release.yml

name: Release

on:
  push:
    tags:
      - "v*.*.*"
  workflow_dispatch:
    inputs:
      version:
        description: "Release version, without the leading v"
        required: true
        type: string
      prerelease:
        description: "Mark the GitHub release as a prerelease"
        required: false
        default: false
        type: boolean

permissions:
  contents: write

env:
  SCHEME: TaskMenu
  CONFIGURATION: Release
  ARCHIVE_PATH: ${{ github.workspace }}/build/TaskMenu.xcarchive
  ARTIFACTS_PATH: ${{ github.workspace }}/build/artifacts

jobs:
  release:
    name: Build signed DMG and publish release
    runs-on: macos-26
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Resolve release version
        id: release
        shell: bash
        run: |
          set -euo pipefail

          if [[ "${GITHUB_EVENT_NAME}" == "workflow_dispatch" ]]; then
            version="${{ inputs.version }}"
            tag_name="v${version}"
            prerelease="${{ inputs.prerelease }}"
          else
            tag_name="${GITHUB_REF_NAME}"
            version="${tag_name#v}"
            prerelease="false"
          fi

          if [[ ! "$version" =~ ^[0-9]+[.][0-9]+[.][0-9]+$ ]]; then
            echo "Version must use x.y.z format: $version" >&2
            exit 64
          fi

          echo "version=$version" >> "$GITHUB_OUTPUT"
          echo "tag_name=$tag_name" >> "$GITHUB_OUTPUT"
          echo "prerelease=$prerelease" >> "$GITHUB_OUTPUT"

      - name: Create release config
        shell: bash
        env:
          GOOGLE_CLIENT_ID: ${{ secrets.GOOGLE_CLIENT_ID }}
          GOOGLE_REDIRECT_SCHEME: ${{ vars.GOOGLE_REDIRECT_SCHEME || secrets.GOOGLE_REDIRECT_SCHEME }}
          APPLE_TEAM_ID: ${{ vars.APPLE_TEAM_ID || secrets.APPLE_TEAM_ID }}
        run: |
          set -euo pipefail

          for name in GOOGLE_CLIENT_ID GOOGLE_REDIRECT_SCHEME APPLE_TEAM_ID; do
            if [[ -z "${!name:-}" ]]; then
              echo "Missing required release value: $name" >&2
              exit 65
            fi
          done

          {
            printf 'GOOGLE_CLIENT_ID = %s\n' "$GOOGLE_CLIENT_ID"
            printf 'GOOGLE_REDIRECT_SCHEME = %s\n' "$GOOGLE_REDIRECT_SCHEME"
            printf 'DEVELOPMENT_TEAM = %s\n' "$APPLE_TEAM_ID"
          } > Config.xcconfig

      - name: Install signing certificate
        shell: bash
        env:
          BUILD_CERTIFICATE_BASE64: ${{ secrets.BUILD_CERTIFICATE_BASE64 }}
          BUILD_CERTIFICATE_PASSWORD: ${{ secrets.BUILD_CERTIFICATE_PASSWORD }}
        run: |
          set -euo pipefail

          for name in BUILD_CERTIFICATE_BASE64 BUILD_CERTIFICATE_PASSWORD; do
            if [[ -z "${!name:-}" ]]; then
              echo "Missing required secret: $name" >&2
              exit 65
            fi
          done

          certificate_path="$RUNNER_TEMP/developer-id-application.p12"
          keychain_path="$RUNNER_TEMP/app-signing.keychain-db"
          keychain_password="$(openssl rand -base64 32)"

          if ! printf '%s' "$BUILD_CERTIFICATE_BASE64" | base64 --decode > "$certificate_path" 2>/dev/null; then
            printf '%s' "$BUILD_CERTIFICATE_BASE64" | base64 -D > "$certificate_path"
          fi
          security create-keychain -p "$keychain_password" "$keychain_path"
          security set-keychain-settings -lut 21600 "$keychain_path"
          security unlock-keychain -p "$keychain_password" "$keychain_path"
          security import "$certificate_path" -P "$BUILD_CERTIFICATE_PASSWORD" -A -t cert -f pkcs12 -k "$keychain_path"
          security default-keychain -s "$keychain_path"
          security list-keychain -d user -s "$keychain_path"
          security set-key-partition-list -S apple-tool:,apple:,codesign: -s -k "$keychain_password" "$keychain_path"
          security find-identity -v -p codesigning "$keychain_path"

