nightly.yml

name: Nightly

# Trunk-based: nightly always builds main — the release/v* branch discovery
# from the old release-centric flow is gone (it pinned nightlies to the
# highest release branch forever, even after it shipped). Stabilization
# builds from release/** come from rc.yml instead.
on:
  schedule:
    - cron: '0 2 * * *'
  workflow_dispatch:

jobs:
  setup:
    runs-on: ubuntu-latest
    outputs:
      date: ${{ steps.date.outputs.date }}

    steps:
      - name: Get date
        id: date
        run: echo "date=$(date -u +%Y%m%d)" >> "$GITHUB_OUTPUT"

  # build-core removed: core's own nightly.yml already builds + pushes
  # ghcr.io/got-feedback/feedback:nightly on the same 02:00 UTC cron, so this
  # was duplicate/racing work. Core owns its image now.

  build:
    needs: setup
    strategy:
      fail-fast: false
      matrix:
        include:
          - os: ubuntu-22.04
            platform: linux
            arch: x64
          - os: macos-14
            platform: mac
            arch: arm64
          - os: windows-latest
            platform: win
            arch: x64

    runs-on: ${{ matrix.os }}

    steps:
      - uses: actions/checkout@v4
        with:
          submodules: recursive

      - name: Read build configuration
        id: config
        shell: bash
        run: |
          NODE_VERSION=$(node -p "require('./.build-config.json').versions.node")
          PYTHON_VERSION=$(node -p "require('./.build-config.json').versions.python")
          echo "node=$NODE_VERSION" >> $GITHUB_OUTPUT
          echo "python=$PYTHON_VERSION" >> $GITHUB_OUTPUT
          echo "Node ${NODE_VERSION}, Python ${PYTHON_VERSION}"

      - uses: actions/setup-node@v4
        with:
          node-version: ${{ steps.config.outputs.node }}

      - uses: actions/setup-python@v5
        with:
          python-version: ${{ steps.config.outputs.python }}

      # macOS: import signing cert so build-macos.sh can codesign the .app.
      # The nightly .app is signed but not notarized — testers clear Gatekeeper with
      #   xattr -dr com.apple.quarantine "fee[dB]ack.app"
      # Same graceful fallback as release.yml: no-op when secrets are absent.
      - name: Import Apple signing certificate
        if: matrix.platform == 'mac'
        env:
          APPLE_CERTIFICATE_P12_BASE64: ${{ secrets.APPLE_CERTIFICATE_P12_BASE64 }}
          APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
          KEYCHAIN_PASSWORD: ${{ secrets.KEYCHAIN_PASSWORD }}
        run: |
          set -euo pipefail
          if [[ -z "${APPLE_CERTIFICATE_P12_BASE64:-}" ]]; then
              echo "APPLE_CERTIFICATE_P12_BASE64 not set — skipping (unsigned build)"
              exit 0
          fi
          printf '%s' "$APPLE_CERTIFICATE_P12_BASE64" | base64 --decode > "$RUNNER_TEMP/cert.p12"
          security create-keychain -p "$KEYCHAIN_PASSWORD" build.keychain
          security default-keychain -s build.keychain
          security unlock-keychain -p "$KEYCHAIN_PASSWORD" build.keychain
          security set-keychain-settings -lut 21600 build.keychain
          security list-keychains -d user -s build.keychain login.keychain-db
          security import "$RUNNER_TEMP/cert.p12" -k build.keychain \
              -P "$APPLE_CERTIFICATE_PASSWORD" -T /usr/bin/codesign
          security set-key-partition-list \
              -S apple-tool:,apple:,codesign: \
              -s -k "$KEYCHAIN_PASSWORD" build.keychain
          rm -f "$RUNNER_TEMP/cert.p12"
          security find-identity -v -p codesigning build.keychain | grep -q "Developer ID Application"

      - name: Build
        run: ./scripts/build-release.sh
        shell: bash
        env:
          # PAT with read access to the private got-feedback repos so
          # build-common.sh can clone core + the bundled plugins.
          GH_CLONE_TOKEN: ${{ secrets.FEEDBACK_CLONE_TOKEN }}
          APPLE_SIGNING_IDENTITY: ${{ secrets.APPLE_SIGNING_IDENTITY }}
          # No notarization for nightlies — testers use xattr -dr com.apple.quarantine
          CSC_FOR_PULL_REQUEST: "true"

      - name: Setup upterm session
        uses: owenthereal/action-upterm@v1
        if: ${{ failure() }}
        with:
          wait-timeout-minutes: 5

      # macOS: zip the .app for tester distribution (same as release.yml non-tag path).
      - name: Zip macOS app
        if: matrix.platform == 'mac'
        shell: bash
        run: |
          set -euo pipefail
          # The .app bundle is named after productName (e.g. fee[dB]ack.app),
          # not the old "Slopsmith" name — find it dynamically so a rebrand
          # can't break the tester zip.
          app=$(ls -d release/mac*/*.app 2>/dev/null | head -n1 || true)
          if [[ -z "${app:-}" || ! -d "$app" ]]; then
            echo "::error::No .app bundle found under release/mac*/"
            exit 1
          fi
          name=$(basename "$app" .app)
          ditto -c -k --sequesterRsrc --keepParent "$app" "release/${name}-macos-arm64.zip"
          echo "Zipped $app -> release/${name}-macos-arm64.zip"

      # Windows: electron-builder's `dir` target leaves win-unpacked/ with no
      # packaged installer (Velopack is skipped for nightlies). Zip the directory
      # so testers can download and extract, then launch the app .exe directly.
      - name: Zip win-unpacked
        if: matrix.platform == 'win'
        shell: pwsh
        run: |
          Compress-Archive -Path release\win-unpacked\* -DestinationPath release\feedback-windows-x64.zip
          Write-Host "Zipped win-unpacked -> release\feedback-windows-x64.zip"

      - name: Clean up signing keychain
        if: always() && matrix.platform == 'mac'
        run: |
          security delete-keychain build.keychain 2>/dev/null || true

      - name: Upload nightly artifacts
        uses: actions/upload-artifact@v4
        with:
          name: nightly-${{ needs.setup.outputs.date }}-${{ matrix.platform }}-${{ matrix.arch }}
          path: |
            release/*.AppImage
            release/*.deb
            release/*.zip
            build/Release/*.pdb
          if-no-files-found: warn
          retention-days: 7