brainbar-release.yml

name: BrainBar Release

on:
  push:
    tags:
      - "v*"

permissions:
  contents: write

jobs:
  release:
    name: package BrainBar
    runs-on: macos-15
    steps:
      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5
        with:
          fetch-depth: 0
          persist-credentials: false

      - name: Verify release tag matches package version
        run: |
          set -euo pipefail
          package_version="$({
            awk '
              $0 == "[project]" { in_project = 1; next }
              in_project && /^\[/ { exit }
              in_project && $1 == "version" && $2 == "=" {
                gsub(/^"|"$/, "", $3)
                print $3
                exit
              }
            ' pyproject.toml
          })"
          expected_tag="v${package_version}"
          if [[ -z "$package_version" || "$GITHUB_REF_NAME" != "$expected_tag" ]]; then
            echo "::error title=Release tag mismatch::Tag '$GITHUB_REF_NAME' must equal '$expected_tag' from pyproject.toml"
            exit 1
          fi

      - name: Select Xcode (Swift 6)
        uses: maxim-lobanov/setup-xcode@ed7a3b1fda3918c0306d1b724322adc0b8cc0a90
        with:
          xcode-version: latest-stable

      - name: Swift version
        run: swift --version

      - name: Resolve release metadata
        run: |
          set -euo pipefail
          release_version="${GITHUB_REF_NAME#v}"
          if [[ ! "$release_version" =~ ^[0-9]+\.[0-9]+\.[0-9]+(\.[0-9]+)?$ ]]; then
            echo "::error title=Invalid BrainBar release tag::Expected tag format vX.Y.Z or interim vX.Y.Z.N; got '$GITHUB_REF_NAME'"
            exit 1
          fi
          bundle_short_version="$release_version"
          if [[ "$release_version" =~ ^[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
            bundle_short_version="${release_version%.*}"
          fi
          build_time_utc="$(date -u +"%Y-%m-%dT%H:%M:%SZ")"
          bundle_build_version="$(git rev-list --count HEAD)"
          echo "BRAINBAR_RELEASE_VERSION=$release_version" >> "$GITHUB_ENV"
          echo "BRAINBAR_BUNDLE_SHORT_VERSION=$bundle_short_version" >> "$GITHUB_ENV"
          echo "BRAINBAR_BUNDLE_BUILD_VERSION=$bundle_build_version" >> "$GITHUB_ENV"
          echo "BRAINBAR_BUILD_TIME_UTC=$build_time_utc" >> "$GITHUB_ENV"
          echo "BrainBar release version: $release_version"
          echo "BrainBar bundle short version: $bundle_short_version"
          echo "BrainBar bundle build version: $bundle_build_version"
          echo "BrainBar build time UTC: $build_time_utc"

      - name: Cache SwiftPM
        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830
        with:
          path: ~/.swiftpm
          key: ${{ runner.os }}-swiftpm-${{ hashFiles('brain-bar/Package.resolved') }}
          restore-keys: ${{ runner.os }}-swiftpm-

      - name: Build BrainBar
        run: cd brain-bar && swift build -c release

      - name: Assemble BrainBar.app
        run: |
          set -euo pipefail

          app_dir="$PWD/dist/BrainBar.app"
          bin_dir="$(cd brain-bar && swift build -c release --show-bin-path)"
          plist="$app_dir/Contents/Info.plist"
          launchagents_dir="$app_dir/Contents/Resources/LaunchAgents"
          plist_buddy="/usr/libexec/PlistBuddy"

          rm -rf "$PWD/dist"
          mkdir -p "$app_dir/Contents/MacOS" "$app_dir/Contents/Resources" "$launchagents_dir"
          cp brain-bar/bundle/Info.plist "$plist"
          cp brain-bar/bundle/AppIcon.icns "$app_dir/Contents/Resources/AppIcon.icns"
          cp "$bin_dir/BrainBar" "$app_dir/Contents/MacOS/BrainBar"
          cp "$bin_dir/BrainBarDaemon" "$app_dir/Contents/MacOS/BrainBarDaemon"
          cp brain-bar/bundle/com.brainlayer.brainbar.plist "$launchagents_dir/com.brainlayer.brainbar.plist"
          cp brain-bar/bundle/com.brainlayer.brainbar-daemon.plist "$launchagents_dir/com.brainlayer.brainbar-daemon.plist"

