build.yaml

name: Build & Release

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

on:
  push:
  release:
    types:
      - created

jobs:
  build:
    name: Build macOS App
    runs-on: self-hosted
    permissions:
      contents: write
      packages: write
      actions: write
    steps:
      - name: Checkout repository
        uses: actions/checkout@v7

      - name: Setup Xcode
        uses: maxim-lobanov/setup-xcode@v1
        with:
          xcode-version: latest-stable

      - name: Install create-dmg
        run: npm install --global create-dmg

      - name: Set up Python
        uses: actions/setup-python@v6
        with:
          python-version: "3.x"

      - name: Install Python dependencies
        run: pip install markdown

      - name: Import code signing certificate
        uses: apple-actions/import-codesign-certs@v7
        with:
          p12-file-base64: ${{ secrets.BUILD_CERTIFICATE_BASE64 }}
          p12-password: ${{ secrets.P12_PASSWORD }}

      - name: Install provisioning profile
        env:
          MACOS_PROVISIONING_PROFILE_BASE64: ${{ secrets.MACOS_PROVISIONING_PROFILE_BASE64 }}
        run: |
          if [ -z "$MACOS_PROVISIONING_PROFILE_BASE64" ]; then
            echo "::error::MACOS_PROVISIONING_PROFILE_BASE64 is required."
            exit 1
          fi

          PROFILE_PATH="$RUNNER_TEMP/RxCode.provisionprofile"
          PROFILE_PLIST="$RUNNER_TEMP/RxCode-profile.plist"
          PROFILE_DIR="$HOME/Library/MobileDevice/Provisioning Profiles"

          mkdir -p "$PROFILE_DIR"
          printf '%s' "$MACOS_PROVISIONING_PROFILE_BASE64" | base64 -D > "$PROFILE_PATH"
          openssl cms -inform DER -verify -noverify -in "$PROFILE_PATH" -out "$PROFILE_PLIST"

          PROFILE_UUID=$(/usr/libexec/PlistBuddy -c "Print UUID" "$PROFILE_PLIST")
          PROFILE_NAME=$(/usr/libexec/PlistBuddy -c "Print Name" "$PROFILE_PLIST")

          cp "$PROFILE_PATH" "$PROFILE_DIR/$PROFILE_UUID.provisionprofile"
          echo "MACOS_PROFILE_UUID=$PROFILE_UUID" >> "$GITHUB_ENV"
          echo "MACOS_PROFILE_SPECIFIER=$PROFILE_NAME" >> "$GITHUB_ENV"

      - name: Write Firebase config
        env:
          FIREBASE_MACOS_B64: ${{ secrets.FIREBASE_MACOS_B64 }}
        run: ./scripts/ci/write-firebase-config.sh

      - name: Bump version (release only)
        if: github.event_name == 'release'
        run: |
          # Strip leading 'v' from release tag (v1.2.3 -> 1.2.3) — Apple's
          # MARKETING_VERSION must be numeric.
          RELEASE_VERSION="${GITHUB_REF_NAME#v}"
          echo "RELEASE_VERSION=${RELEASE_VERSION}" >> "$GITHUB_ENV"
          ./scripts/ci/update-version.sh "${RELEASE_VERSION}"

