build.yml

name: Zen Release builds

on:
  workflow_dispatch:
    inputs:
      create_release:
        description: 'Create a new release for this build'
        required: false
        default: false
        type: 'boolean'
      update_version:
        description: 'Update the version number'
        required: false
        default: false
        type: 'boolean'
      update_branch:
        description: 'Update branch with new version'
        required: true
        default: 'beta'
        type: 'choice'
        options:
          - 'beta'
          - 'twilight'
  workflow_call:
    inputs:
      create_release:
        description: 'Create a new release for this build'
        required: false
        default: false
        type: 'boolean'
      update_version:
        description: 'Update the version number'
        required: false
        default: false
        type: 'boolean'
      update_branch:
        description: 'Update branch with new version'
        required: true
        default: 'beta'
        type: 'string'

jobs:
  debug-inputs:
    name: Debug inputs
    runs-on: ubuntu-latest
    steps:
      - name: Debug
        run: |
          echo "create_release: ${{ inputs.create_release }}"
          echo "update_version: ${{ inputs.update_version }}"
          echo "update_branch: ${{ inputs.update_branch }}"
          echo "GITHUB_REPOSITORY: ${{ github.repository }}"
          echo "GITHUB_REPOSITORY_OWNER: ${{ github.repository_owner }}"
          echo "GITHUB_REPOSITORY_OWNER: ${{ github.repository_owner }}"
          echo "GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}"

  check-build-is-correct:
    runs-on: ubuntu-latest
    needs: [debug-inputs]
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4
        with:
          submodules: recursive
          token: ${{ secrets.DEPLOY_KEY }}
          fetch-depth: 0

      - name: Check if correct branch
        run: |
          echo "Checking if we are on the correct branch"
          git branch
          git status
          git branch --show-current
          branch="${{ inputs.update_branch }}"
          if [[ $branch == "beta" ]]; then
            branch="stable"
          elif [[ $branch == "twilight" ]]; then
            branch="dev"
          fi
          if [[ $(git branch --show-current) != $branch ]]; then
            echo ">>> Branch mismatch"
            exit 1
          else
            echo ">>> Branch matches"
          fi

  build-data:
    permissions:
      contents: write
    name: Generate build data
    runs-on: ubuntu-latest
    needs: check-build-is-correct
    outputs:
      build_date: ${{ steps.data.outputs.builddate }}
      version: ${{ steps.data.outputs.version }}
      build_time: ${{ steps.data.outputs.buildtime }}
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4
        with:
          submodules: recursive
          token: ${{ secrets.DEPLOY_KEY }}

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version-file: '.nvmrc'

      - name: Setup pnpm
        run: npm install -g pnpm

      - name: Get pnpm store directory
        id: pnpm-cache
        shell: bash
        run: |
          echo "STORE_PATH=$(pnpm store path)" >> $GITHUB_OUTPUT

      - name: Install dependencies
        run: |
          pnpm install

      - name: Setup Surfer
        run: |
          npm i -g @zen-browser/surfer

      - name: Bump version
        if: ${{ inputs.update_version && inputs.update_branch == 'beta' }}
        run: |
          pnpm surfer ci --brand ${{ inputs.update_branch }} --bump prerelease

      - name: Bump version without new version
        if: ${{ !inputs.update_version || inputs.update_branch == 'twilight' }}
        run: |
          pnpm surfer ci --brand ${{ inputs.update_branch }}

      - name: Debug
        run: |
          surfer get version
          surfer get version | xargs
          echo "$(surfer get version | xargs)"

      - name: Export release date
        id: data
        shell: bash
        run: |
          echo "builddate=$(date +"%Y-%m-%d")" >> $GITHUB_OUTPUT
          echo "version=$(surfer get version | xargs)" >> $GITHUB_OUTPUT
          echo "buildtime=$(date +"%H:%M:%S")" >> $GITHUB_OUTPUT

