release.yml

name: release

on:
  push:
    tags:
      - "v*"

permissions:
  contents: write

concurrency:
  group: release-${{ github.ref }}
  cancel-in-progress: false

jobs:
  macos:
    runs-on: macos-15
    timeout-minutes: 90
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
      - name: Verify release version
        run: |
          version=$(/usr/libexec/PlistBuddy -c 'Print :CFBundleShortVersionString' Resources/Info.plist)
          test "$GITHUB_REF_NAME" = "v$version"
      - name: Test core behavior
        run: ./Scripts/test.sh
      - name: Build notarized release and signed update feed
        env:
          APPLE_APP_SPECIFIC_PASSWORD: ${{ secrets.APPLE_APP_SPECIFIC_PASSWORD }}
          APPLE_DEVELOPER_ID_CERTIFICATE: ${{ secrets.APPLE_DEVELOPER_ID_CERTIFICATE }}
          APPLE_DEVELOPER_ID_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_DEVELOPER_ID_CERTIFICATE_PASSWORD }}
          APPLE_ID: ${{ secrets.APPLE_ID }}
          APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
          CODEWINDOW_POSTHOG_KEY: ${{ secrets.CODEWINDOW_POSTHOG_KEY }}
          CODEWINDOW_POSTHOG_HOST: ${{ vars.CODEWINDOW_POSTHOG_HOST }}
          SPARKLE_PRIVATE_KEY: ${{ secrets.SPARKLE_PRIVATE_KEY }}
        run: |
          set -euo pipefail

          for variable in \
            APPLE_APP_SPECIFIC_PASSWORD \
            APPLE_DEVELOPER_ID_CERTIFICATE \
            APPLE_DEVELOPER_ID_CERTIFICATE_PASSWORD \
            APPLE_ID \
            APPLE_TEAM_ID \
            CODEWINDOW_POSTHOG_KEY \
            SPARKLE_PRIVATE_KEY; do
            test -n "${!variable}"
          done

          certificate_path="$RUNNER_TEMP/codewindow-developer-id.p12"
          keychain_path="$RUNNER_TEMP/codewindow-signing.keychain-db"
          keychain_password="$(uuidgen)"
          cleanup() {
            security delete-keychain "$keychain_path" >/dev/null 2>&1 || true
            /usr/bin/find "$certificate_path" -delete 2>/dev/null || true
          }
          trap cleanup EXIT

          printf '%s' "$APPLE_DEVELOPER_ID_CERTIFICATE" | /usr/bin/base64 --decode > "$certificate_path"
          security create-keychain -p "$keychain_password" "$keychain_path"
          security set-keychain-settings -lut 21600 "$keychain_path"
          security unlock-keychain -p "$keychain_password" "$keychain_path"
          security import "$certificate_path" \
            -k "$keychain_path" \
            -P "$APPLE_DEVELOPER_ID_CERTIFICATE_PASSWORD" \
            -T /usr/bin/codesign
          security set-key-partition-list \
            -S apple-tool:,apple:,codesign: \
            -s \
            -k "$keychain_password" \
            "$keychain_path"
          security list-keychains -d user -s "$keychain_path"

          xcrun notarytool store-credentials codewindow-ci \
            --apple-id "$APPLE_ID" \
            --team-id "$APPLE_TEAM_ID" \
            --password "$APPLE_APP_SPECIFIC_PASSWORD" \
            --keychain "$keychain_path"

          signing_identity="$(security find-identity -v -p codesigning "$keychain_path" | awk '/Developer ID Application:/ { print $2; exit }')"
          test -n "$signing_identity"

          export CODEWINDOW_EXPECTED_TEAM_ID="$APPLE_TEAM_ID"
          export CODEWINDOW_NOTARY_KEYCHAIN="$keychain_path"
          export CODEWINDOW_NOTARY_PROFILE="codewindow-ci"
          export CODEWINDOW_REQUIRE_NOTARIZATION=1
          export CODEWINDOW_SIGN_IDENTITY="$signing_identity"
          ./Scripts/package-release.sh

          test -s build/appcast.xml
          test -s build/notary-log.json
          test -s build/dmg-notary-log.json
          xcrun stapler validate build/CodeWindow.app
          spctl --assess --type execute --verbose=4 build/CodeWindow.app
      - name: Verify distributable disk image
        run: |
          set -euo pipefail
          version=$(/usr/libexec/PlistBuddy -c 'Print :CFBundleShortVersionString' Resources/Info.plist)
          disk_image="build/CodeWindow-v${version}-macOS-universal.dmg"
          test -s "$disk_image"
          (cd build && shasum -a 256 -c "CodeWindow-v${version}-macOS-universal.dmg.sha256")
          xcrun stapler validate "$disk_image"
          codesign --verify --strict --verbose=2 "$disk_image"
          spctl --assess --type open --context context:primary-signature --verbose=4 "$disk_image"

          mount_point="$RUNNER_TEMP/codewindow-dmg"
          mkdir -p "$mount_point"
          cleanup_mount() {
            hdiutil detach "$mount_point" >/dev/null 2>&1 || true
          }
          trap cleanup_mount EXIT
          hdiutil attach -readonly -nobrowse -mountpoint "$mount_point" "$disk_image" >/dev/null
          test -d "$mount_point/CodeWindow.app"
          test -L "$mount_point/Applications"
          test "$(readlink "$mount_point/Applications")" = "/Applications"
          cmp "$mount_point/.DS_Store" Resources/DMG/.DS_Store
          test ! -e "$mount_point/.background"
          xcrun stapler validate "$mount_point/CodeWindow.app"
          codesign --verify --deep --strict --verbose=2 "$mount_point/CodeWindow.app"
          spctl --assess --type execute --verbose=4 "$mount_point/CodeWindow.app"
          cleanup_mount
          trap - EXIT
      - name: Publish GitHub release
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          version=$(/usr/libexec/PlistBuddy -c 'Print :CFBundleShortVersionString' Resources/Info.plist)
          gh release create "$GITHUB_REF_NAME" \
            "build/CodeWindow-v${version}-macOS-universal.zip" \
            "build/CodeWindow-v${version}-macOS-universal.zip.sha256" \
            "build/CodeWindow-v${version}-macOS-universal.dmg" \
            "build/CodeWindow-v${version}-macOS-universal.dmg.sha256" \
            build/appcast.xml \
            --verify-tag \
            --title "CodeWindow $version" \
            --generate-notes