release.yml

name: Release

on:
  push:
    tags:
      - 'v*.*.*'
  workflow_dispatch:
    inputs:
      tag:
        description: 'Tag to release (must already exist, e.g. v1.0.0)'
        required: true

permissions:
  contents: write

env:
  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true

jobs:
  build:
    name: Build, sign, notarize, release
    runs-on: macos-15
    timeout-minutes: 60
    env:
      SCHEME: AiDevtools
      PROJECT: AiDevtools/AiDevtools.xcodeproj
      CONFIGURATION: Release
      ARCHIVE_PATH: build/AiDevtools.xcarchive
      EXPORT_PATH: build/export
      EXPORT_OPTIONS: build-config/ExportOptions.plist
      APP_NAME: AiDevtools
      DMG_NAME: AiDevtools.dmg

    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Resolve tag
        id: tag
        env:
          EVENT_NAME: ${{ github.event_name }}
          INPUT_TAG: ${{ github.event.inputs.tag }}
          REF_NAME: ${{ github.ref_name }}
        run: |
          set -euo pipefail
          if [[ "$EVENT_NAME" == "workflow_dispatch" ]]; then
            TAG="$INPUT_TAG"
          else
            TAG="$REF_NAME"
          fi
          if [[ ! "$TAG" =~ ^v[0-9]+\.[0-9]+\.[0-9]+(-[A-Za-z0-9.]+)?$ ]]; then
            echo "Invalid tag format: $TAG" >&2
            exit 1
          fi
          VERSION="${TAG#v}"
          echo "tag=$TAG" >> "$GITHUB_OUTPUT"
          echo "version=$VERSION" >> "$GITHUB_OUTPUT"

      - name: Select Xcode
        run: sudo xcode-select -s /Applications/Xcode_16.4.app || sudo xcode-select -s /Applications/Xcode.app

      - name: Set MARKETING_VERSION + CURRENT_PROJECT_VERSION
        env:
          VERSION: ${{ steps.tag.outputs.version }}
          BUILD_NUMBER: ${{ github.run_number }}
        run: |
          set -euo pipefail
          /usr/bin/sed -i '' -E "s/MARKETING_VERSION = [^;]+;/MARKETING_VERSION = ${VERSION};/g" "${PROJECT}/project.pbxproj"
          /usr/bin/sed -i '' -E "s/CURRENT_PROJECT_VERSION = [^;]+;/CURRENT_PROJECT_VERSION = ${BUILD_NUMBER};/g" "${PROJECT}/project.pbxproj"
          grep -E "MARKETING_VERSION|CURRENT_PROJECT_VERSION" "${PROJECT}/project.pbxproj" | head -4

      - name: Import signing certificate
        env:
          BUILD_CERTIFICATE_BASE64: ${{ secrets.BUILD_CERTIFICATE_BASE64 }}
          P12_PASSWORD: ${{ secrets.P12_PASSWORD }}
          KEYCHAIN_PASSWORD: ${{ secrets.KEYCHAIN_PASSWORD }}
        run: |
          set -euo pipefail
          CERT_PATH="$RUNNER_TEMP/cert.p12"
          KEYCHAIN_PATH="$RUNNER_TEMP/build.keychain-db"
          echo -n "$BUILD_CERTIFICATE_BASE64" | base64 --decode -o "$CERT_PATH"
          security create-keychain -p "$KEYCHAIN_PASSWORD" "$KEYCHAIN_PATH"
          security set-keychain-settings -lut 21600 "$KEYCHAIN_PATH"
          security unlock-keychain -p "$KEYCHAIN_PASSWORD" "$KEYCHAIN_PATH"
          security import "$CERT_PATH" -P "$P12_PASSWORD" -A -t cert -f pkcs12 -k "$KEYCHAIN_PATH"
          security set-key-partition-list -S apple-tool:,apple:,codesign: -s -k "$KEYCHAIN_PASSWORD" "$KEYCHAIN_PATH" >/dev/null
          security list-keychain -d user -s "$KEYCHAIN_PATH" $(security list-keychains -d user | tr -d '"')
          security find-identity -v -p codesigning "$KEYCHAIN_PATH"

      - name: Archive
        run: |
          set -euo pipefail
          xcodebuild \
            -project "$PROJECT" \
            -scheme "$SCHEME" \
            -configuration "$CONFIGURATION" \
            -destination 'generic/platform=macOS' \
            -archivePath "$ARCHIVE_PATH" \
            CODE_SIGN_STYLE=Manual \
            CODE_SIGN_IDENTITY="Developer ID Application" \
            DEVELOPMENT_TEAM=L23PD654Q3 \
            ENABLE_HARDENED_RUNTIME=YES \
            OTHER_CODE_SIGN_FLAGS="--timestamp --options=runtime" \
            archive
          test -d "$ARCHIVE_PATH"

      - name: Export Developer ID build
        run: |
          set -euo pipefail
          xcodebuild \
            -exportArchive \
            -archivePath "$ARCHIVE_PATH" \
            -exportPath "$EXPORT_PATH" \
            -exportOptionsPlist "$EXPORT_OPTIONS"
          ls -la "$EXPORT_PATH"