      - name: Commit
        uses: stefanzweifel/git-auto-commit-action@v5
        if: ${{ inputs.update_version }}
        with:
          commit_message: 🔖 Update version to ${{ steps.data.outputs.version }}
          commit_user_name: Zen Browser Robot
          commit_user_email: zen-browser-auto@users.noreply.github.com

  check-release:
    runs-on: ubuntu-latest
    needs: [build-data]
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4
        with:
          submodules: recursive
          token: ${{ secrets.DEPLOY_KEY }}

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version-file: '.nvmrc'

      - name: Setup pnpm
        run: npm install -g pnpm

      - name: Get pnpm store directory
        id: pnpm-cache
        shell: bash
        run: |
          echo "STORE_PATH=$(pnpm store path)" >> $GITHUB_OUTPUT

      - name: Install dependencies
        run: |
          pnpm install

      - name: Setup Surfer
        run: |
          npm i -g @zen-browser/surfer

      - name: Activate Surfer CLI
        run: |
          echo "There's a bug in the Surfer CLI, we run this so that Surfer sets everything up correctly"
          pnpm surfer ci --brand ${{ inputs.update_branch }} --display-version ${{ needs.build-data.outputs.version }}

      - name: Check version
        run: |
          echo "$(pwd)"
          ls .
          echo "version=$(pnpm surfer get version | xargs)" >> $GITHUB_OUTPUT
          if [[ $(pnpm surfer get version | xargs) == ${{ needs.build-data.outputs.version }} ]]; then
            echo ">>> Version matches"
          else
            echo ">>> Version mismatch"
            exit 1
          fi

  source:
    permissions:
      contents: write
    runs-on: ubuntu-latest
    needs: [build-data, check-release]

    steps:
      - name: Checkout repository
        uses: actions/checkout@v4
        with:
          submodules: recursive
          token: ${{ secrets.DEPLOY_KEY }}

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version-file: '.nvmrc'

      - name: Setup Git
        run: |
          git config --global user.email "mauro-balades@users.noreply.github.com"
          git config --global user.name "mauro-balades"

      - name: Setup pnpm
        run: npm install -g pnpm

      - name: Get pnpm store directory
        id: pnpm-cache
        shell: bash
        run: |
          echo "STORE_PATH=$(pnpm store path)" >> $GITHUB_OUTPUT

      - name: Install dependencies
        run: |
          pnpm install

      - name: Load Surfer CI setup
        run: pnpm surfer ci --brand ${{ inputs.update_branch }} --display-version ${{ needs.build-data.outputs.version }}

      - name: Download Firefox source and dependencies
        run: pnpm surfer download --verbose

      - name: Import
        run: pnpm surfer import --verbose

      - name: Compress
        run: |
          cd engine
          tar --use-compress-program=zstd -hcf ../zen.source.tar.gz *
          cd ..

      - name: Upload artifact
        uses: actions/upload-artifact@v4
        with:
          name: zen.source.tar.gz
          path: ./zen.source.tar.gz

  windows-step-1:
    name: Windows build step 1 (PGO build)
    uses: ./.github/workflows/windows-release-build.yml
    needs: [build-data]
    permissions:
      contents: write
    secrets: inherit
    with:
      build-version: ${{ needs.build-data.outputs.version }}
      generate-gpo: true
      profile-data-path-archive: zen-windows-profile-data-and-jarlog.zip
      release-branch: ${{ inputs.update_branch }}

  windows-step-2:
    name: Windows build step 2 (Generate profile data)
    uses: ./.github/workflows/windows-profile-build.yml
    permissions:
      contents: write
    secrets: inherit
    needs: [windows-step-1, build-data]
    with:
      build-version: ${{ needs.build-data.outputs.version }}
      profile-data-path-archive: zen.win64-pgo-stage-1.zip
      release-branch: ${{ inputs.update_branch }}

  windows-step-3:
    name: Windows build step 3 (build with profile data)
    uses: ./.github/workflows/windows-release-build.yml
    permissions:
      contents: write
    secrets: inherit
    needs: [build-data, windows-step-2]
    with:
      build-version: ${{ needs.build-data.outputs.version }}
      generate-gpo: false
      release-branch: ${{ inputs.update_branch }}

