release.yml

name: Release Build

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

on:
  push:
    tags:
      - "v*"
  workflow_dispatch:
    inputs:
      tag:
        description: "Optional tag/label used for naming the release asset"
        required: false
        default: ""
      require_developer_id:
        description: "Fail unless a Developer ID Application certificate and notarization secrets are configured"
        required: false
        default: false
        type: boolean

permissions:
  contents: write
  pull-requests: write

jobs:
  release:
    runs-on: macos-26
    timeout-minutes: 60

    steps:
      - name: Checkout code
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v4
        with:
          fetch-depth: 0  # Full history for changelog generation

      - name: Configure git user
        run: |
          git config --global user.name "github-actions[bot]"
          git config --global user.email "github-actions[bot]@users.noreply.github.com"

      - name: Select Xcode version
        run: sudo xcode-select -s /Applications/Xcode_26.2.app/Contents/Developer

      - name: Show Swift version
        run: swift --version

      - name: Cache SPM dependencies
        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
        with:
          path: |
            ~/Library/Caches/org.swift.swiftpm/spm-repositories
            .build
          key: ${{ runner.os }}-spm-release-${{ hashFiles('Package.resolved') }}
          restore-keys: |
            ${{ runner.os }}-spm-release-

      - name: Clear SPM binary artifacts cache
        run: rm -rf ~/Library/Caches/org.swift.swiftpm/artifacts

      - name: Run unit tests
        run: swift test -q --skip KasetUITests

      - name: Determine version from tag
        id: version
        run: |
          if [ -n "${{ inputs.tag }}" ]; then
            TAG="${{ inputs.tag }}"
          elif [ -n "${{ github.ref_name }}" ]; then
            TAG="${{ github.ref_name }}"
          else
            TAG="0.0.0"
          fi
          VERSION="${TAG#v}"  # Remove 'v' prefix if present
          echo "version=$VERSION" >> "$GITHUB_OUTPUT"
          echo "Using version: $VERSION"

      - name: Configure release signing
        id: import_cert
        env:
          MACOS_CERTIFICATE: ${{ secrets.MACOS_CERTIFICATE }}
          MACOS_CERTIFICATE_PWD: ${{ secrets.MACOS_CERTIFICATE_PWD }}
          MACOS_KEYCHAIN_PWD: ${{ secrets.MACOS_KEYCHAIN_PWD }}
          REQUIRE_DEVELOPER_ID: ${{ inputs.require_developer_id || 'false' }}
        run: |
          set -euo pipefail

          require_developer_id() {
            [[ "$REQUIRE_DEVELOPER_ID" == "true" ]]
          }

          use_adhoc_signing() {
            local reason="$1"
            if require_developer_id; then
              echo "ERROR: $reason" >&2
              echo "Developer ID signing was required by workflow input." >&2
              exit 1
            fi

            echo "WARN: $reason" >&2
            echo "WARN: Falling back to ad-hoc signing. The release will not be notarized and macOS Gatekeeper may warn users." >&2
            echo "identity=" >> "$GITHUB_OUTPUT"
            echo "signing_mode=adhoc" >> "$GITHUB_OUTPUT"
          }

          use_development_signing() {
            local identity_hash="$1"
            local reason="$2"
            if require_developer_id; then
              echo "ERROR: $reason" >&2
              echo "Developer ID signing was required by workflow input." >&2
              exit 1
            fi

            echo "WARN: $reason" >&2
            echo "WARN: Using Apple Development signing. The release will not be notarized and macOS Gatekeeper may warn users." >&2
            echo "::add-mask::$identity_hash"
            echo "Using Apple Development signing identity."
            echo "identity=$identity_hash" >> "$GITHUB_OUTPUT"
            echo "signing_mode=dev" >> "$GITHUB_OUTPUT"
          }

          # Developer ID Application signing + notarization is the preferred
          # distribution path, but it requires a paid Apple Developer Program
          # membership. Maintainer builds without that account intentionally use
          # Apple Development signing when the existing non-paid-account .p12 is
          # available, then ad-hoc signing as a last resort.
          if [ -z "$MACOS_CERTIFICATE" ] || [ -z "$MACOS_CERTIFICATE_PWD" ] || [ -z "$MACOS_KEYCHAIN_PWD" ]; then
            use_adhoc_signing "MACOS_CERTIFICATE, MACOS_CERTIFICATE_PWD, or MACOS_KEYCHAIN_PWD is not configured."
            exit 0
          fi