      - name: Build archive
        run: |
          gem install xcpretty
          # CURRENT_PROJECT_VERSION is overridden per-build so every CI build
          # has a unique build number (github.run_number), without committing
          # churn to project.pbxproj.
          # The provisioning profile is scoped to the RxCode target's Release
          # build settings in project.pbxproj (PROVISIONING_PROFILE_SPECIFIER),
          # NOT passed on the command line. A command-line PROVISIONING_PROFILE*
          # applies to every target in the graph — including SPM package targets
          # that don't support provisioning profiles — which fails the archive.
          # CODE_SIGN_STYLE/IDENTITY stay global: Manual signing needs no team
          # and library targets sign with the identity but need no profile.
          set -o pipefail
          xcodebuild -destination platform=macOS \
            -project RxCode.xcodeproj \
            -scheme RxCode \
            -configuration Release \
            -archivePath output/output.xcarchive \
            -allowProvisioningUpdates \
            CODE_SIGN_IDENTITY="${{ secrets.SIGNING_CERTIFICATE_NAME }}" \
            CODE_SIGN_STYLE=Manual \
            OTHER_CODE_SIGN_FLAGS="--options=runtime --timestamp" \
            CURRENT_PROJECT_VERSION=${{ github.run_number }} \
            archive 2>&1 | tee xcodebuild-archive.log | xcpretty || {
              status=${PIPESTATUS[0]}
              echo "::group::Full xcodebuild output (archive failed)"
              cat xcodebuild-archive.log
              echo "::endgroup::"
              exit "$status"
            }

      - name: Sign Sparkle
        run: ./scripts/ci/sign-sparkle.sh
        env:
          SIGNING_CERTIFICATE_NAME: ${{ secrets.SIGNING_CERTIFICATE_NAME }}

      - name: Notarize
        run: ./scripts/ci/notary.sh
        env:
          APPLE_ID: ${{ secrets.APPLE_ID }}
          APPLE_ID_PWD: ${{ secrets.APPLE_ID_PWD }}
          APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}

      - name: Generate appcast
        run: ./scripts/ci/generate-appcast.sh
        env:
          SPARKLE_KEY: ${{ secrets.SPARKLE_KEY }}
          VERSION: ${{ github.ref_name }}
          BUILD_NUMBER: ${{ github.run_number }}
          RELEASE_NOTE: ${{ github.event.release.body }}

      # Upload artifact for Pull Requests (1 day retention)
      - name: Upload artifact for PR
        if: github.event_name == 'pull_request'
        uses: actions/upload-artifact@v7
        with:
          name: RxCode-PR-${{ github.event.pull_request.number }}
          path: RxCode.dmg
          retention-days: 1

      # Upload to release for release events
      - name: Upload DMG to Release
        if: github.event_name == 'release'
        uses: softprops/action-gh-release@v3
        with:
          files: RxCode.dmg
          token: ${{ secrets.GITHUB_TOKEN }}

      # Upload appcast as an artifact for the deploy job
      - name: Upload appcast for deploy job
        if: github.event_name == 'release'
        uses: actions/upload-artifact@v7
        with:
          name: appcast-${{ github.sha }}
          path: appcast.xml
          retention-days: 1

      - name: Upload release notes for deploy job
        if: github.event_name == 'release'
        uses: actions/upload-artifact@v7
        with:
          name: release_notes-${{ github.sha }}
          path: release_notes.html
          retention-days: 1

  deploy:
    name: Deploy to GitHub Pages
    needs: build
    if: github.event_name == 'release'
    runs-on: ubuntu-latest
    permissions:
      pages: write
      id-token: write
    environment:
      name: github-pages
      url: ${{ steps.deployment.outputs.page_url }}
    steps:
      - name: Download appcast from build job
        uses: actions/download-artifact@v8
        with:
          name: appcast-${{ github.sha }}

      - name: Download release notes from build job
        uses: actions/download-artifact@v8
        with:
          name: release_notes-${{ github.sha }}

      - name: Prepare pages directory
        run: |
          mkdir -p pages
          cp appcast.xml pages/
          cp release_notes.html pages/
          # Pin custom domain — without this, deploy-pages strips the CNAME
          # GitHub wrote when the domain was set in Settings → Pages.
          echo "update.code.rxlab.app" > pages/CNAME

      - name: Setup Pages
        uses: actions/configure-pages@v6

      - name: Upload pages artifact
        uses: actions/upload-pages-artifact@v5
        with:
          path: "pages"

      - name: Deploy to GitHub Pages
        id: deployment
        uses: actions/deploy-pages@v5