  linux:
    name: Linux build
    uses: ./.github/workflows/linux-release-build.yml
    permissions:
      contents: write
    secrets: inherit
    needs: [build-data]
    with:
      build-version: ${{ needs.build-data.outputs.version }}
      release-branch: ${{ inputs.update_branch }}

  mac:
    name: macOS build
    uses: ./.github/workflows/macos-release-build.yml
    permissions:
      contents: write
    secrets: inherit
    needs: [build-data]
    with:
      build-version: ${{ needs.build-data.outputs.version }}
      release-branch: ${{ inputs.update_branch }}

  appimage:
    name: AppImage build - Linux ${{ matrix.arch == 'x86_64' && 'generic' || matrix.arch == 'x86_64-v3' && 'specific' || matrix.arch == 'aarch64' && 'aarch64' }}
    permissions:
      contents: write
    runs-on: ubuntu-latest
    strategy:
      matrix:
        arch: [x86_64, x86_64-v3, aarch64]
    needs: [linux]
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4
        with:
          submodules: recursive
          token: ${{ secrets.DEPLOY_KEY }}

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version-file: '.nvmrc'

      - name: Install dependencies
        run: |
          npm install -g pnpm
          sudo apt-get update
          sudo apt-get -y install libfuse2 desktop-file-utils appstream

      - name: Download Linux build
        uses: actions/download-artifact@v4
        with:
          name: zen.linux-${{ matrix.arch == 'x86_64' && 'generic' || matrix.arch == 'x86_64-v3' && 'specific' || matrix.arch == 'aarch64' && 'aarch64' }}.tar.bz2

      - name: Execute AppImage build
        run: |
          set -eux
          rm AppDir/.DirIcon || true
          cp configs/branding/${{ inputs.update_branch }}/logo128.png AppDir/usr/share/icons/hicolor/128x128/apps/zen.png
          cp configs/branding/${{ inputs.update_branch }}/logo128.png AppDir/zen.png && ln -s zen.png AppDir/.DirIcon

          if [ "${{ inputs.update_branch }}" = "twilight" ]; then
            sed -i -e 's/Name=Zen Browser/Name=Zen Twilight/g' AppDir/zen.desktop
            sed -i -e 's/StartupWMClass=zen-beta/StartupWMClass=zen-twilight/g' AppDir/zen.desktop
          fi

          APPDIR=AppDir
          tar -xvf *.tar.* && rm -rf *.tar.*
          mv zen/* $APPDIR/
          wget https://github.com/AppImage/appimagetool/releases/download/continuous/appimagetool-x86_64.AppImage
          chmod +x *.AppImage
          chmod +x ./AppDir/AppRun
          echo "AppDir: $APPDIR"
          ls -al
          find .
          ls -al "$APPDIR"
          ARCH=${{ matrix.arch == 'aarch64' && 'aarch64' || 'x86_64' }} ./appimagetool-x86_64.AppImage --comp zstd --mksquashfs-opt -Xcompression-level --mksquashfs-opt 10 \
          -u "gh-releases-zsync|$GITHUB_REPOSITORY_OWNER|desktop|latest|zen-${{ matrix.arch == 'x86_64' && 'generic' || matrix.arch == 'x86_64-v3' && 'specific' || matrix.arch == 'aarch64' && 'aarch64' }}.AppImage.zsync" \
          "$APPDIR" zen-${{ matrix.arch == 'x86_64' && 'generic' || matrix.arch == 'x86_64-v3' && 'specific' || matrix.arch == 'aarch64' && 'aarch64' }}.AppImage
          mkdir dist
          mv zen*AppImage* dist/.