          KEYCHAIN_PATH="$RUNNER_TEMP/kaset-signing.keychain-db"
          CERT_PATH="$RUNNER_TEMP/cert.p12"

          if ! printf '%s' "$MACOS_CERTIFICATE" | base64 --decode > "$CERT_PATH"; then
            use_adhoc_signing "MACOS_CERTIFICATE is not valid base64."
            exit 0
          fi

          security create-keychain -p "$MACOS_KEYCHAIN_PWD" "$KEYCHAIN_PATH"
          security set-keychain-settings -lut 21600 "$KEYCHAIN_PATH"
          security unlock-keychain -p "$MACOS_KEYCHAIN_PWD" "$KEYCHAIN_PATH"
          # Restrict private-key access to codesign rather than -A (all apps).
          if ! security import "$CERT_PATH" -P "$MACOS_CERTIFICATE_PWD" \
            -t cert -f pkcs12 -k "$KEYCHAIN_PATH" \
            -T /usr/bin/codesign -T /usr/bin/security; then
            rm -f "$CERT_PATH"
            use_adhoc_signing "MACOS_CERTIFICATE could not be imported."
            exit 0
          fi

          security set-key-partition-list -S apple-tool:,apple:,codesign: \
            -s -k "$MACOS_KEYCHAIN_PWD" "$KEYCHAIN_PATH" >/dev/null

          # Prepend our keychain to the search list so codesign can find the cert.
          security list-keychains -d user -s "$KEYCHAIN_PATH" \
            $(security list-keychains -d user | tr -d '"')

          rm -f "$CERT_PATH"

          IDENTITY_HASH=$(security find-identity -v -p codesigning "$KEYCHAIN_PATH" 2>/dev/null \
            | awk '/Developer ID Application/ { print $2; exit }' || true)
          if [ -n "$IDENTITY_HASH" ]; then
            echo "::add-mask::$IDENTITY_HASH"
            echo "Using Developer ID Application signing identity."
            echo "identity=$IDENTITY_HASH" >> "$GITHUB_OUTPUT"
            echo "signing_mode=developer-id" >> "$GITHUB_OUTPUT"
            exit 0
          fi

          DEVELOPMENT_IDENTITY_HASH=$(security find-identity -v -p codesigning "$KEYCHAIN_PATH" 2>/dev/null \
            | awk '/Apple Development/ { print $2; exit }' || true)
          if [ -n "$DEVELOPMENT_IDENTITY_HASH" ]; then
            use_development_signing "$DEVELOPMENT_IDENTITY_HASH" "Imported keychain has no Developer ID Application identity."
            exit 0
          fi

          use_adhoc_signing "Imported keychain has no Developer ID Application or Apple Development identity."

      - name: Build release app
        env:
          KASET_SIGNING: ${{ steps.import_cert.outputs.signing_mode }}
          APP_IDENTITY: ${{ steps.import_cert.outputs.identity }}
          ARCHES: "arm64 x86_64"
        run: |
          # Set version from tag
          echo "MARKETING_VERSION=${{ steps.version.outputs.version }}" > version.env
          echo "BUILD_NUMBER=${{ github.run_number }}" >> version.env
          Scripts/build-app.sh release

      - name: Verify release app
        run: |
          VERIFY_ARGS=()
          if [ "${{ steps.import_cert.outputs.signing_mode }}" = "developer-id" ]; then
            VERIFY_ARGS+=(--require-developer-id)
          fi
          Scripts/verify-release-app.sh "${VERIFY_ARGS[@]}" .build/app/Kaset.app

      - name: Cache Homebrew
        id: cache-homebrew
        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
        with:
          path: |
            /usr/local/Homebrew
            ~/Library/Caches/Homebrew
          key: ${{ runner.os }}-homebrew-create-dmg

      - name: Install create-dmg
        run: brew install create-dmg

      - name: Create DMG
        run: |
          APP_PATH=".build/app/Kaset.app"

          if [ ! -d "$APP_PATH" ]; then
            echo "Error: Could not find Kaset.app"
            exit 1
          fi

          echo "Found app at: $APP_PATH"
          rm -f kaset.dmg || true

          # Verify app version matches expected version
          PLIST_VERSION=$(/usr/libexec/PlistBuddy -c "Print CFBundleShortVersionString" "$APP_PATH/Contents/Info.plist")
          EXPECTED_VERSION="${{ steps.version.outputs.version }}"
          echo "Built app version: $PLIST_VERSION"
          echo "Expected version: $EXPECTED_VERSION"
          if [ "$PLIST_VERSION" != "$EXPECTED_VERSION" ]; then
            echo "Error: Version mismatch!"
            exit 1
          fi

