release.yml

name: Release

on:
  workflow_dispatch:
    inputs:
      version:
        description: 'Release version (e.g., 1.4.0)'
        required: true
        type: string

env:
  SCHEME: "Codeagogo"
  DESTINATION: "platform=macOS"

jobs:
  release:
    name: Create Release
    runs-on: macos-14
    permissions:
      contents: write

    steps:
      - name: Validate version format
        run: |
          if ! [[ "${{ inputs.version }}" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
            echo "Error: Version must be in format X.Y.Z (e.g., 1.4.0)"
            exit 1
          fi

      - name: Checkout
        uses: actions/checkout@v4
        with:
          fetch-depth: 0
          token: ${{ secrets.GITHUB_TOKEN }}

      - name: Configure Git
        run: |
          git config user.name "github-actions[bot]"
          git config user.email "github-actions[bot]@users.noreply.github.com"

      - name: Check for existing tag
        run: |
          if git rev-parse "v${{ inputs.version }}" >/dev/null 2>&1; then
            echo "Error: Tag v${{ inputs.version }} already exists"
            exit 1
          fi

      - name: Update CHANGELOG.md
        run: |
          VERSION="${{ inputs.version }}"
          DATE=$(date +%Y-%m)

          # Check if there are unreleased changes
          if ! grep -q "## \[Unreleased\]" CHANGELOG.md; then
            echo "Error: No [Unreleased] section found in CHANGELOG.md"
            exit 1
          fi

          # Check if there's content under Unreleased
          UNRELEASED_CONTENT=$(sed -n '/## \[Unreleased\]/,/## \[/p' CHANGELOG.md | sed '1d;$d')
          if [ -z "$(echo "$UNRELEASED_CONTENT" | grep -v '^[[:space:]]*$')" ]; then
            echo "Error: No changes documented under [Unreleased] section"
            exit 1
          fi

          # Replace [Unreleased] with new version, keeping Unreleased section for future
          sed -i '' "s/## \[Unreleased\]/## [Unreleased]\n\n## [$VERSION] - $DATE/" CHANGELOG.md

          echo "Updated CHANGELOG.md for version $VERSION"
          cat CHANGELOG.md | head -50

      - name: Update Xcode project version
        run: |
          VERSION="${{ inputs.version }}"

          # Update MARKETING_VERSION in project.pbxproj for the main app target
          # This updates all occurrences which covers Debug and Release configurations
          sed -i '' "s/MARKETING_VERSION = [0-9]*\.[0-9]*\.[0-9]*;/MARKETING_VERSION = $VERSION;/g" \
            "Codeagogo.xcodeproj/project.pbxproj"

          echo "Updated Xcode project version to $VERSION"
          grep "MARKETING_VERSION" "Codeagogo.xcodeproj/project.pbxproj"

      - name: Extract release notes
        id: release_notes
        run: |
          VERSION="${{ inputs.version }}"

          # Extract the section for this version (between ## [version] and next ## [)
          NOTES=$(sed -n "/## \[$VERSION\]/,/## \[/p" CHANGELOG.md | sed '1d;$d')

          # Write to file for GitHub release
          echo "$NOTES" > release_notes.md

          echo "Release notes:"
          cat release_notes.md

      - name: Commit release changes
        run: |
          git add CHANGELOG.md "Codeagogo.xcodeproj/project.pbxproj"
          git commit -m "release: v${{ inputs.version }}"

      - name: Create and push tag
        run: |
          git tag -a "v${{ inputs.version }}" -m "Release v${{ inputs.version }}"
          git push origin main
          git push origin "v${{ inputs.version }}"

      - name: Select Xcode
        run: sudo xcode-select -s /Applications/Xcode_16.2.app/Contents/Developer

