auto-release.yml

name: Auto Release

on:
  push:
    branches:
      - main
  workflow_dispatch:
    inputs:
      tag_name:
        description: 'Existing tag to build and release (e.g. v1.0.2)'
        required: true

permissions:
  contents: write
  pull-requests: write

jobs:
  release-please:
    runs-on: ubuntu-latest
    if: ${{ github.event_name == 'push' }}
    outputs:
      release_created: ${{ steps.release.outputs.release_created }}
      tag_name: ${{ steps.release.outputs.tag_name }}
      major: ${{ steps.release.outputs.major }}
      minor: ${{ steps.release.outputs.minor }}
      patch: ${{ steps.release.outputs.patch }}
    steps:
      - uses: google-github-actions/release-please-action@v4
        id: release
        with:
          token: ${{ secrets.GITHUB_TOKEN }}
          release-type: simple

  build-release:
    needs: release-please
    if: ${{ always() && (needs.release-please.outputs.release_created || github.event_name == 'workflow_dispatch') }}
    runs-on: macos-14

    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Resolve tag name
        id: tag
        run: |
          if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
            echo "tag_name=${{ github.event.inputs.tag_name }}" >> $GITHUB_OUTPUT
          else
            echo "tag_name=${{ needs.release-please.outputs.tag_name }}" >> $GITHUB_OUTPUT
          fi

      - name: Set Version in Info.plist
        run: |
          TAG="${{ steps.tag.outputs.tag_name }}"
          VERSION="${TAG#v}"
          /usr/libexec/PlistBuddy -c "Set :CFBundleShortVersionString $VERSION" RedMagicRoom/Info.plist
          /usr/libexec/PlistBuddy -c "Set :CFBundleVersion $VERSION" RedMagicRoom/Info.plist
          echo "Updated Info.plist to version $VERSION"

      - name: Setup Swift
        uses: swift-actions/setup-swift@v2
        with:
          swift-version: "5.9"

      - name: Install the Apple certificate
        env:
          BUILD_CERTIFICATE_BASE64: ${{ secrets.BUILD_CERTIFICATE_BASE64 }}
          P12_PASSWORD: ${{ secrets.P12_PASSWORD }}
        run: |
          CERTIFICATE_PATH=$RUNNER_TEMP/build_certificate.p12
          KEYCHAIN_PATH=$RUNNER_TEMP/app-signing.keychain-db

          # Write secret to file using printenv to avoid shell interpretation issues
          printenv BUILD_CERTIFICATE_BASE64 > "$RUNNER_TEMP/cert_b64.txt"

          # Validate the secret was loaded
          CERT_SIZE=$(wc -c < "$RUNNER_TEMP/cert_b64.txt")
          echo "Certificate base64 size: ${CERT_SIZE} bytes"
          if [ "$CERT_SIZE" -lt 100 ]; then
            echo "::error::BUILD_CERTIFICATE_BASE64 secret appears too small (${CERT_SIZE} bytes). Please re-set the secret."
            exit 1
          fi

          # Decode certificate from file (avoids pipe/echo issues)
          base64 -d -i "$RUNNER_TEMP/cert_b64.txt" -o "$CERTIFICATE_PATH"

          # Verify decoded file
          P12_SIZE=$(wc -c < "$CERTIFICATE_PATH")
          echo "Decoded certificate size: ${P12_SIZE} bytes"
          if [ "$P12_SIZE" -lt 100 ]; then
            echo "::error::Decoded certificate is too small (${P12_SIZE} bytes). The secret may not be properly base64-encoded."
            exit 1
          fi

          # Clean up base64 temp file
          rm -f "$RUNNER_TEMP/cert_b64.txt"

          # Create temporary keychain
          security create-keychain -p "" "$KEYCHAIN_PATH"
          security set-keychain-settings -lut 21600 "$KEYCHAIN_PATH"
          security unlock-keychain -p "" "$KEYCHAIN_PATH"

          # Import certificate to keychain
          security import "$CERTIFICATE_PATH" -P "$P12_PASSWORD" -A -t cert -f pkcs12 -k "$KEYCHAIN_PATH"
          security set-key-partition-list -S apple-tool:,apple: -s -k "" "$KEYCHAIN_PATH"
          security list-keychain -d user -s "$KEYCHAIN_PATH"

      - name: Build and Sign
        run: ./build.sh

      - name: Notarize app
        env:
          APPLE_API_KEY_ID: ${{ secrets.APPLE_API_KEY_ID }}
          APPLE_API_ISSUER_ID: ${{ secrets.APPLE_API_ISSUER_ID }}
          APPLE_API_PRIVATE_KEY: ${{ secrets.APPLE_API_PRIVATE_KEY }}
        run: |
          # Write API key to file
          API_KEY_PATH="$RUNNER_TEMP/AuthKey_${APPLE_API_KEY_ID}.p8"
          printenv APPLE_API_PRIVATE_KEY > "$API_KEY_PATH"

          # Submit for notarization and wait
          xcrun notarytool submit dist/RedMagicRoom.zip \
            --key "$API_KEY_PATH" \
            --key-id "$APPLE_API_KEY_ID" \
            --issuer "$APPLE_API_ISSUER_ID" \
            --wait

          # Staple the notarization ticket to the app
          xcrun stapler staple dist/RedMagicRoom.app

          # Re-zip with the stapled ticket
          cd dist
          rm -f RedMagicRoom.zip
          zip -r RedMagicRoom.zip RedMagicRoom.app
          cd ..

          # Clean up
          rm -f "$API_KEY_PATH"

      - name: Upload Release Asset
        uses: softprops/action-gh-release@v1
        with:
          tag_name: ${{ steps.tag.outputs.tag_name }}
          files: dist/RedMagicRoom.zip
          fail_on_unmatched_files: true

      - name: Generate GitHub App token
        id: app-token
        uses: actions/create-github-app-token@v2
        with:
          app-id: ${{ secrets.APP_ID }}
          private-key: ${{ secrets.APP_PRIVATE_KEY }}
          owner: warike
          repositories: homebrew-tools

      - name: Update Homebrew cask
        env:
          GH_TOKEN: ${{ steps.app-token.outputs.token }}
        run: |
          TAG="${{ steps.tag.outputs.tag_name }}"
          VERSION="${TAG#v}"
          SHA=$(shasum -a 256 dist/RedMagicRoom.zip | awk '{print $1}')

          echo "Updating Homebrew cask to version ${VERSION} (sha256: ${SHA})"

          git clone https://x-access-token:${GH_TOKEN}@github.com/warike/homebrew-tools.git /tmp/homebrew-tools
          cd /tmp/homebrew-tools

          sed -i '' "s/version \".*\"/version \"${VERSION}\"/" Casks/red-magic-room.rb
          sed -i '' "s/sha256 \".*\"/sha256 \"${SHA}\"/" Casks/red-magic-room.rb

          git config user.name "warike-release-bot[bot]"
          git config user.email "bot@users.noreply.github.com"

          git add Casks/red-magic-room.rb

          if git diff --staged --quiet; then
            echo "No changes to the cask file. Skipping."
          else
            git commit -m "chore: bump red-magic-room to ${VERSION}"
            git push
          fi