          # Verify Universal Binary (Intel + Apple Silicon)
          if [ -f "$APP_PATH/Contents/MacOS/Kaset" ]; then
            ARCHS=$(lipo -archs "$APP_PATH/Contents/MacOS/Kaset" 2>/dev/null || echo "unknown")
          else
            ARCHS="unknown"
          fi
          echo "Architectures: $ARCHS"
          if [[ "$ARCHS" != *"x86_64"* ]] || [[ "$ARCHS" != *"arm64"* ]]; then
            echo "Error: App is not a Universal Binary (found: $ARCHS)"
            exit 1
          fi

          # Create styled DMG with Applications symlink
          create-dmg \
            --volname "Kaset" \
            --window-pos 200 120 \
            --window-size 660 400 \
            --icon-size 100 \
            --icon "Kaset.app" 180 190 \
            --app-drop-link 480 190 \
            --hide-extension "Kaset.app" \
            --no-internet-enable \
            kaset.dmg \
            "$APP_PATH"

      - name: Determine artifact name
        id: artifact
        run: |
          if [ -n "${{ inputs.tag }}" ]; then
            TAG="${{ inputs.tag }}"
          elif [ -n "${{ github.ref_name }}" ]; then
            TAG="${{ github.ref_name }}"
          else
            TAG="v${{ steps.version.outputs.version }}"
          fi

          if [ -z "$TAG" ]; then
            TAG="release"
          fi

          echo "tag=$TAG" >> "$GITHUB_OUTPUT"
          echo "filename=kaset-$TAG.dmg" >> "$GITHUB_OUTPUT"

      - name: Rename DMG
        run: mv kaset.dmg "${{ steps.artifact.outputs.filename }}"

      - name: Sign and notarize DMG
        env:
          APP_IDENTITY: ${{ steps.import_cert.outputs.identity }}
          SIGNING_MODE: ${{ steps.import_cert.outputs.signing_mode }}
          APPLE_ID: ${{ secrets.APPLE_ID }}
          APPLE_APP_SPECIFIC_PASSWORD: ${{ secrets.APPLE_APP_SPECIFIC_PASSWORD }}
          APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
        run: |
          FILE="${{ steps.artifact.outputs.filename }}"

          if [ "$SIGNING_MODE" != "developer-id" ]; then
            echo "Skipping DMG Developer ID signing and notarization because SIGNING_MODE=$SIGNING_MODE."
            echo "This release will rely on checksum verification, GitHub/Homebrew transport, and Sparkle EdDSA update signatures."
            echo "macOS Gatekeeper may warn users because Developer ID notarization requires a paid Apple Developer Program membership."
            exit 0
          fi

          codesign --force --timestamp --sign "$APP_IDENTITY" "$FILE"
          codesign --verify --verbose=2 "$FILE"

          if [ -z "$APPLE_ID" ] || [ -z "$APPLE_APP_SPECIFIC_PASSWORD" ] || [ -z "$APPLE_TEAM_ID" ]; then
            echo "ERROR: APPLE_ID, APPLE_APP_SPECIFIC_PASSWORD, and APPLE_TEAM_ID secrets are required for notarized Developer ID releases." >&2
            echo "A Developer ID certificate was imported, so publishing an unnotarized DMG would be a release misconfiguration." >&2
            exit 1
          fi

          xcrun notarytool submit "$FILE" \
            --apple-id "$APPLE_ID" \
            --password "$APPLE_APP_SPECIFIC_PASSWORD" \
            --team-id "$APPLE_TEAM_ID" \
            --wait

          xcrun stapler staple "$FILE"
          xcrun stapler validate "$FILE"
          spctl --assess --type open --verbose=4 "$FILE"

      - name: Upload artifact
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v4
        with:
          name: ${{ steps.artifact.outputs.filename }}
          path: ${{ steps.artifact.outputs.filename }}
          retention-days: 30

      - name: Calculate SHA256
        id: sha256
        run: |
          SHA256=$(shasum -a 256 "${{ steps.artifact.outputs.filename }}" | awk '{print $1}')
          echo "sha256=$SHA256" >> "$GITHUB_OUTPUT"

