release.yml

name: Release

on:
  push:
    tags:
      - "v*.*.*"
  workflow_dispatch:
    inputs:
      version:
        description: "Stable version without v, for example 0.1.0 (main only)"
        required: true
        type: string

# One stable feed: never cancel a run midway through signing or publication.
# GitHub may replace a pending run with another pending run; dispatch again if
# several versions were queued. The monotonic-version check still prevents rollback.
concurrency:
  group: chippytea-stable-release
  cancel-in-progress: false

permissions:
  contents: read

defaults:
  run:
    shell: bash

jobs:
  validate:
    if: github.repository == 'richiemcilroy/chippytea'
    runs-on: ubuntu-24.04
    timeout-minutes: 10
    outputs:
      version: ${{ steps.plan.outputs.version }}
      tag: ${{ steps.plan.outputs.tag }}
      sha: ${{ steps.plan.outputs.sha }}
    steps:
      - name: Check out the triggering commit
        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
        with:
          fetch-depth: 0
          persist-credentials: false
      - name: Set up release tooling
        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6
        with:
          python-version: "3.12"
      - name: Test release safety checks
        run: python3 -B -m unittest discover -s scripts/release -p test_release.py -v
      - name: Validate source, version, tag, and previous channel
        id: plan
        env:
          GH_TOKEN: ${{ github.token }}
          RELEASE_INPUT_VERSION: ${{ inputs.version || '' }}
        run: |
          python3 -B scripts/release/release.py plan \
            --output "$RUNNER_TEMP/release-plan.json" \
            --github-output "$GITHUB_OUTPUT"

  release:
    needs: validate
    runs-on: macos-15
    environment: release
    timeout-minutes: 100
    permissions:
      contents: write
    env:
      DEVELOPER_DIR: /Applications/Xcode_26.2.app/Contents/Developer
      RELEASE_VERSION: ${{ needs.validate.outputs.version }}
    steps:
      - name: Check out the validated source commit
        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
        with:
          ref: ${{ needs.validate.outputs.sha }}
          fetch-depth: 0
          persist-credentials: false
      - name: Set up release tooling
        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6
        with:
          python-version: "3.12"
      - name: Configure isolated release paths
        run: |
          {
            printf '%s\n' "CHIPPYTEA_RELEASE_PLAN=$RUNNER_TEMP/release-plan.json"
            printf '%s\n' "CHIPPYTEA_RELEASE_LOG_DIR=$RUNNER_TEMP/chippytea-release-logs"
          } >> "$GITHUB_ENV"
      - name: Set up universal Rust targets
        run: |
          rustup toolchain install stable --profile minimal
          rustup default stable
          rustup target add aarch64-apple-darwin x86_64-apple-darwin
      - name: Recheck the channel before accessing signing secrets
        env:
          GH_TOKEN: ${{ github.token }}
          RELEASE_INPUT_VERSION: ${{ inputs.version || '' }}
        run: |
          python3 -B scripts/release/release.py plan --output "$CHIPPYTEA_RELEASE_PLAN"
          unset GH_TOKEN GITHUB_TOKEN
          python3 -B -m unittest discover -s scripts/release -p test_release.py -v
          env -u CARGO_TARGET_DIR -u CARGO_BUILD_TARGET_DIR \
            cargo test --locked --target-dir "$RUNNER_TEMP/chippytea-release-checks"
      - name: Build, notarize, staple, and validate the signed update
        env:
          GH_TOKEN: ${{ github.token }}
          APPLE_CERTIFICATE_P12_BASE64: ${{ secrets.APPLE_CERTIFICATE_P12_BASE64 }}
          APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
          APPLE_SIGNING_IDENTITY: ${{ vars.APPLE_SIGNING_IDENTITY || secrets.APPLE_SIGNING_IDENTITY }}
          APPLE_TEAM_ID: ${{ vars.APPLE_TEAM_ID || secrets.APPLE_TEAM_ID }}
          APPLE_ID: ${{ secrets.APPLE_ID }}
          APPLE_APP_SPECIFIC_PASSWORD: ${{ secrets.APPLE_APP_SPECIFIC_PASSWORD }}
          ASC_KEY_ID: ${{ secrets.ASC_KEY_ID }}
          ASC_ISSUER_ID: ${{ secrets.ASC_ISSUER_ID }}
          ASC_PRIVATE_KEY: ${{ secrets.ASC_PRIVATE_KEY }}
          SPARKLE_PRIVATE_KEY: ${{ secrets.SPARKLE_PRIVATE_KEY }}
        run: |
          bash scripts/release/build-release.sh "$RELEASE_VERSION" \
            "$RUNNER_TEMP/chippytea-release-output"
      - name: Preserve the verified release artifacts
        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
        with:
          name: chippytea-${{ needs.validate.outputs.version }}-${{ needs.validate.outputs.sha }}
          path: |
            ${{ runner.temp }}/chippytea-release-output/chippytea-${{ needs.validate.outputs.version }}-universal.dmg
            ${{ runner.temp }}/chippytea-release-output/chippytea-${{ needs.validate.outputs.version }}-universal.zip
            ${{ runner.temp }}/chippytea-release-output/appcast.xml
            ${{ runner.temp }}/chippytea-release-output/release-notes.md
            ${{ runner.temp }}/chippytea-release-output/release.json
            ${{ runner.temp }}/chippytea-release-output/SHA256SUMS
          if-no-files-found: error
          retention-days: 14
      - name: Publish verified draft assets and advance the public feed
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          python3 -B scripts/release/release.py publish \
            --plan "$CHIPPYTEA_RELEASE_PLAN" \
            --artifacts "$RUNNER_TEMP/chippytea-release-output"
      - name: Preserve notarization diagnostics on failure
        if: failure()
        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
        with:
          name: notarization-diagnostics-${{ needs.validate.outputs.version }}
          path: ${{ runner.temp }}/chippytea-release-logs/notary-*.json
          if-no-files-found: ignore
          retention-days: 7