      - name: Upload artifact
        uses: actions/upload-artifact@v4
        with:
          name: zen-${{ matrix.arch == 'x86_64' && 'generic' || matrix.arch == 'x86_64-v3' && 'specific' || matrix.arch == 'aarch64' && 'aarch64' }}.AppImage
          path: ./dist/zen-${{ matrix.arch == 'x86_64' && 'generic' || matrix.arch == 'x86_64-v3' && 'specific' || matrix.arch == 'aarch64' && 'aarch64' }}.AppImage

      - name: Upload artifact (ZSync)
        uses: actions/upload-artifact@v4
        with:
          name: zen-${{ matrix.arch == 'x86_64' && 'generic' || matrix.arch == 'x86_64-v3' && 'specific' || matrix.arch == 'aarch64' && 'aarch64' }}.AppImage.zsync
          path: ./dist/zen-${{ matrix.arch == 'x86_64' && 'generic' || matrix.arch == 'x86_64-v3' && 'specific' || matrix.arch == 'aarch64' && 'aarch64' }}.AppImage.zsync

  release:
    if: ${{ inputs.create_release || inputs.update_branch == 'twilight' }}
    permissions: write-all
    name: Release
    needs: [build-data, linux, windows-step-3, check-release, mac, appimage, source]
    runs-on: ubuntu-latest
    environment:
      name: ${{ inputs.update_branch == 'beta' && 'Deploy-Release' || 'Deploy-Twilight' }}

    steps:
      - name: Checkout repository
        uses: actions/checkout@v4
        with:
          submodules: recursive
          token: ${{ secrets.DEPLOY_KEY }}

      - name: Git pull
        run: |
          git pull

      - name: Download artifact
        uses: actions/download-artifact@v4

      - name: List
        run: find .

      - name: Checkout updates repository
        uses: actions/checkout@v4
        with:
          repository: zen-browser/updates-server
          path: updates-server
          token: ${{ secrets.DEPLOY_KEY }}

      - name: Download object files
        run: |
          git clone https://github.com/zen-browser/windows-binaries.git .github/workflows/object

      - name: Copy update manifests
        env:
          RELEASE_BRANCH: ${{ inputs.update_branch }}
        run: |
          cd updates-server
          mkdir -p updates
          cp -a ../linux_update_manifest_generic/.  updates/
          cp -a ../linux_update_manifest_specific/.  updates/
          cp -a ../linux_update_manifest_aarch64/.  updates/

          if [[ $RELEASE_BRANCH == 'beta' ]]; then
            cp -a ../.github/workflows/object/windows-x64-signed-generic/update_manifest/.  updates/
            cp -a ../.github/workflows/object/windows-x64-signed-specific/update_manifest/.  updates/
            cp -a ../.github/workflows/object/windows-x64-signed-arm64/update_manifest/.  updates/
          else
            cp -a ../windows_update_manifest_generic/.  updates/
            cp -a ../windows_update_manifest_specific/.  updates/
            cp -a ../windows_update_manifest_arm64/.  updates/
          fi

          cp -a ../macos_update_manifest_aarch64/.  updates/
          cp -a ../macos_update_manifest_x86_64/.  updates/

      - name: Commit
        uses: stefanzweifel/git-auto-commit-action@v5
        with:
          commit_message: 🚀 Update update manifests
          commit_user_name: Zen Browser Robot
          commit_user_email: zen-browser-auto@users.noreply.github.com
          repository: ./updates-server

        # If we are on Twilight, we want to just update the Twilight tag's release
      - name: Update Twilight tag
        if: ${{ inputs.update_branch == 'twilight' }}
        uses: marvinpinto/action-automatic-releases@master
        with:
          files: |
            zen.source.tar.gz
            zen.linux-generic.tar.bz2
            zen.linux-specific.tar.bz2
            zen.linux-aarch64.tar.bz2
            zen-generic.AppImage
            zen-generic.AppImage.zsync
            zen-specific.AppImage
            zen-specific.AppImage.zsync
            zen-aarch64.AppImage
            zen-aarch64.AppImage.zsync
            zen.win-generic.zip
            zen.win-specific.zip
            zen.win-arm64.zip
            linux.mar
            linux-generic.mar
            linux-aarch64.mar
            windows-generic.mar
            windows.mar
            windows-arm64.mar
            macos-x86_64.mar
            macos-aarch64.mar
            zen.installer.exe
            zen.installer-generic.exe
            zen.installer-arm64.exe
            zen.macos-x86_64.dmg
            zen.macos-aarch64.dmg
          automatic_release_tag: 'twilight'
          title: 'Twilight build - ${{ needs.build-data.outputs.version }} (${{ needs.build-data.outputs.build_date }} at ${{ needs.build-data.outputs.build_time }})'
          draft: false
          prerelease: true
          repo_token: ${{ github.token }}
        env:
          GITHUB_REPOSITORY: ${{ github.repository }}