      - name: Sign DMG for Sparkle
        id: sparkle_sign
        env:
          SPARKLE_PRIVATE_KEY: ${{ secrets.SPARKLE_PRIVATE_KEY }}
        run: |
          if [ -z "$SPARKLE_PRIVATE_KEY" ]; then
            echo "Warning: SPARKLE_PRIVATE_KEY not set, skipping Sparkle signing"
            echo "signature=" >> "$GITHUB_OUTPUT"
            echo "length=0" >> "$GITHUB_OUTPUT"
            exit 0
          fi

          # Find Sparkle's sign_update binary
          SIGN_UPDATE=$(find ./.build -name "sign_update" -type f 2>/dev/null | head -1)
          if [ -z "$SIGN_UPDATE" ]; then
            echo "Warning: sign_update not found, skipping Sparkle signing"
            echo "signature=" >> "$GITHUB_OUTPUT"
            echo "length=0" >> "$GITHUB_OUTPUT"
            exit 0
          fi

          # Write private key to a runner-temp file and always remove it before the step exits.
          SPARKLE_KEY_FILE=$(mktemp "$RUNNER_TEMP/kaset-sparkle-key.XXXXXX")
          trap 'rm -f "$SPARKLE_KEY_FILE"' EXIT
          printf '%s' "$SPARKLE_PRIVATE_KEY" > "$SPARKLE_KEY_FILE"
          chmod 600 "$SPARKLE_KEY_FILE"

          # Sign the DMG and capture output. Do not echo SIGN_OUTPUT: it contains the public update signature.
          SIGN_OUTPUT=$("$SIGN_UPDATE" --ed-key-file "$SPARKLE_KEY_FILE" "${{ steps.artifact.outputs.filename }}")

          # Parse signature and length from output
          # Output format: sparkle:edSignature="..." length="..."
          SIGNATURE=$(echo "$SIGN_OUTPUT" | grep -o 'sparkle:edSignature="[^"]*"' | sed 's/sparkle:edSignature="//;s/"$//')
          LENGTH=$(stat -f%z "${{ steps.artifact.outputs.filename }}")

          echo "signature=$SIGNATURE" >> "$GITHUB_OUTPUT"
          echo "length=$LENGTH" >> "$GITHUB_OUTPUT"
          echo "Sparkle signature generated successfully"

      - name: Generate release notes
        id: release_notes
        run: |
          TAG="${{ steps.artifact.outputs.tag }}"
          VERSION="${{ steps.version.outputs.version }}"
          SHA256="${{ steps.sha256.outputs.sha256 }}"

          # Get previous tag for changelog
          # List all version tags sorted by version, find the one before current
          CURRENT_TAG="${{ steps.artifact.outputs.tag }}"
          PREV_TAG=$(git tag -l 'v*' --sort=-v:refname | grep -A1 "^${CURRENT_TAG}$" | tail -1)
          # If grep found nothing or returned the same tag, try alternative method
          if [ "$PREV_TAG" = "$CURRENT_TAG" ] || [ -z "$PREV_TAG" ]; then
            PREV_TAG=$(git describe --tags --abbrev=0 "${CURRENT_TAG}^" 2>/dev/null || echo "")
          fi

          # Generate changelog
          if [ -n "$PREV_TAG" ] && [ "$PREV_TAG" != "$CURRENT_TAG" ]; then
            CHANGELOG=$(git log --pretty=format:"- %s" "$PREV_TAG".."$CURRENT_TAG" --no-merges | head -50)
          else
            CHANGELOG="- Initial release"
          fi

          # Create release notes
          NOTES=$(cat <<EOF
          ## What's New

          ${CHANGELOG}
          EOF
          )

          # Write to file (safer than GITHUB_OUTPUT for multiline)
          echo "$NOTES" > release_notes.md

      - name: Check if pre-release
        id: prerelease
        run: |
          TAG="${{ steps.artifact.outputs.tag }}"
          if [[ "$TAG" =~ -(alpha|beta|rc|dev) ]]; then
            echo "is_prerelease=true" >> "$GITHUB_OUTPUT"
          else
            echo "is_prerelease=false" >> "$GITHUB_OUTPUT"
          fi

      - name: Create GitHub release and upload DMG
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          set -eo pipefail

          TAG="${{ steps.artifact.outputs.tag }}"
          FILE="${{ steps.artifact.outputs.filename }}"
          TITLE="${TAG}"
          PRERELEASE_FLAG=""

          if [ "${{ steps.prerelease.outputs.is_prerelease }}" = "true" ]; then
            PRERELEASE_FLAG="--prerelease"
          fi

          if gh release view "$TAG" >/dev/null 2>&1; then
            echo "Release $TAG already exists, uploading asset instead"
            gh release upload "$TAG" "$FILE" --clobber
          else
            gh release create "$TAG" "$FILE" \
              --title "$TITLE" \
              --notes-file release_notes.md \
              $PRERELEASE_FLAG
          fi

