build.yml

name: Arduino Lab for MicroPython

on:
  push:
    branches:
      - main
      - develop
    tags:
      - '[0-9]+.[0-9]+.[0-9]+*'
  workflow_dispatch:
  pull_request:
    branches:
      - develop

env:
  JOB_TRANSFER_ARTIFACT: build-artifacts
  NODE_VERSION: 20.18

jobs:
  build:
    if: github.repository == 'arduino/lab-micropython-editor'
    strategy:
      fail-fast: false
      matrix:
        config:
          - os: macos-latest
            id: macos-universal
          - os: [self-hosted, windows-sign-pc]
            id: windows
          - os: ubuntu-latest
            id: linux-x64
          - os: ubuntu-24.04-arm
            id: linux-arm64
    runs-on: ${{ matrix.config.os }}
    timeout-minutes: 90

    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Install Node.js ${{ env.NODE_VERSION }} 
        if: runner.name != 'WINDOWS-SIGN-PC'
        uses: actions/setup-node@v4
        with:
          node-version: ${{ env.NODE_VERSION }}
          registry-url: 'https://registry.npmjs.org'

      - name: Install Python 3.x
        if: runner.name != 'WINDOWS-SIGN-PC'
        uses: actions/setup-python@v4
        with:
          python-version: '3.11.x'

      - name: Package
        shell: bash
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          AC_USERNAME: ${{ secrets.AC_USERNAME }}
          AC_PASSWORD: ${{ secrets.AC_PASSWORD }}
          AC_TEAM_ID: ${{ secrets.AC_TEAM_ID }}
          INSTALLER_CERT_WINDOWS_CER: "/tmp/cert.cer"
          # We are hardcoding the path for signtool because is not present on the windows PATH env var by default.
          # Keep in mind that this path could change when upgrading to a new runner version
          SIGNTOOL_PATH: "C:/Program Files (x86)/Windows Kits/10/bin/10.0.19041.0/x86/signtool.exe"
          WIN_CERT_PASSWORD: ${{ secrets.INSTALLER_CERT_WINDOWS_PASSWORD }}
          WIN_CERT_CONTAINER_NAME: ${{ secrets.INSTALLER_CERT_WINDOWS_CONTAINER }}
          # AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
          # AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
          # IS_NIGHTLY: ${{ github.event_name == 'schedule' || (github.event_name == 'workflow_dispatch' && github.ref == 'refs/heads/main') }}
          IS_RELEASE: ${{ startsWith(github.ref, 'refs/tags/') }}
          IS_FORK: ${{ github.event.pull_request.head.repo.fork == true }}
          npm_config_target_arch: ${{ matrix.config.id == 'linux-arm64' && 'arm64' || '' }}
          ELECTRON_BUILDER_ARCH: ${{ matrix.config.id == 'linux-arm64' && 'arm64' || '' }}

        run: |
            # See: https://www.electron.build/code-signing
            if [ $IS_FORK = true ]; then
              echo "Skipping the app signing: building from a fork."
            else
              if [ "${{ runner.OS }}" = "macOS" ]; then
                export CSC_LINK="${{ runner.temp }}/signing_certificate.p12"
                # APPLE_SIGNING_CERTIFICATE_P12 secret was produced by following the procedure from:
                # https://www.kencochrane.com/2020/08/01/build-and-sign-golang-binaries-for-macos-with-github-actions/#exporting-the-developer-certificate
                echo "${{ secrets.APPLE_SIGNING_CERTIFICATE_P12 }}" | base64 --decode > "$CSC_LINK"

                export CSC_KEY_PASSWORD="${{ secrets.KEYCHAIN_PASSWORD }}"

              elif [ "${{ runner.OS }}" = "Windows" ]; then
                export CSC_LINK="${{ runner.temp }}/signing_certificate.pfx"
                # npm config set msvs_version 2017 --global
                echo "${{ secrets.WINDOWS_SIGNING_CERTIFICATE_PFX }}" | base64 --decode > "$CSC_LINK"

                export CSC_KEY_PASSWORD="${{ secrets.WINDOWS_SIGNING_CERTIFICATE_PASSWORD }}"
              fi
            fi

            npm install
            npm run build

      - name: Upload [GitHub Actions]
        uses: actions/upload-artifact@v4
        with:
          name: ${{ env.JOB_TRANSFER_ARTIFACT }}-${{ matrix.config.id }}
          path: dist
          overwrite: true

  artifacts:
    name: ${{ matrix.artifact.name }} artifact
    needs: build
    if: always() && needs.build.result != 'skipped'
    runs-on: ubuntu-latest

    strategy:
      matrix:
        artifact:
          - path: "*-mac_universal.zip"
            name: Arduino-Lab-for-MicroPython_macOS_Universal
            id: macos-universal
          - path: "*-win_x64.zip"
            name: Arduino-Lab-for-MicroPython_Windows_X86-64
            id: windows
          - path: "*-linux_x64.zip"
            name: Arduino-Lab-for-MicroPython_Linux_X86-64
            id: linux-x64
          - path: "*-linux_arm64.zip"
            name: Arduino-Lab-for-MicroPython_Linux_ARM64
            id: linux-arm64

          # keep for future implementation
          # Windows - installers (future)
          # - path: "*Windows_64bit.exe"
          #   name: Windows_X86-64_interactive_installer
          #   id: windows
          # - path: "*Windows_64bit.msi"
          #   name: Windows_X86-64_MSI
          #   id: windows
          

    steps:
      - name: Download job transfer artifact
        uses: actions/download-artifact@v4
        with:
          name: ${{ env.JOB_TRANSFER_ARTIFACT }}-${{ matrix.artifact.id }}
          path: ${{ env.JOB_TRANSFER_ARTIFACT }}
      - name: Upload tester build artifact
        uses: actions/upload-artifact@v4
        with:
          name: ${{ matrix.artifact.name }}
          path: ${{ env.JOB_TRANSFER_ARTIFACT }}/${{ matrix.artifact.path }}
          overwrite: true

  release:
    needs: build
    if: github.repository == 'arduino/lab-micropython-editor' && startsWith(github.ref, 'refs/tags/')
    runs-on: ubuntu-latest
    steps:
      - name: Download all artifacts
        uses: actions/download-artifact@v4
        with:
          pattern: build-artifacts-*
          path: artifacts
          
      - name: List artifacts
        run: ls -R artifacts

      - name: Get Tag
        id: tag_name
        run: |
          echo "TAG_NAME=${GITHUB_REF#refs/tags/}" >> $GITHUB_OUTPUT

      - name: Publish Release [GitHub]
        uses: svenstaro/upload-release-action@2.11.2
        with:
          repo_token: ${{ secrets.GITHUB_TOKEN }}
          release_name: ${{ steps.tag_name.outputs.TAG_NAME }}
          file: artifacts/**/*.zip
          tag: ${{ github.ref }}
          file_glob: true
          overwrite: true

  clean:
    # This job must run after all jobs that use the transfer artifact.
    needs:
      - build
      - release
      - artifacts
    if: always() && needs.build.result != 'skipped'
    runs-on: ubuntu-latest
    steps:
      - name: Remove unneeded job transfer artifacts
        uses: geekyeggo/delete-artifact@v5
        with:
          name: ${{ env.JOB_TRANSFER_ARTIFACT }}-*