manual-release.yml

name: Manual Release

on:
  workflow_dispatch:
    inputs:
      tag_version:
        description: 'Existing tag version to release (e.g., v1.2.3)'
        required: true
        type: string

permissions:
  contents: write
  packages: write

env:
  GO_VERSION: '1.26'
  MACOS_XCODE_VERSION: 'latest-stable'
  REGISTRY: ghcr.io
  IMAGE_NAME: ${{ github.repository }}

jobs:
  validate-tag:
    runs-on: ubuntu-latest
    outputs:
      tag-exists: ${{ steps.check.outputs.exists }}
    steps:
    - name: Checkout code
      uses: actions/checkout@v4
      with:
        fetch-depth: 0

    - name: Check if tag exists
      id: check
      run: |
        if git tag -l | grep -q "^${{ github.event.inputs.tag_version }}$"; then
          echo "exists=true" >> $GITHUB_OUTPUT
          echo "✅ Tag ${{ github.event.inputs.tag_version }} exists"
        else
          echo "exists=false" >> $GITHUB_OUTPUT
          echo "❌ Tag ${{ github.event.inputs.tag_version }} does not exist"
          exit 1
        fi

  macos-release-sign-notarize:
    needs: validate-tag
    if: needs.validate-tag.outputs.tag-exists == 'true'
    runs-on: macos-latest
    outputs:
      release-ready: ${{ steps.apple-secrets.outputs.ready }}
    steps:
    - name: Checkout code
      uses: actions/checkout@v4
      with:
        ref: ${{ github.event.inputs.tag_version }}
        fetch-depth: 0

    - name: Check Apple release secrets
      id: apple-secrets
      shell: bash
      env:
        APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
        APPLE_DEV_ID_APPLICATION_CERT_BASE64: ${{ secrets.APPLE_DEV_ID_APPLICATION_CERT_BASE64 }}
        APPLE_DEV_ID_APPLICATION_CERT_PASSWORD: ${{ secrets.APPLE_DEV_ID_APPLICATION_CERT_PASSWORD }}
        APPLE_DEV_ID_INSTALLER_CERT_BASE64: ${{ secrets.APPLE_DEV_ID_INSTALLER_CERT_BASE64 }}
        APPLE_DEV_ID_INSTALLER_CERT_PASSWORD: ${{ secrets.APPLE_DEV_ID_INSTALLER_CERT_PASSWORD }}
        APPLE_KEYCHAIN_PASSWORD: ${{ secrets.APPLE_KEYCHAIN_PASSWORD }}
        APPLE_NOTARYTOOL_KEY_ID: ${{ secrets.APPLE_NOTARYTOOL_KEY_ID }}
        APPLE_NOTARYTOOL_ISSUER_ID: ${{ secrets.APPLE_NOTARYTOOL_ISSUER_ID }}
        APPLE_NOTARYTOOL_KEY_P8_BASE64: ${{ secrets.APPLE_NOTARYTOOL_KEY_P8_BASE64 }}
      run: |
        missing=()
        for var in \
          APPLE_TEAM_ID \
          APPLE_DEV_ID_APPLICATION_CERT_BASE64 \
          APPLE_DEV_ID_APPLICATION_CERT_PASSWORD \
          APPLE_DEV_ID_INSTALLER_CERT_BASE64 \
          APPLE_DEV_ID_INSTALLER_CERT_PASSWORD \
          APPLE_KEYCHAIN_PASSWORD \
          APPLE_NOTARYTOOL_KEY_ID \
          APPLE_NOTARYTOOL_ISSUER_ID \
          APPLE_NOTARYTOOL_KEY_P8_BASE64
        do
          if [ -z "${!var}" ]; then
            missing+=("$var")
          fi
        done

        if [ "${#missing[@]}" -gt 0 ]; then
          echo "ready=false" >> "$GITHUB_OUTPUT"
          {
            echo "### macOS release packaging skipped"
            echo
            echo "Missing Apple release secrets:"
            for item in "${missing[@]}"; do
              echo "- $item"
            done
          } >> "$GITHUB_STEP_SUMMARY"
          exit 0
        fi

        echo "ready=true" >> "$GITHUB_OUTPUT"
        echo "### macOS release packaging enabled" >> "$GITHUB_STEP_SUMMARY"

    - name: Select Xcode
      if: steps.apple-secrets.outputs.ready == 'true'
      uses: maxim-lobanov/setup-xcode@v1
      with:
        xcode-version: ${{ env.MACOS_XCODE_VERSION }}

    - name: Capture Xcode version
      if: steps.apple-secrets.outputs.ready == 'true'
      id: xcode
      run: |
        VERSION=$(xcodebuild -version | tr '\n' ' ' | sed 's/  */ /g')
        echo "version=$VERSION" >> $GITHUB_OUTPUT
        xcodebuild -version

    - name: Install XcodeGen
      if: steps.apple-secrets.outputs.ready == 'true'
      run: |
        brew list xcodegen >/dev/null 2>&1 || brew install xcodegen
        xcodegen version