      - name: Release
        uses: marvinpinto/action-automatic-releases@master
        if: ${{ inputs.update_branch == 'beta' }}
        with:
          repo_token: '${{ secrets.DEPLOY_KEY }}'
          automatic_release_tag: ${{ needs.build-data.outputs.version }}
          prerelease: false
          title: 'Beta build - ${{ needs.build-data.outputs.version }} (${{ needs.build-data.outputs.build_date }})'
          files: |
            zen.source.tar.gz
            zen.linux-generic.tar.bz2
            zen.linux-specific.tar.bz2
            zen.linux-aarch64.tar.bz2
            zen-generic.AppImage
            zen-generic.AppImage.zsync
            zen-specific.AppImage
            zen-specific.AppImage.zsync
            zen-aarch64.AppImage
            zen-aarch64.AppImage.zsync
            .github/workflows/object/windows-x64-signed-generic/zen.win-generic.zip
            .github/workflows/object/windows-x64-signed-specific/zen.win-specific.zip
            .github/workflows/object/windows-x64-signed-arm64/zen.win-arm64.zip
            linux.mar
            linux-generic.mar
            linux-aarch64.mar
            .github/workflows/object/windows-x64-signed-generic/windows-generic.mar
            .github/workflows/object/windows-x64-signed-specific/windows.mar
            .github/workflows/object/windows-x64-signed-arm64/windows-arm64.mar
            macos-x86_64.mar
            macos-aarch64.mar
            .github/workflows/object/windows-x64-signed-specific/zen.installer.exe
            .github/workflows/object/windows-x64-signed-generic/zen.installer-generic.exe
            .github/workflows/object/windows-x64-signed-arm64/zen.installer-arm64.exe
            zen.macos-x86_64.dmg
            zen.macos-aarch64.dmg

  prepare-flatpak:
    if: ${{ inputs.create_release && inputs.update_branch == 'beta' }}
    permissions: write-all
    name: Prepare Flatpak
    needs: [release, linux, build-data]
    runs-on: ubuntu-latest

    steps:
      - name: Checkout Flatpak repository
        uses: actions/checkout@v4
        with:
          repository: zen-browser/release-utils
          token: ${{ secrets.DEPLOY_KEY }}

      - name: Install dependencies
        run: |
          git pull
          sudo apt-get update
          npm install

      - name: Generate new Flatpak release
        run: |
          npm run build-flatpak -- \
            --version ${{ needs.build-data.outputs.version }}

      - name: Commit
        uses: stefanzweifel/git-auto-commit-action@v5
        with:
          commit_message: 🚀 Update releases for Flatpak
          commit_user_name: Zen Browser Robot
          commit_user_email: zen-browser-auto@users.noreply.github.com

      - name: Checkout Flatpak repository
        uses: actions/checkout@v4
        with:
          repository: zen-browser/flatpak
          token: ${{ secrets.DEPLOY_KEY }}
          path: flatpak

      - name: Move releases.xml
        run: |
          pwd
          ls .
          ls ..
          mv releases.xml ./flatpak/io.github.zen_browser.zen.metainfo.xml
          # output the version to the file
          echo -n ${{ needs.build-data.outputs.version }} > ./flatpak/version

      - name: Commit
        uses: stefanzweifel/git-auto-commit-action@v5
        with:
          commit_message: '[release]: Update Flatpak manifest'
          commit_user_name: Zen Browser Robot
          commit_user_email: zen-browser-auto@users.noreply.github.com
          repository: ./flatpak