      - name: Install App Store Connect API key
        shell: bash
        env:
          APP_STORE_CONNECT_API_KEY_BASE64: ${{ secrets.APP_STORE_CONNECT_API_KEY_BASE64 }}
          APP_STORE_CONNECT_KEY_ID: ${{ secrets.APP_STORE_CONNECT_KEY_ID }}
          APP_STORE_CONNECT_ISSUER_ID: ${{ secrets.APP_STORE_CONNECT_ISSUER_ID }}
        run: |
          set -euo pipefail

          for name in APP_STORE_CONNECT_API_KEY_BASE64 APP_STORE_CONNECT_KEY_ID APP_STORE_CONNECT_ISSUER_ID; do
            if [[ -z "${!name:-}" ]]; then
              echo "Missing required release value: $name" >&2
              exit 65
            fi
          done

          issuer_trimmed="$(printf '%s' "$APP_STORE_CONNECT_ISSUER_ID" | tr -d '[:space:]')"
          key_id_trimmed="$(printf '%s' "$APP_STORE_CONNECT_KEY_ID" | tr -d '[:space:]')"
          echo "Key ID length after trimming whitespace: ${#key_id_trimmed}"
          if [[ "$key_id_trimmed" =~ ^[0-9A-Za-z]+$ ]]; then
            echo "Key ID format: alphanumeric"
          else
            echo "Key ID format: invalid" >&2
            exit 64
          fi

          echo "Issuer ID length after trimming whitespace: ${#issuer_trimmed}"
          if [[ "$issuer_trimmed" =~ ^[0-9A-Fa-f]{8}-[0-9A-Fa-f]{4}-[0-9A-Fa-f]{4}-[0-9A-Fa-f]{4}-[0-9A-Fa-f]{12}$ ]]; then
            echo "Issuer ID format: valid UUID"
          else
            echo "Issuer ID format: invalid UUID" >&2
            exit 64
          fi

          key_path="$RUNNER_TEMP/AuthKey_${key_id_trimmed}.p8"
          if ! printf '%s' "$APP_STORE_CONNECT_API_KEY_BASE64" | base64 --decode > "$key_path" 2>/dev/null; then
            printf '%s' "$APP_STORE_CONNECT_API_KEY_BASE64" | base64 -D > "$key_path"
          fi
          chmod 600 "$key_path"

          echo "Decoded API key bytes: $(wc -c < "$key_path" | tr -d '[:space:]')"
          echo "Decoded API key lines: $(wc -l < "$key_path" | tr -d '[:space:]')"
          echo "Decoded API key SHA-256: $(shasum -a 256 "$key_path" | awk '{print $1}')"
          if grep -q -- "-----BEGIN PRIVATE KEY-----" "$key_path" && grep -q -- "-----END PRIVATE KEY-----" "$key_path"; then
            echo "Decoded API key PEM envelope: present"
          else
            echo "Decoded API key PEM envelope: missing" >&2
            exit 65
          fi
          openssl pkey -in "$key_path" -noout >/dev/null

          xcrun notarytool history \
            --key "$key_path" \
            --key-id "$key_id_trimmed" \
            --issuer "$issuer_trimmed" \
            --output-format json >/dev/null

          echo "APP_STORE_CONNECT_KEY_ID=$key_id_trimmed" >> "$GITHUB_ENV"
          echo "APP_STORE_CONNECT_ISSUER_ID=$issuer_trimmed" >> "$GITHUB_ENV"
          echo "APP_STORE_CONNECT_KEY_PATH=$key_path" >> "$GITHUB_ENV"