      - name: Verify signing
        run: |
          set -euo pipefail
          APP_PATH="${EXPORT_PATH}/${APP_NAME}.app"
          echo "--- codesign -dv ---"
          codesign -dv --verbose=4 "$APP_PATH" 2>&1 | tee /tmp/codesign-dv.txt
          echo "--- hardened runtime / timestamp checks ---"
          grep -E "flags=.*runtime" /tmp/codesign-dv.txt || { echo "ERROR: hardened runtime not enabled"; exit 1; }
          grep -E "Timestamp=" /tmp/codesign-dv.txt || { echo "ERROR: secure timestamp missing"; exit 1; }
          echo "--- entitlements ---"
          codesign -d --entitlements :- "$APP_PATH" || true
          echo "--- deep verify ---"
          codesign --verify --deep --strict --verbose=2 "$APP_PATH"
          echo "--- gatekeeper assess (informational, may fail pre-notarize) ---"
          spctl -a -t exec -vv "$APP_PATH" || true

      - name: Create DMG
        run: |
          set -euo pipefail
          brew install create-dmg
          mkdir -p build/dmg
          create-dmg \
            --volname "$APP_NAME" \
            --window-pos 200 120 \
            --window-size 640 400 \
            --icon-size 100 \
            --icon "${APP_NAME}.app" 180 180 \
            --hide-extension "${APP_NAME}.app" \
            --app-drop-link 460 180 \
            --no-internet-enable \
            "build/dmg/${DMG_NAME}" \
            "${EXPORT_PATH}/${APP_NAME}.app"
          ls -la build/dmg

      - name: Notarize DMG
        id: notarize
        env:
          NOTARY_APPLE_ID: ${{ secrets.NOTARY_APPLE_ID }}
          NOTARY_TEAM_ID: ${{ secrets.NOTARY_TEAM_ID }}
          NOTARY_PASSWORD: ${{ secrets.NOTARY_PASSWORD }}
        run: |
          set -euo pipefail
          SUBMIT_OUTPUT=$(xcrun notarytool submit "build/dmg/${DMG_NAME}" \
            --apple-id "$NOTARY_APPLE_ID" \
            --team-id "$NOTARY_TEAM_ID" \
            --password "$NOTARY_PASSWORD" \
            --output-format json \
            --wait)
          echo "$SUBMIT_OUTPUT"
          SUBMISSION_ID=$(echo "$SUBMIT_OUTPUT" | jq -r '.id')
          STATUS=$(echo "$SUBMIT_OUTPUT" | jq -r '.status')
          echo "submission_id=$SUBMISSION_ID" >> "$GITHUB_OUTPUT"
          if [[ "$STATUS" != "Accepted" ]]; then
            echo "Notarization status: $STATUS"
            xcrun notarytool log "$SUBMISSION_ID" \
              --apple-id "$NOTARY_APPLE_ID" \
              --team-id "$NOTARY_TEAM_ID" \
              --password "$NOTARY_PASSWORD"
            exit 1
          fi
          xcrun stapler staple "build/dmg/${DMG_NAME}"
          xcrun stapler validate "build/dmg/${DMG_NAME}"

      - name: Fetch notary log on failure
        if: failure() && steps.notarize.outputs.submission_id != ''
        env:
          NOTARY_APPLE_ID: ${{ secrets.NOTARY_APPLE_ID }}
          NOTARY_TEAM_ID: ${{ secrets.NOTARY_TEAM_ID }}
          NOTARY_PASSWORD: ${{ secrets.NOTARY_PASSWORD }}
          SUBMISSION_ID: ${{ steps.notarize.outputs.submission_id }}
        run: |
          set -euo pipefail
          xcrun notarytool log "$SUBMISSION_ID" \
            --apple-id "$NOTARY_APPLE_ID" \
            --team-id "$NOTARY_TEAM_ID" \
            --password "$NOTARY_PASSWORD"

      - name: Generate changelog
        env:
          TAG: ${{ steps.tag.outputs.tag }}
        run: |
          set -euo pipefail
          PREV_TAG=$(git tag --sort=-creatordate | grep -v -F -x "$TAG" | head -1 || true)
          {
            printf '## %s\n\n' "$TAG"
            if [[ -n "$PREV_TAG" ]]; then
              printf 'Changes since `%s`:\n\n' "$PREV_TAG"
              git log --pretty=format:"- %s (%h)" "${PREV_TAG}..${TAG}"
            else
              printf 'Initial release.\n\n'
              git log --pretty=format:"- %s (%h)" "$TAG"
            fi
            printf '\n\n### Install\n\n'
            printf '1. Download `%s` below.\n' "$DMG_NAME"
            printf '2. Open the DMG and drag **%s.app** to **Applications**.\n' "$APP_NAME"
            printf '3. First launch may take a few seconds for Gatekeeper verification.\n'
          } > build/CHANGELOG.md
          cat build/CHANGELOG.md

      - name: Upload artifact
        uses: actions/upload-artifact@v4
        with:
          name: AiDevtools-${{ steps.tag.outputs.version }}
          path: |
            build/dmg/${{ env.DMG_NAME }}
            build/CHANGELOG.md
          retention-days: 30

      - name: Create GitHub Release
        uses: softprops/action-gh-release@v2
        with:
          tag_name: ${{ steps.tag.outputs.tag }}
          name: ${{ steps.tag.outputs.tag }}
          body_path: build/CHANGELOG.md
          draft: false
          prerelease: ${{ contains(steps.tag.outputs.tag, '-') }}
          files: |
            build/dmg/${{ env.DMG_NAME }}

      - name: Cleanup keychain
        if: always()
        run: |
          security delete-keychain "$RUNNER_TEMP/build.keychain-db" || true