          set_plist_string() {
            local key="$1"
            local value="$2"
            if "$plist_buddy" -c "Print :$key" "$plist" >/dev/null 2>&1; then
              "$plist_buddy" -c "Set :$key $value" "$plist"
            else
              "$plist_buddy" -c "Add :$key string $value" "$plist"
            fi
          }

          set_plist_string CFBundleShortVersionString "$BRAINBAR_BUNDLE_SHORT_VERSION"
          set_plist_string CFBundleVersion "$BRAINBAR_BUNDLE_BUILD_VERSION"
          set_plist_string BrainLayerReleaseVersion "$BRAINBAR_RELEASE_VERSION"
          set_plist_string GitCommit "$GITHUB_SHA"
          set_plist_string GitDescribe "$GITHUB_REF_NAME"
          set_plist_string BuildTimeUTC "$BRAINBAR_BUILD_TIME_UTC"

          "$plist_buddy" -c "Print :CFBundleShortVersionString" "$plist"
          "$plist_buddy" -c "Print :GitCommit" "$plist"
          "$plist_buddy" -c "Print :BuildTimeUTC" "$plist"

      - name: Import Developer ID certificate
        id: signing
        env:
          BRAINBAR_DEVELOPER_ID_CERTIFICATE_BASE64: ${{ secrets.BRAINBAR_DEVELOPER_ID_CERTIFICATE_BASE64 }}
          BRAINBAR_DEVELOPER_ID_CERTIFICATE_PASSWORD: ${{ secrets.BRAINBAR_DEVELOPER_ID_CERTIFICATE_PASSWORD }}
          BRAINBAR_DEVELOPER_ID_APPLICATION: ${{ secrets.BRAINBAR_DEVELOPER_ID_APPLICATION }}
          BRAINBAR_SIGNING_KEYCHAIN_PASSWORD: ${{ secrets.BRAINBAR_SIGNING_KEYCHAIN_PASSWORD }}
        run: |
          set -euo pipefail

          if [ -z "$BRAINBAR_DEVELOPER_ID_CERTIFICATE_BASE64" ] \
            || [ -z "$BRAINBAR_DEVELOPER_ID_CERTIFICATE_PASSWORD" ] \
            || [ -z "$BRAINBAR_DEVELOPER_ID_APPLICATION" ]; then
            echo "::error title=BrainBar signing unavailable::Developer ID signing secrets are required before BrainBar.zip can be released."
            {
              echo "## BrainBar signing"
              echo ""
              echo "SIGNING FAILED: Developer ID secrets are not fully configured. BrainBar.zip was not released."
            } >> "$GITHUB_STEP_SUMMARY"
            exit 1
          fi

          keychain_password="${BRAINBAR_SIGNING_KEYCHAIN_PASSWORD:-$(uuidgen)}"
          cert_path="$RUNNER_TEMP/brainbar-developer-id.p12"
          keychain_path="$RUNNER_TEMP/brainbar-signing.keychain-db"

          echo "$BRAINBAR_DEVELOPER_ID_CERTIFICATE_BASE64" | base64 -D -o "$cert_path"
          security create-keychain -p "$keychain_password" "$keychain_path"
          security set-keychain-settings -lut 21600 "$keychain_path"
          security unlock-keychain -p "$keychain_password" "$keychain_path"
          security import "$cert_path" \
            -P "$BRAINBAR_DEVELOPER_ID_CERTIFICATE_PASSWORD" \
            -A \
            -t cert \
            -f pkcs12 \
            -k "$keychain_path"
          security set-key-partition-list -S apple-tool:,apple: -s -k "$keychain_password" "$keychain_path"
          security list-keychains -d user -s "$keychain_path"

          echo "signed=true" >> "$GITHUB_OUTPUT"
          echo "BRAINBAR_SIGNING_IDENTITY=$BRAINBAR_DEVELOPER_ID_APPLICATION" >> "$GITHUB_ENV"
          echo "BRAINBAR_SIGNING_STATUS=Developer ID signed" >> "$GITHUB_ENV"