    - name: Set up Go
      if: steps.apple-secrets.outputs.ready == 'true'
      uses: actions/setup-go@v5
      with:
        go-version: ${{ env.GO_VERSION }}
        cache: true

    - name: Cache macOS DerivedData
      if: steps.apple-secrets.outputs.ready == 'true'
      uses: actions/cache@v4
      with:
        path: .build/macos/DerivedData
        key: macos-release-deriveddata-${{ runner.os }}-${{ steps.xcode.outputs.version }}-${{ hashFiles('proto/localbroker/**/*.proto', 'buf*.yaml', 'platform/macos/PrivilegeServices/project.yml', 'platform/macos/PrivilegeServices/**/*.swift', 'platform/macos/PrivilegeServices/**/*.plist', 'platform/macos/PrivilegeServices/**/*.entitlements', 'platform/macos/PrivilegeServices/**/*.template', 'scripts/*macos-privilege-services*.sh', 'scripts/localbroker-codegen-common.sh', 'Makefile') }}
        restore-keys: |
          macos-release-deriveddata-${{ runner.os }}-${{ steps.xcode.outputs.version }}-

    - name: Import Developer ID certificates
      if: steps.apple-secrets.outputs.ready == 'true'
      shell: bash
      env:
        APPLE_KEYCHAIN_PASSWORD: ${{ secrets.APPLE_KEYCHAIN_PASSWORD }}
        APPLE_DEV_ID_APPLICATION_CERT_BASE64: ${{ secrets.APPLE_DEV_ID_APPLICATION_CERT_BASE64 }}
        APPLE_DEV_ID_APPLICATION_CERT_PASSWORD: ${{ secrets.APPLE_DEV_ID_APPLICATION_CERT_PASSWORD }}
        APPLE_DEV_ID_INSTALLER_CERT_BASE64: ${{ secrets.APPLE_DEV_ID_INSTALLER_CERT_BASE64 }}
        APPLE_DEV_ID_INSTALLER_CERT_PASSWORD: ${{ secrets.APPLE_DEV_ID_INSTALLER_CERT_PASSWORD }}
      run: |
        KEYCHAIN_PATH="$RUNNER_TEMP/thand-build.keychain-db"
        APP_CERT_PATH="$RUNNER_TEMP/dev-id-application.p12"
        INSTALLER_CERT_PATH="$RUNNER_TEMP/dev-id-installer.p12"

        echo "$APPLE_DEV_ID_APPLICATION_CERT_BASE64" | base64 --decode > "$APP_CERT_PATH"
        echo "$APPLE_DEV_ID_INSTALLER_CERT_BASE64" | base64 --decode > "$INSTALLER_CERT_PATH"

        security create-keychain -p "$APPLE_KEYCHAIN_PASSWORD" "$KEYCHAIN_PATH"
        security set-keychain-settings -lut 21600 "$KEYCHAIN_PATH"
        security unlock-keychain -p "$APPLE_KEYCHAIN_PASSWORD" "$KEYCHAIN_PATH"
        security import "$APP_CERT_PATH" -k "$KEYCHAIN_PATH" -P "$APPLE_DEV_ID_APPLICATION_CERT_PASSWORD" -T /usr/bin/codesign -T /usr/bin/security
        security import "$INSTALLER_CERT_PATH" -k "$KEYCHAIN_PATH" -P "$APPLE_DEV_ID_INSTALLER_CERT_PASSWORD" -T /usr/bin/productsign -T /usr/bin/security
        security list-keychains -d user -s "$KEYCHAIN_PATH" login.keychain-db
        security default-keychain -d user -s "$KEYCHAIN_PATH"
        security set-key-partition-list -S apple-tool:,apple: -s -k "$APPLE_KEYCHAIN_PASSWORD" "$KEYCHAIN_PATH"

    - name: Configure notarytool profile
      if: steps.apple-secrets.outputs.ready == 'true'
      shell: bash
      env:
        APPLE_NOTARYTOOL_KEY_ID: ${{ secrets.APPLE_NOTARYTOOL_KEY_ID }}
        APPLE_NOTARYTOOL_ISSUER_ID: ${{ secrets.APPLE_NOTARYTOOL_ISSUER_ID }}
        APPLE_NOTARYTOOL_KEY_P8_BASE64: ${{ secrets.APPLE_NOTARYTOOL_KEY_P8_BASE64 }}
      run: |
        KEY_PATH="$RUNNER_TEMP/AuthKey_${APPLE_NOTARYTOOL_KEY_ID}.p8"
        echo "$APPLE_NOTARYTOOL_KEY_P8_BASE64" | base64 --decode > "$KEY_PATH"
        xcrun notarytool store-credentials thand-ci-notary \
          --key "$KEY_PATH" \
          --key-id "$APPLE_NOTARYTOOL_KEY_ID" \
          --issuer "$APPLE_NOTARYTOOL_ISSUER_ID"
        echo "NOTARYTOOL_PROFILE=thand-ci-notary" >> "$GITHUB_ENV"

