build-app.yml

name: Build standalone app

on:
  push:
    tags: ['v*']
  workflow_dispatch:

jobs:
  build:
    name: Build on ${{ matrix.os }}
    runs-on: ${{ matrix.os }}
    strategy:
      fail-fast: false
      matrix:
        include:
          - os: macos-14
            artifact: Raytracing-macOS-arm64
          - os: windows-latest
            artifact: Raytracing-Windows
          - os: ubuntu-22.04
            artifact: Raytracing-Linux

    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0  # setuptools_scm needs full history + tags

      - uses: actions/setup-python@v5
        with:
          # 3.12 (not 3.11) — mytk warns about a UI quirk in the Tk
          # bindings shipped with python.org's 3.11 build on macOS
          # Sonoma. 3.12 ships a Tk that doesn't trip it.
          python-version: '3.12'

      - name: Install Tk (Linux only)
        if: runner.os == 'Linux'
        run: sudo apt-get update && sudo apt-get install -y python3-tk

      - name: Install dependencies
        run: |
          python -m pip install --upgrade pip
          pip install -e ".[gui]"
          pip install pyperclip pillow pyinstaller

      - name: Build with PyInstaller
        # --collect-submodules PIL: mytk loads PIL.ImageDraw / PIL.ImageTk
        # via importlib.import_module(), which PyInstaller's static analyzer
        # cannot follow. Without this flag the bundled app prompts the user
        # to "install the missing module 'ImageDraw'" on first launch.
        run: pyinstaller --windowed --name Raytracing --noconfirm
             --collect-submodules PIL
             --distpath packaging/dist --workpath packaging/build
             raytracing/ui/raytracing_app.py

      - name: Sign and notarize (macOS)
        if: runner.os == 'macOS'
        env:
          CERTIFICATE: ${{ secrets.MACOS_CERTIFICATE }}
          CERTIFICATE_PWD: ${{ secrets.MACOS_CERTIFICATE_PWD }}
          IDENTITY: ${{ secrets.MACOS_SIGNING_IDENTITY }}
          APPLE_ID: ${{ secrets.MACOS_NOTARY_APPLE_ID }}
          TEAM_ID: ${{ secrets.MACOS_NOTARY_TEAMID }}
          APP_PWD: ${{ secrets.MACOS_NOTARY_PWD }}
        run: |
          # Import certificate into a temporary keychain
          KEYCHAIN=build.keychain
          KEYCHAIN_PWD=$(uuidgen)
          security create-keychain -p "$KEYCHAIN_PWD" "$KEYCHAIN"
          security default-keychain -s "$KEYCHAIN"
          security unlock-keychain -p "$KEYCHAIN_PWD" "$KEYCHAIN"
          echo "$CERTIFICATE" | base64 --decode > cert.p12
          security import cert.p12 -k "$KEYCHAIN" -P "$CERTIFICATE_PWD" \
            -T /usr/bin/codesign
          security set-key-partition-list -S apple-tool:,apple: \
            -s -k "$KEYCHAIN_PWD" "$KEYCHAIN"
          rm cert.p12

          # Sign the .app bundle
          codesign --deep --force --options runtime --timestamp \
            --sign "$IDENTITY" packaging/dist/Raytracing.app

          # Notarize (Apple checks the binary, typically 1-5 min)
          ditto -c -k --keepParent packaging/dist/Raytracing.app \
            /tmp/Raytracing-notarize.zip
          xcrun notarytool submit /tmp/Raytracing-notarize.zip \
            --apple-id "$APPLE_ID" --team-id "$TEAM_ID" \
            --password "$APP_PWD" --wait

          # Staple the ticket so Gatekeeper works offline
          xcrun stapler staple packaging/dist/Raytracing.app

      - name: Package macOS .app as zip
        if: runner.os == 'macOS'
        working-directory: packaging/dist
        run: ditto -c -k --keepParent Raytracing.app Raytracing-macOS.zip

      - name: Package Windows folder as zip
        if: runner.os == 'Windows'
        working-directory: packaging/dist
        run: Compress-Archive -Path Raytracing -DestinationPath Raytracing-Windows.zip

      - name: Package Linux folder as tar.gz
        if: runner.os == 'Linux'
        working-directory: packaging/dist
        run: tar -czf Raytracing-Linux.tar.gz Raytracing

      - name: Upload artifact
        uses: actions/upload-artifact@v4
        with:
          name: ${{ matrix.artifact }}
          path: |
            packaging/dist/Raytracing-macOS.zip
            packaging/dist/Raytracing-Windows.zip
            packaging/dist/Raytracing-Linux.tar.gz
          if-no-files-found: ignore

  release:
    name: Attach to GitHub Release
    needs: build
    if: startsWith(github.ref, 'refs/tags/v')
    runs-on: ubuntu-latest
    permissions:
      contents: write
    steps:
      - uses: actions/download-artifact@v4
        with:
          path: artifacts
          merge-multiple: true

      - uses: softprops/action-gh-release@v2
        with:
          files: artifacts/*
          fail_on_unmatched_files: false

  pypi:
    # Done here (not in pythonpublish.yml) because GitHub does not fire
    # downstream `release` events for releases created with GITHUB_TOKEN,
    # so the softprops action above can't trigger a separate publish
    # workflow. Keeping everything in one workflow side-steps that.
    name: Publish to PyPI
    needs: release
    if: startsWith(github.ref, 'refs/tags/v')
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0  # setuptools_scm needs full history + tags

      - uses: actions/setup-python@v5
        with:
          python-version: '3.11'

      - name: Install build dependencies
        run: |
          python -m pip install --upgrade pip
          pip install build twine

      - name: Build sdist and wheel
        run: python -m build

      - name: Publish to PyPI
        env:
          TWINE_USERNAME: ${{ secrets.PYPI_USERNAME }}
          TWINE_PASSWORD: ${{ secrets.PYPI_PASSWORD }}
        run: twine upload dist/*