      - name: Install XcodeGen
        run: brew install xcodegen

      - name: Generate Xcode project
        run: xcodegen generate

      - name: Validate project version
        shell: bash
        run: |
          set -euo pipefail

          expected_version="${{ steps.release.outputs.version }}"
          actual_version="$(
            xcodebuild -project TaskMenu.xcodeproj \
              -scheme "$SCHEME" \
              -configuration "$CONFIGURATION" \
              -showBuildSettings |
              awk -F'= ' '/ MARKETING_VERSION = / { print $2; exit }'
          )"

          if [[ "$actual_version" != "$expected_version" ]]; then
            echo "Tag version v${expected_version} does not match MARKETING_VERSION ${actual_version}." >&2
            echo "Update project.yml before tagging the release." >&2
            exit 65
          fi

      - name: Extract release notes
        shell: bash
        run: |
          set -euo pipefail

          ./scripts/extract_changelog.sh "${{ steps.release.outputs.version }}" > "$RUNNER_TEMP/release-notes.md"
          if [[ ! -s "$RUNNER_TEMP/release-notes.md" ]]; then
            echo "Release notes are empty for ${{ steps.release.outputs.version }}." >&2
            exit 65
          fi

      - name: Archive
        shell: bash
        env:
          APPLE_TEAM_ID: ${{ vars.APPLE_TEAM_ID || secrets.APPLE_TEAM_ID }}
        run: |
          set -euo pipefail

          xcodebuild archive \
            -project TaskMenu.xcodeproj \
            -scheme "$SCHEME" \
            -configuration "$CONFIGURATION" \
            -destination "generic/platform=macOS" \
            -archivePath "$ARCHIVE_PATH" \
            CODE_SIGN_STYLE=Manual \
            CODE_SIGN_IDENTITY="Developer ID Application" \
            DEVELOPMENT_TEAM="$APPLE_TEAM_ID" \
            OTHER_CODE_SIGN_FLAGS="--timestamp"

      - name: Build, sign, and notarize DMG
        shell: bash
        env:
          SIGNING_IDENTITY: Developer ID Application
        run: |
          set -euo pipefail

          for name in APP_STORE_CONNECT_KEY_ID APP_STORE_CONNECT_ISSUER_ID APP_STORE_CONNECT_KEY_PATH; do
            if [[ -z "${!name:-}" ]]; then
              echo "Missing required secret: $name" >&2
              exit 65
            fi
          done

          app_path="$ARCHIVE_PATH/Products/Applications/TaskMenu.app"
          ./scripts/make_dmg.sh \
            --app "$app_path" \
            --version "${{ steps.release.outputs.version }}" \
            --output-dir "$ARTIFACTS_PATH"

      - name: Publish GitHub release
        shell: bash
        env:
          GH_TOKEN: ${{ github.token }}
          TAG_NAME: ${{ steps.release.outputs.tag_name }}
          VERSION: ${{ steps.release.outputs.version }}
          PRERELEASE: ${{ steps.release.outputs.prerelease }}
        run: |
          set -euo pipefail

          if gh release view "$TAG_NAME" >/dev/null 2>&1; then
            gh release upload "$TAG_NAME" "$ARTIFACTS_PATH"/* --clobber
            if [[ "$PRERELEASE" == "true" ]]; then
              gh release edit "$TAG_NAME" \
                --title "TaskMenu ${VERSION}" \
                --notes-file "$RUNNER_TEMP/release-notes.md" \
                --prerelease
            else
              gh release edit "$TAG_NAME" \
                --title "TaskMenu ${VERSION}" \
                --notes-file "$RUNNER_TEMP/release-notes.md"
            fi
          else
            if [[ "$PRERELEASE" == "true" ]]; then
              gh release create "$TAG_NAME" "$ARTIFACTS_PATH"/* \
                --title "TaskMenu ${VERSION}" \
                --notes-file "$RUNNER_TEMP/release-notes.md" \
                --prerelease
            else
              gh release create "$TAG_NAME" "$ARTIFACTS_PATH"/* \
                --title "TaskMenu ${VERSION}" \
                --notes-file "$RUNNER_TEMP/release-notes.md"
            fi
          fi