release.yml

name: ContainerBar release

on:
  push:
    tags:
      - "v*"
  workflow_dispatch:
    inputs:
      version:
        description: "Release version, for example 0.1.0 or v0.1.0"
        required: true
        type: string

permissions:
  contents: write

jobs:
  release:
    name: Build and publish ContainerBar
    runs-on: macos-26
    timeout-minutes: 60
    env:
      BUILD_CONFIGURATION: release
      CONTAINERBAR_BUNDLE_IDENTIFIER: io.github.warrendt.containerbar
      CODESIGN_IDENTITY: "-"
      SWIFT_BUILD_FLAGS: "--arch arm64"
      GIT_CONFIG_COUNT: 1
      GIT_CONFIG_KEY_0: safe.bareRepository
      GIT_CONFIG_VALUE_0: all
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Resolve release metadata
        id: release
        env:
          INPUT_VERSION: ${{ inputs.version }}
        run: |
          set -euo pipefail

          if [ "${GITHUB_EVENT_NAME}" = "workflow_dispatch" ]; then
            version="${INPUT_VERSION#v}"
            tag="v${version}"
          else
            tag="${GITHUB_REF_NAME}"
            version="${tag#v}"
          fi

          echo "version=${version}" >> "$GITHUB_OUTPUT"
          echo "tag=${tag}" >> "$GITHUB_OUTPUT"
          echo "VERSION=${version}" >> "$GITHUB_ENV"
          echo "TAG=${tag}" >> "$GITHUB_ENV"
          echo "GIT_COMMIT=$(git rev-parse HEAD)" >> "$GITHUB_ENV"

      - name: Show toolchain
        run: |
          sw_vers
          xcodebuild -version
          swift --version

      - name: Build ContainerBar app
        env:
          MARKETING_VERSION: ${{ steps.release.outputs.version }}
          BUNDLE_VERSION: ${{ github.run_number }}
        run: |
          set -euo pipefail
          scripts/build-containerbar-app.sh
          codesign --verify --deep --strict --verbose=2 "bin/release/ContainerBar.app"

      - name: Package release assets
        run: |
          set -euo pipefail
          mkdir -p release
          ditto -c -k --sequesterRsrc --keepParent \
            "bin/release/ContainerBar.app" \
            "release/ContainerBar-${VERSION}-macos-arm64.zip"
          shasum -a 256 "release/ContainerBar-${VERSION}-macos-arm64.zip" \
            > "release/ContainerBar-${VERSION}-macos-arm64.zip.sha256"

      - name: Publish GitHub release
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          set -euo pipefail

          notes="ContainerBar ${VERSION}

          This release contains the macOS arm64 ContainerBar app bundle. Download the zip, unzip it, and move ContainerBar.app to Applications."

          if gh release view "$TAG" >/dev/null 2>&1; then
            gh release upload "$TAG" release/* --clobber
          else
            gh release create "$TAG" release/* \
              --target "$GITHUB_SHA" \
              --title "ContainerBar ${VERSION}" \
              --notes "$notes"
          fi

      - name: Update Homebrew tap
        env:
          HOMEBREW_TAP_TOKEN: ${{ secrets.HOMEBREW_TAP_TOKEN }}
        run: |
          set -euo pipefail

          if [ -z "${HOMEBREW_TAP_TOKEN}" ]; then
            echo "::warning::HOMEBREW_TAP_TOKEN is not configured; skipping Homebrew tap update."
            exit 0
          fi

          sha256="$(awk '{print $1}' "release/ContainerBar-${VERSION}-macos-arm64.zip.sha256")"
          git clone "https://x-access-token:${HOMEBREW_TAP_TOKEN}@github.com/warrendt/homebrew-tap.git" homebrew-tap

          mkdir -p homebrew-tap/Casks
          cat > homebrew-tap/Casks/containerbar.rb <<EOF
          cask "containerbar" do
            version "${VERSION}"
            sha256 "${sha256}"

            url "https://github.com/warrendt/containerbar/releases/download/v#{version}/ContainerBar-#{version}-macos-arm64.zip"
            name "ContainerBar"
            desc "macOS menu bar app for Apple container"
            homepage "https://github.com/warrendt/containerbar"

            depends_on arch: :arm64
            depends_on macos: ">= :sequoia"

            app "ContainerBar.app"
          end
          EOF

          ruby -c homebrew-tap/Casks/containerbar.rb

          git -C homebrew-tap config user.name "github-actions[bot]"
          git -C homebrew-tap config user.email "41898282+github-actions[bot]@users.noreply.github.com"

          if git -C homebrew-tap diff --quiet -- Casks/containerbar.rb; then
            echo "Homebrew tap already points at ContainerBar ${VERSION}."
            exit 0
          fi

          git -C homebrew-tap add Casks/containerbar.rb
          git -C homebrew-tap commit -m "Update ContainerBar cask to ${VERSION}"
          git -C homebrew-tap push origin main