      - name: Checkout Homebrew tap repo
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v4
        with:
          repository: sozercan/homebrew-repo
          token: ${{ secrets.HOMEBREW_REPO_TOKEN }}
          path: homebrew-repo
          fetch-depth: 0

      - name: Update Homebrew Cask
        run: |
          TAG="${{ steps.artifact.outputs.tag }}"
          VERSION="${TAG#v}"

          cd homebrew-repo

          # Update the cask file
          mkdir -p Casks
          cat > Casks/kaset.rb << EOF
          cask "kaset" do
            version "$VERSION"
            sha256 "${{ steps.sha256.outputs.sha256 }}"

            url "https://github.com/sozercan/kaset/releases/download/v#{version}/kaset-v#{version}.dmg"
            name "Kaset"
            desc "Native YouTube Music client"
            homepage "https://github.com/sozercan/kaset"

            auto_updates true
            # Homebrew casks can gate on macOS release symbols, but not this
            # app's exact 15.4 patch minimum; LSMinimumSystemVersion and
            # Sparkle's appcast enforce 15.4 at launch/update time.
            depends_on macos: :sequoia

            app "Kaset.app"

            postflight do
              system_command "/usr/bin/xattr", args: ["-cr", "#{appdir}/Kaset.app"], sudo: false
            end

            zap trash: [
              "~/Library/Application Support/Kaset",
              "~/Library/Caches/com.sertacozercan.Kaset",
              "~/Library/Preferences/com.sertacozercan.Kaset.plist",
              "~/Library/Saved Application State/com.sertacozercan.Kaset.savedState",
              "~/Library/WebKit/com.sertacozercan.Kaset",
            ]
          end
          EOF

          git add Casks/kaset.rb
          git diff --cached --quiet || git commit -m "Update kaset to ${TAG}"
          git push origin main

      - name: Update Appcast
        run: |
          # Fetch and checkout the default branch (we're in detached HEAD from tag checkout)
          git fetch origin ${{ github.event.repository.default_branch }}
          git checkout ${{ github.event.repository.default_branch }}

          TAG="${{ steps.artifact.outputs.tag }}"
          VERSION="${TAG#v}"

          # Update appcast.xml for Sparkle auto-updates
          SIGNATURE="${{ steps.sparkle_sign.outputs.signature }}"
          LENGTH="${{ steps.sparkle_sign.outputs.length }}"

          if [ -n "$SIGNATURE" ]; then
            PUB_DATE=$(date -u "+%a, %d %b %Y %H:%M:%S %z")
            DOWNLOAD_URL="https://github.com/${{ github.repository }}/releases/download/${TAG}/${{ steps.artifact.outputs.filename }}"
            RELEASE_NOTES_URL="https://github.com/${{ github.repository }}/releases/tag/${TAG}"

            # Create updated appcast.xml with the new item at the top
            cat > appcast.xml << APPCAST_EOF
          <?xml version="1.0" encoding="utf-8"?>
          <rss version="2.0" xmlns:sparkle="http://www.andymatuschak.org/xml-namespaces/sparkle" xmlns:dc="http://purl.org/dc/elements/1.1/">
              <channel>
                  <title>Kaset Updates</title>
                  <link>https://github.com/${{ github.repository }}/releases</link>
                  <description>Most recent updates for Kaset, a native macOS YouTube Music client.</description>
                  <language>en</language>

                  <item>
                      <title>Version ${VERSION}</title>
                      <sparkle:releaseNotesLink>${RELEASE_NOTES_URL}</sparkle:releaseNotesLink>
                      <pubDate>${PUB_DATE}</pubDate>
                      <enclosure
                          url="${DOWNLOAD_URL}"
                          sparkle:version="${{ github.run_number }}"
                          sparkle:shortVersionString="${VERSION}"
                          length="${LENGTH}"
                          type="application/octet-stream"
                          sparkle:edSignature="${SIGNATURE}"/>
                      <sparkle:minimumSystemVersion>15.4</sparkle:minimumSystemVersion>
                  </item>

              </channel>
          </rss>
          APPCAST_EOF

            git add appcast.xml
            git diff --cached --quiet || git commit -m "Update appcast to ${{ steps.artifact.outputs.tag }}"
            git push origin ${{ github.event.repository.default_branch }}
          fi