feat(desktop): automatic release pipeline (#1006)

* feat(desktop): automatic release pipeline

* refactor(desktop-release): remove build number infer since we won't release locally

* fix(desktop): correct MAS TestFlight release config

.github/workflows/desktop-release.yml

@@ -0,0 +1,125 @@
+name: Desktop Release
+
+on:
+  workflow_call:
+    inputs:
+      release_tag:
+        required: true
+        type: string
+      publish_testflight:
+        required: false
+        type: boolean
+        default: false
+      upload_github_release:
+        required: false
+        type: boolean
+        default: false
+
+permissions:
+  contents: read
+
+jobs:
+  testflight:
+    if: inputs.publish_testflight
+    environment: release
+    timeout-minutes: 30
+    runs-on: macos-15
+    permissions:
+      contents: read
+    env:
+      APP_STORE_CONNECT_API_KEY_ID: ${{ secrets.APP_STORE_CONNECT_API_KEY_ID }}
+      APP_STORE_CONNECT_ISSUER_ID: ${{ secrets.APP_STORE_CONNECT_ISSUER_ID }}
+      APP_STORE_CONNECT_API_KEY_BASE64: ${{ secrets.APP_STORE_CONNECT_API_KEY_BASE64 }}
+      CSC_LINK: ${{ secrets.CSC_LINK }}
+      CSC_KEY_PASSWORD: ${{ secrets.CSC_KEY_PASSWORD }}
+      ZEROBYTE_DESKTOP_VERSION: ${{ inputs.release_tag }}
+      ZEROBYTE_EXPORT_COMPLIANCE_CODE: ${{ secrets.ZEROBYTE_EXPORT_COMPLIANCE_CODE }}
+      ZEROBYTE_MAS_PROVISIONING_PROFILE_BASE64: ${{ secrets.ZEROBYTE_MAS_PROVISIONING_PROFILE_BASE64 }}
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+        with:
+          fetch-depth: 0
+          ref: ${{ github.ref }}
+
+      - name: Install dependencies
+        uses: "./.github/actions/install-dependencies"
+
+      - name: Install Fastlane dependencies
+        working-directory: apps/desktop
+        run: bundle install
+
+      - name: Write MAS provisioning profile
+        run: |
+          : "${ZEROBYTE_MAS_PROVISIONING_PROFILE_BASE64:?Set ZEROBYTE_MAS_PROVISIONING_PROFILE_BASE64 secret}"
+          profile_path="$RUNNER_TEMP/mac-app-store.provisionprofile"
+          echo "ZEROBYTE_MAS_PROVISIONING_PROFILE=$profile_path" >> "$GITHUB_ENV"
+          printf '%s' "$ZEROBYTE_MAS_PROVISIONING_PROFILE_BASE64" | base64 --decode > "$profile_path"
+          chmod 600 "$profile_path"
+
+      - name: Build and upload to TestFlight
+        working-directory: apps/desktop
+        env:
+          FASTLANE_HIDE_CHANGELOG: "true"
+          FASTLANE_SKIP_UPDATE_CHECK: "true"
+        run: bundle exec fastlane mac beta
+
+      - name: Clean TestFlight release secrets
+        if: always()
+        run: |
+          if [ -n "${ZEROBYTE_MAS_PROVISIONING_PROFILE:-}" ]; then
+            rm -f "$ZEROBYTE_MAS_PROVISIONING_PROFILE"
+          fi
+          rm -rf apps/desktop/dist/mas-arm64
+
+  github-release:
+    if: inputs.upload_github_release
+    environment: release
+    timeout-minutes: 30
+    runs-on: macos-15
+    permissions:
+      contents: read
+    env:
+      APP_STORE_CONNECT_API_KEY_BASE64: ${{ secrets.APP_STORE_CONNECT_API_KEY_BASE64 }}
+      APPLE_API_KEY: ${{ runner.temp }}/AuthKey.p8
+      APPLE_API_KEY_ID: ${{ secrets.APP_STORE_CONNECT_API_KEY_ID }}
+      APPLE_API_ISSUER: ${{ secrets.APP_STORE_CONNECT_ISSUER_ID }}
+      CSC_LINK: ${{ secrets.CSC_LINK }}
+      CSC_KEY_PASSWORD: ${{ secrets.CSC_KEY_PASSWORD }}
+      ZEROBYTE_DESKTOP_VERSION: ${{ inputs.release_tag }}
+      ZEROBYTE_EXPORT_COMPLIANCE_CODE: ${{ secrets.ZEROBYTE_EXPORT_COMPLIANCE_CODE }}
+      ZEROBYTE_MAC_SIGN: "true"
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+        with:
+          fetch-depth: 0
+          ref: ${{ github.ref }}
+
+      - name: Install dependencies
+        uses: "./.github/actions/install-dependencies"
+
+      - name: Write App Store Connect API key
+        run: |
+          printf '%s' "$APP_STORE_CONNECT_API_KEY_BASE64" | base64 --decode > "$APPLE_API_KEY"
+          chmod 600 "$APPLE_API_KEY"
+
+      - name: Build DMG
+        working-directory: apps/desktop
+        run: bun run make
+
+      - name: Upload DMG artifact
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        with:
+          name: desktop-github-release
+          path: |
+            apps/desktop/dist/*.dmg
+          if-no-files-found: error
+          retention-days: 1
+          compression-level: 0
+
+      - name: Clean GitHub release secrets
+        if: always()
+        run: |
+          rm -f "$APPLE_API_KEY"
+          rm -rf apps/desktop/dist

.github/workflows/release.yml

@@ -107,6 +107,16 @@ jobs:
           build-args: |
             APP_VERSION=${{ needs.determine-release-type.outputs.tagname }}
 
+  publish-desktop-testflight:
+    needs: [determine-release-type, checks, e2e-tests, integration-tests]
+    uses: ./.github/workflows/desktop-release.yml
+    permissions:
+      contents: read
+    with:
+      release_tag: ${{ needs.determine-release-type.outputs.tagname }}
+      publish_testflight: true
+    secrets: inherit
+
   publish-release:
     runs-on: ubuntu-latest
     needs: [build-images, determine-release-type]