      - name: Install Apple Certificate
        if: env.APPLE_CERTIFICATE_BASE64 != ''
        env:
          APPLE_CERTIFICATE_BASE64: ${{ secrets.APPLE_CERTIFICATE_BASE64 }}
          APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
        run: |
          KEYCHAIN_PATH=$RUNNER_TEMP/app-signing.keychain-db
          KEYCHAIN_PASSWORD=$(openssl rand -base64 32)

          security create-keychain -p "$KEYCHAIN_PASSWORD" "$KEYCHAIN_PATH"
          security set-keychain-settings -lut 21600 "$KEYCHAIN_PATH"
          security unlock-keychain -p "$KEYCHAIN_PASSWORD" "$KEYCHAIN_PATH"

          CERTIFICATE_PATH=$RUNNER_TEMP/certificate.p12
          echo -n "$APPLE_CERTIFICATE_BASE64" | base64 --decode -o "$CERTIFICATE_PATH"

          security import "$CERTIFICATE_PATH" \
            -P "$APPLE_CERTIFICATE_PASSWORD" \
            -A \
            -t cert \
            -f pkcs12 \
            -k "$KEYCHAIN_PATH"

          security set-key-partition-list -S apple-tool:,apple: -k "$KEYCHAIN_PASSWORD" "$KEYCHAIN_PATH"
          security list-keychain -d user -s "$KEYCHAIN_PATH"

      - name: Build Release (signed)
        if: env.APPLE_CERTIFICATE_BASE64 != ''
        env:
          APPLE_CERTIFICATE_BASE64: ${{ secrets.APPLE_CERTIFICATE_BASE64 }}
          APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
        run: |
          xcodebuild build \
            -scheme "$SCHEME" \
            -destination "$DESTINATION" \
            -configuration Release \
            -derivedDataPath build \
            CODE_SIGN_STYLE=Manual \
            CODE_SIGN_IDENTITY="Apple Development" \
            DEVELOPMENT_TEAM="$APPLE_TEAM_ID" \
            CODE_SIGNING_REQUIRED=YES \
            ENABLE_HARDENED_RUNTIME=YES \
            ENABLE_APP_SANDBOX=NO

      - name: Build Release (unsigned)
        if: env.APPLE_CERTIFICATE_BASE64 == ''
        env:
          APPLE_CERTIFICATE_BASE64: ${{ secrets.APPLE_CERTIFICATE_BASE64 }}
        run: |
          xcodebuild build \
            -scheme "$SCHEME" \
            -destination "$DESTINATION" \
            -configuration Release \
            -derivedDataPath build \
            CODE_SIGN_IDENTITY="-" \
            CODE_SIGNING_REQUIRED=NO

      - name: Create artifact
        run: |
          mkdir -p artifact
          cp -R "build/Build/Products/Release/Codeagogo.app" artifact/
          cd artifact
          zip -r "Codeagogo-v${{ inputs.version }}-macOS.zip" "Codeagogo.app"

      - name: Create GitHub Release
        uses: softprops/action-gh-release@v2
        with:
          tag_name: v${{ inputs.version }}
          name: Codeagogo v${{ inputs.version }}
          body_path: release_notes.md
          files: artifact/Codeagogo-v${{ inputs.version }}-macOS.zip
          draft: false
          prerelease: false

      - name: Update Homebrew Cask
        run: |
          VERSION="${{ inputs.version }}"
          ZIP_PATH="artifact/Codeagogo-v${VERSION}-macOS.zip"
          SHA=$(shasum -a 256 "$ZIP_PATH" | awk '{print $1}')

          sed -i '' "s/version \".*\"/version \"${VERSION}\"/" Casks/codeagogo.rb
          sed -i '' "s/sha256 \".*\"/sha256 \"${SHA}\"/" Casks/codeagogo.rb

          echo "Updated Casks/codeagogo.rb: version=${VERSION} sha256=${SHA}"
          cat Casks/codeagogo.rb

          git add Casks/codeagogo.rb
          git commit -m "chore: update Homebrew cask to v${VERSION}"
          git push origin main

      - name: Cleanup Keychain
        if: always()
        run: |
          KEYCHAIN_PATH=$RUNNER_TEMP/app-signing.keychain-db
          if [ -f "$KEYCHAIN_PATH" ]; then
            security delete-keychain "$KEYCHAIN_PATH"
          fi