release.yml

name: Release

on:
  push:
    tags:
      - "v*"
  workflow_dispatch:
    inputs:
      tag:
        description: Git tag to publish, for example v0.1.0
        required: true
        type: string

permissions:
  contents: write

jobs:
  release:
    runs-on: macos-15

    steps:
      - name: Check out repository
        uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Resolve release tag
        id: release
        shell: bash
        run: |
          if [[ "${GITHUB_EVENT_NAME}" == "workflow_dispatch" ]]; then
            tag="${{ github.event.inputs.tag }}"
            git fetch --tags origin
            git checkout "refs/tags/$tag"
          else
            tag="${GITHUB_REF_NAME}"
          fi

          if [[ ! "$tag" =~ ^v[0-9]+(\.[0-9]+)*$ ]]; then
            echo "expected tag in v<semver> form, got: $tag" >&2
            exit 1
          fi

          echo "tag=$tag" >> "$GITHUB_OUTPUT"
          echo "version=${tag#v}" >> "$GITHUB_OUTPUT"

      - name: Run tests
        shell: bash
        run: swift test

      - name: Import Apple signing assets
        id: apple-signing
        env:
          APPLE_DEVELOPER_ID_APPLICATION_CERTIFICATE_BASE64: ${{ secrets.APPLE_DEVELOPER_ID_APPLICATION_CERTIFICATE_BASE64 }}
          APPLE_DEVELOPER_ID_APPLICATION_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_DEVELOPER_ID_APPLICATION_CERTIFICATE_PASSWORD }}
          APPLE_DEVELOPER_ID_INSTALLER_CERTIFICATE_BASE64: ${{ secrets.APPLE_DEVELOPER_ID_INSTALLER_CERTIFICATE_BASE64 }}
          APPLE_DEVELOPER_ID_INSTALLER_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_DEVELOPER_ID_INSTALLER_CERTIFICATE_PASSWORD }}
          APP_STORE_CONNECT_API_KEY_BASE64: ${{ secrets.APP_STORE_CONNECT_API_KEY_BASE64 }}
          APP_STORE_CONNECT_API_KEY_ID: ${{ secrets.APP_STORE_CONNECT_API_KEY_ID }}
          APP_STORE_CONNECT_API_ISSUER_ID: ${{ secrets.APP_STORE_CONNECT_API_ISSUER_ID }}
        shell: bash
        run: scripts/import-apple-signing-assets.sh

      - name: Build release artifacts
        env:
          MACOS_APP_BUNDLE_ID: com.jianliang00.computer-use-cli
          MACOS_CODE_SIGN_IDENTITY: ${{ secrets.APPLE_DEVELOPER_ID_APPLICATION_IDENTITY }}
          MACOS_INSTALLER_SIGN_IDENTITY: ${{ secrets.APPLE_DEVELOPER_ID_INSTALLER_IDENTITY }}
          MACOS_CODE_SIGN_KEYCHAIN: ${{ steps.apple-signing.outputs.keychain-path }}
          MACOS_SIGNING_ENABLED: "1"
          MACOS_NOTARIZATION_ENABLED: "1"
          CREATE_INSTALLER_PKGS: "1"
          NOTARYTOOL_KEY_PATH: ${{ steps.apple-signing.outputs.notary-key-path }}
          NOTARYTOOL_KEY_ID: ${{ secrets.APP_STORE_CONNECT_API_KEY_ID }}
          NOTARYTOOL_ISSUER_ID: ${{ secrets.APP_STORE_CONNECT_API_ISSUER_ID }}
        shell: bash
        run: scripts/package-release-artifacts.sh "${{ steps.release.outputs.version }}" "$RUNNER_TEMP/release-artifacts"

      - name: Publish GitHub release
        env:
          GH_TOKEN: ${{ github.token }}
          GH_REPO: ${{ github.repository }}
        shell: bash
        run: |
          tag="${{ steps.release.outputs.tag }}"
          artifacts_dir="$RUNNER_TEMP/release-artifacts"

          if gh release view "$tag" --repo "$GH_REPO" >/dev/null 2>&1; then
            gh release upload "$tag" "$artifacts_dir"/* --clobber --repo "$GH_REPO"
          else
            gh release create "$tag" "$artifacts_dir"/* --title "$tag" --generate-notes --repo "$GH_REPO"
          fi

      - name: Clean up Apple signing keychain
        if: ${{ always() && steps.apple-signing.outputs.keychain-path != '' }}
        shell: bash
        run: security delete-keychain "${{ steps.apple-signing.outputs.keychain-path }}" || true