      - name: Wait 4 minutes for the Flatpak repo to update
        run: sleep 240

  release-flatpak:
    if: ${{ inputs.create_release && inputs.update_branch == 'beta' }}
    permissions: write-all
    name: Release Flatpak
    needs: [prepare-flatpak, build-data]
    runs-on: ubuntu-latest

    steps:
      - name: Checkout Flatpak repository
        uses: actions/checkout@v4
        with:
          repository: flathub/io.github.zen_browser.zen
          token: ${{ secrets.DEPLOY_KEY }}

      - name: Download Linux generic build
        uses: actions/download-artifact@v4
        with:
          name: zen.linux-generic.tar.bz2

      - name: Update repository
        uses: actions/checkout@v4
        with:
          path: zen-browser
          token: ${{ secrets.DEPLOY_KEY }}

      - name: Download Flatpak archive
        run: |
          wget https://github.com/zen-browser/flatpak/releases/latest/download/archive.tar -O archive.tar

      - name: Setup Git
        run: |
          git config --global user.name "github-actions[bot]"
          git config --global user.email "github-actions[bot]@users.noreply.github.com"

      - name: Prepare Flatpak manifest
        run: |
          python3 ./zen-browser/scripts/prepare-flatpak-release.py \
            --flatpak-archive archive.tar \
            --version ${{ needs.build-data.outputs.version }} \
            --linux-archive zen.linux-generic.tar.bz2 \
            --output io.github.zen_browser.zen.yml \
            --template-root ./zen-browser/flatpak

      - name: Commit changes
        run: |
          git add io.github.zen_browser.zen.yml
          git commit -m "Update to version ${{ needs.build-data.outputs.version }}"

      - name: Clean up
        run: |
          rm -rf zen-browser
          rm -rf archive.tar
          rm -rf zen.linux-generic.tar.bz2

      - name: Upload Flatpak manifest
        uses: actions/upload-artifact@v4
        with:
          name: io.github.zen_browser.zen.yml
          path: ./io.github.zen_browser.zen.yml

      - name: Create pull request
        uses: peter-evans/create-pull-request@v7
        env:
          GIT_TRACE: 1
          GIT_CURL_VERBOSE: 1
        with:
          token: ${{ secrets.DEPLOY_KEY }}
          commit-message: 🚀 Update to version ${{ needs.build-data.outputs.version }}
          title: 🚀 Update to version ${{ needs.build-data.outputs.version }}
          body: |
            This PR updates the Zen Browser Flatpak package to version ${{ needs.build-data.outputs.version }}.

            @${{ github.actor }} please review and merge this PR.
          branch: update-to-${{ needs.build-data.outputs.version }}
          base: master
          git-token: ${{ secrets.DEPLOY_KEY }}
          delete-branch: true

  release-homebrew-beta:
    if: ${{ inputs.create_release && inputs.update_branch == 'beta' }}
    permissions: write-all
    name: Homebrew release for beta build
    needs: [release, mac, build-data]
    runs-on: macos-latest

    steps:
      - name: Setup Homebrew
        uses: Homebrew/actions/setup-homebrew@master
        with:
          cask: true
          test-bot: false

      - name: Setup Git
        uses: Homebrew/actions/git-user-config@master
        with:
          username: zen-browser-auto

      - name: Bump cask
        uses: Homebrew/actions/bump-packages@master
        with:
          token: ${{ secrets.DEPLOY_KEY }}
          casks: zen-browser

  release-homebrew-twilight:
    if: ${{ inputs.create_release && inputs.update_branch == 'twilight' }}
    permissions: write-all
    name: Homebrew release for twilight build
    needs: [release, mac, build-data]
    runs-on: macos-latest

    steps:
      - name: Set up Homebrew
        uses: Homebrew/actions/setup-homebrew@master
        with:
          cask: true
          test-bot: false

      - name: Setup git
        uses: Homebrew/actions/git-user-config@master
        with:
          username: zen-browser-auto

      - name: Bump cask
        uses: Homebrew/actions/bump-packages@master
        with:
          token: ${{ secrets.DEPLOY_KEY }}
          casks: zen-browser@twilight