release.yml

name: Build and Release

on:
  push:
    branches: [main]
    paths-ignore:
      - "**.md"
      - "docs/**"
      - "tests/**"

permissions:
  contents: write

jobs:
  build-and-release:
    runs-on: macos-latest

    steps:
      - name: Checkout code
        uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: "3.11"

      - name: Get version from code
        id: get_version
        run: |
          VERSION=$(grep -E "^__version__ = " pdf2mp3_gui.py | cut -d'"' -f2)
          echo "version=$VERSION" >> $GITHUB_OUTPUT
          echo "tag=v$VERSION" >> $GITHUB_OUTPUT

      - name: Check if tag exists
        id: check_tag
        run: |
          if git rev-parse "v${{ steps.get_version.outputs.version }}" >/dev/null 2>&1; then
            echo "exists=true" >> $GITHUB_OUTPUT
          else
            echo "exists=false" >> $GITHUB_OUTPUT
          fi

      - name: Install dependencies
        if: steps.check_tag.outputs.exists == 'false'
        run: |
          python -m pip install --upgrade pip
          python -m pip install py2app edge-tts pypdf PyQt6 Pillow
          brew install create-dmg

      - name: Build macOS app
        if: steps.check_tag.outputs.exists == 'false'
        run: |
          chmod +x .github/scripts/build-app.sh
          .github/scripts/build-app.sh

      - name: Generate DMG background image
        if: steps.check_tag.outputs.exists == 'false'
        run: |
          mkdir -p .github/assets
          python3 .github/scripts/create-dmg-background.py
          chmod +x .github/scripts/create-dmg-background.sh
          .github/scripts/create-dmg-background.sh
          ls -lh .github/assets/

      - name: Code sign and notarize app
        if: steps.check_tag.outputs.exists == 'false'
        env:
          APPLE_CERTIFICATE_P12_BASE64: ${{ secrets.APPLE_CERTIFICATE_P12_BASE64 }}
          APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
          APPLE_ID: ${{ secrets.APPLE_ID }}
          APPLE_APP_SPECIFIC_PASSWORD: ${{ secrets.APPLE_APP_SPECIFIC_PASSWORD }}
          APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
        run: |
          chmod +x .github/scripts/sign-and-notarize.sh
          .github/scripts/sign-and-notarize.sh

      - name: Create DMG
        if: steps.check_tag.outputs.exists == 'false'
        run: |
          chmod +x .github/scripts/create-dmg.sh
          .github/scripts/create-dmg.sh ${{ steps.get_version.outputs.version }}

      - name: Sign DMG
        if: steps.check_tag.outputs.exists == 'false'
        env:
          APPLE_CERTIFICATE_P12_BASE64: ${{ secrets.APPLE_CERTIFICATE_P12_BASE64 }}
          APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
        run: |
          # Reimport certificate for DMG signing
          KEYCHAIN_PATH="$RUNNER_TEMP/dmg-signing.keychain-db"
          KEYCHAIN_PASSWORD=$(openssl rand -base64 32)
          security create-keychain -p "$KEYCHAIN_PASSWORD" "$KEYCHAIN_PATH"
          security set-keychain-settings -lut 21600 "$KEYCHAIN_PATH"
          security unlock-keychain -p "$KEYCHAIN_PASSWORD" "$KEYCHAIN_PATH"

          CERT_PATH="$RUNNER_TEMP/certificate.p12"
          echo "$APPLE_CERTIFICATE_P12_BASE64" | base64 --decode > "$CERT_PATH"
          security import "$CERT_PATH" -k "$KEYCHAIN_PATH" -P "$APPLE_CERTIFICATE_PASSWORD" -T /usr/bin/codesign
          security list-keychain -d user -s "$KEYCHAIN_PATH"
          security set-key-partition-list -S apple-tool:,apple: -s -k "$KEYCHAIN_PASSWORD" "$KEYCHAIN_PATH"

          chmod +x .github/scripts/sign-dmg.sh
          .github/scripts/sign-dmg.sh ${{ steps.get_version.outputs.version }}

          security delete-keychain "$KEYCHAIN_PATH" || true
          rm -f "$CERT_PATH"

      - name: Create Release
        if: steps.check_tag.outputs.exists == 'false'
        uses: softprops/action-gh-release@v1
        with:
          tag_name: ${{ steps.get_version.outputs.tag }}
          name: TextWave ${{ steps.get_version.outputs.version }}
          draft: false
          prerelease: false
          files: |
            TextWave-${{ steps.get_version.outputs.version }}.dmg
            dist/TextWave.app.zip
          body: |
            ## TextWave ${{ steps.get_version.outputs.version }}

            ### Installation
            Download `TextWave-${{ steps.get_version.outputs.version }}.dmg`, open it, and drag TextWave to your Applications folder.

            ✅ **This release is code-signed and notarized by Apple** - no security warnings!

            ### Requirements
            - macOS 10.15 or later
            - Internet connection for text-to-speech conversion

            ### Features
            - Convert PDF documents to MP3 audio files
            - Automatic edge-tts dependency updates
            - In-app update notifications
            - Sleep prevention during conversion
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}