    - name: Package signed macOS installer
      if: steps.apple-secrets.outputs.ready == 'true'
      env:
        APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
      run: |
        PACKAGE_VERSION="${{ github.event.inputs.tag_version }}"
        PACKAGE_VERSION="${PACKAGE_VERSION#v}"
        export PACKAGE_VERSION
        ./scripts/package-macos-privilege-services-release.sh

    - name: Upload macOS installer artifact
      if: steps.apple-secrets.outputs.ready == 'true'
      uses: actions/upload-artifact@v4
      with:
        name: thand-macos-privilege-services-pkg
        path: .build/macos/PrivilegeServices/release/ThandPrivilegeServices.pkg

  release:
    needs: [validate-tag, macos-release-sign-notarize]
    if: needs.validate-tag.outputs.tag-exists == 'true'
    runs-on: ubuntu-latest
    steps:
    - name: Checkout code
      uses: actions/checkout@v4
      with:
        ref: ${{ github.event.inputs.tag_version }}
        fetch-depth: 0

    - name: Log in to Container Registry
      uses: docker/login-action@v3
      with:
        registry: ${{ env.REGISTRY }}
        username: ${{ github.actor }}
        password: ${{ secrets.GITHUB_TOKEN }}

    - name: Tag Docker image as latest
      run: |
        # Pull the existing versioned image and retag as latest
        docker pull ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ github.event.inputs.tag_version }}
        docker tag ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ github.event.inputs.tag_version }} ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:latest
        docker push ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:latest

    - name: Find workflow run for tag
      id: find-run
      run: |
        # Find the workflow run that created this tag
        TAG_COMMIT=$(git rev-list -n 1 ${{ github.event.inputs.tag_version }})
        echo "Tag commit: $TAG_COMMIT"
        
        # Get the workflow run ID that built this commit
        RUN_ID=$(curl -s -H "Authorization: Bearer ${{ secrets.GITHUB_TOKEN }}" \
          "https://api.github.com/repos/${{ github.repository }}/actions/runs?head_sha=$TAG_COMMIT&status=completed" \
          | jq -r '.workflow_runs[] | select(.name == "Build and Release") | .id' | head -1)
        
        if [ "$RUN_ID" = "null" ] || [ -z "$RUN_ID" ]; then
          echo "❌ Could not find workflow run for tag ${{ github.event.inputs.tag_version }}"
          exit 1
        fi
        
        echo "Found workflow run: $RUN_ID"
        echo "run-id=$RUN_ID" >> $GITHUB_OUTPUT

    - name: Download build artifacts
      uses: actions/download-artifact@v4
      with:
        pattern: binaries-*-${{ github.event.inputs.tag_version }}
        path: dist/
        merge-multiple: true
        github-token: ${{ secrets.GITHUB_TOKEN }}
        repository: ${{ github.repository }}
        run-id: ${{ steps.find-run.outputs.run-id }}

    - name: Download macOS installer artifact
      if: needs.macos-release-sign-notarize.outputs.release-ready == 'true'
      uses: actions/download-artifact@v4
      with:
        name: thand-macos-privilege-services-pkg
        path: dist/

    - name: Generate changelog
      id: changelog
      run: |
        # Get the previous tag for changelog generation
        PREVIOUS_TAG=$(git describe --tags --abbrev=0 ${{ github.event.inputs.tag_version }}^)
        echo "Generating changelog from $PREVIOUS_TAG to ${{ github.event.inputs.tag_version }}"
        
        # Generate changelog
        CHANGELOG=$(git log --pretty=format:"- %s (%h)" $PREVIOUS_TAG..${{ github.event.inputs.tag_version }})
        
        # Save changelog to output
        echo "changelog<<EOF" >> $GITHUB_OUTPUT
        echo "$CHANGELOG" >> $GITHUB_OUTPUT
        echo "EOF" >> $GITHUB_OUTPUT

    - name: Create GitHub Release
      uses: softprops/action-gh-release@v1
      with:
        tag_name: ${{ github.event.inputs.tag_version }}
        name: Release ${{ github.event.inputs.tag_version }}
        body: |
          ## What's Changed
          
          ${{ steps.changelog.outputs.changelog }}
          
          ## Docker Images
          
          ```bash
          docker pull ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ github.event.inputs.tag_version }}
          docker pull ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:latest
          ```
          
          ## Installation
          
          ### Homebrew
          ```bash
          brew tap thand-io/tap
          brew install thand
          ```
          
        files: |
          dist/*
        draft: false
        prerelease: false

  homebrew:
    needs: release
    runs-on: ubuntu-latest
    steps:
    - name: Trigger Homebrew Tap Update
      uses: peter-evans/repository-dispatch@v3
      with:
        token: ${{ secrets.HOMEBREW_TAP_TOKEN }}
        repository: thand-io/homebrew-tap
        event-type: update-formula
        client-payload: |
          {
            "version": "${{ github.event.inputs.tag_version }}",
            "repository": "${{ github.repository }}",
            "release_url": "https://github.com/${{ github.repository }}/releases/tag/${{ github.event.inputs.tag_version }}"
          }