      - name: Sign BrainBar.app
        if: steps.signing.outputs.signed == 'true'
        run: |
          set -euo pipefail
          codesign --force --deep --options runtime --timestamp --sign "$BRAINBAR_SIGNING_IDENTITY" dist/BrainBar.app
          codesign --verify --deep --strict --verbose=4 dist/BrainBar.app
          codesign -dv --verbose=4 dist/BrainBar.app

      - name: Notarize BrainBar.app
        if: steps.signing.outputs.signed == 'true'
        env:
          BRAINBAR_NOTARY_APPLE_ID: ${{ secrets.BRAINBAR_NOTARY_APPLE_ID }}
          BRAINBAR_NOTARY_PASSWORD: ${{ secrets.BRAINBAR_NOTARY_PASSWORD }}
          BRAINBAR_NOTARY_TEAM_ID: ${{ secrets.BRAINBAR_NOTARY_TEAM_ID }}
        run: |
          set -euo pipefail

          if [ -z "$BRAINBAR_NOTARY_APPLE_ID" ] \
            || [ -z "$BRAINBAR_NOTARY_PASSWORD" ] \
            || [ -z "$BRAINBAR_NOTARY_TEAM_ID" ]; then
            echo "::error title=BrainBar notarization unavailable::Notary secrets are required before BrainBar.zip can be released."
            {
              echo "## BrainBar notarization"
              echo ""
              echo "NOTARIZATION FAILED: notary secrets are not fully configured. BrainBar.zip was not released."
            } >> "$GITHUB_STEP_SUMMARY"
            exit 1
          fi

          notary_zip="$RUNNER_TEMP/BrainBar-notary.zip"
          ditto -c -k --keepParent dist/BrainBar.app "$notary_zip"
          xcrun notarytool submit "$notary_zip" \
            --apple-id "$BRAINBAR_NOTARY_APPLE_ID" \
            --password "$BRAINBAR_NOTARY_PASSWORD" \
            --team-id "$BRAINBAR_NOTARY_TEAM_ID" \
            --wait
          xcrun stapler staple dist/BrainBar.app
          xcrun stapler validate dist/BrainBar.app
          codesign --verify --deep --strict --verbose=4 dist/BrainBar.app
          spctl --assess --type execute --verbose=4 dist/BrainBar.app
          echo "BRAINBAR_NOTARIZATION_STATUS=notarized and stapled" >> "$GITHUB_ENV"

      - name: Package BrainBar.zip
        run: |
          set -euo pipefail
          ditto -c -k --keepParent dist/BrainBar.app dist/BrainBar.zip
          ls -lh dist/BrainBar.zip

      - name: Guard BrainBar.zip exists before release
        run: |
          set -euo pipefail
          if [ ! -s dist/BrainBar.zip ]; then
            echo "::error title=BrainBar.zip missing::Expected non-empty dist/BrainBar.zip before creating the GitHub Release"
            exit 1
          fi
          echo "BrainBar.zip size: $(stat -f%z dist/BrainBar.zip) bytes"

      - name: Verify packaged BrainBar.zip
        run: |
          set -euo pipefail
          verify_dir="$RUNNER_TEMP/brainbar-zip-verify"
          rm -rf "$verify_dir"
          mkdir -p "$verify_dir"
          ditto -x -k dist/BrainBar.zip "$verify_dir"
          codesign --verify --deep --strict --verbose=4 "$verify_dir/BrainBar.app"
          xcrun stapler validate "$verify_dir/BrainBar.app"
          spctl --assess --type execute --verbose=4 "$verify_dir/BrainBar.app"

      - name: Create GitHub Release
        uses: softprops/action-gh-release@3bb12739c298aeb8a4eeaf626c5b8d85266b0e65
        with:
          tag_name: ${{ github.ref_name }}
          name: BrainBar ${{ github.ref_name }}
          files: dist/BrainBar.zip
          fail_on_unmatched_files: true
          generate_release_notes: true
          append_body: true
          body: |
            BrainBar release version: ${{ env.BRAINBAR_RELEASE_VERSION }}
            Signing status: ${{ env.BRAINBAR_SIGNING_STATUS }}
            Notarization status: ${{ env.BRAINBAR_NOTARIZATION_STATUS }}