release.yml

name: Release

on:
  push:
    tags:
      - 'v*'

env:
  APP_NAME: Hinto
  SCHEME: Hinto
  BUILD_PATH: build/Build/Products/Release
  MACOS_MIN_VERSION: "13.0"  # Keep in sync with Config/base.xcconfig

jobs:
  release:
    runs-on: macos-latest
    environment: production
    permissions:
      contents: write

    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Get version from tag
        id: version
        run: |
          VERSION=${GITHUB_REF#refs/tags/v}
          ./Scripts/ci/validate-release-version.sh "$VERSION"
          BUILD_NUMBER=$(./Scripts/ci/version-to-build-number.sh "$VERSION")
          echo "version=$VERSION" >> $GITHUB_OUTPUT
          echo "build_number=$BUILD_NUMBER" >> $GITHUB_OUTPUT
          echo "Releasing version: $VERSION (build $BUILD_NUMBER)"

      - name: Install certificate
        env:
          APPLE_CERTIFICATE_P12: ${{ secrets.APPLE_CERTIFICATE_P12 }}
          APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
        run: |
          KEYCHAIN_PATH=$RUNNER_TEMP/app-signing.keychain-db
          KEYCHAIN_PASSWORD=password

          security create-keychain -p "$KEYCHAIN_PASSWORD" "$KEYCHAIN_PATH"
          security default-keychain -s "$KEYCHAIN_PATH"
          security unlock-keychain -p "$KEYCHAIN_PASSWORD" "$KEYCHAIN_PATH"

          echo "$APPLE_CERTIFICATE_P12" | base64 --decode > $RUNNER_TEMP/certificate.p12
          security import $RUNNER_TEMP/certificate.p12 \
            -P "$APPLE_CERTIFICATE_PASSWORD" \
            -T /usr/bin/codesign \
            -k "$KEYCHAIN_PATH"

          security set-key-partition-list -S apple-tool:,apple: -s -k "$KEYCHAIN_PASSWORD" "$KEYCHAIN_PATH"

      - name: Build
        env:
          APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
        run: |
          xcodebuild \
            -scheme $SCHEME \
            -configuration Release \
            -derivedDataPath build \
            CODE_SIGN_IDENTITY="Developer ID Application" \
            CODE_SIGN_STYLE=Manual \
            DEVELOPMENT_TEAM="$APPLE_TEAM_ID" \
            CODE_SIGN_INJECT_BASE_ENTITLEMENTS=NO \
            OTHER_CODE_SIGN_FLAGS="--timestamp --options runtime" \
            build

      - name: Re-sign Sparkle framework
        run: |
          APP_PATH="$BUILD_PATH/$APP_NAME.app"
          SPARKLE_PATH="$APP_PATH/Contents/Frameworks/Sparkle.framework"

          # Sign Sparkle components (inner to outer)
          codesign --force --options runtime --timestamp \
            --sign "Developer ID Application" \
            "$SPARKLE_PATH/Versions/B/XPCServices/Downloader.xpc"

          codesign --force --options runtime --timestamp \
            --sign "Developer ID Application" \
            "$SPARKLE_PATH/Versions/B/XPCServices/Installer.xpc"

          codesign --force --options runtime --timestamp \
            --sign "Developer ID Application" \
            "$SPARKLE_PATH/Versions/B/Autoupdate"

          codesign --force --options runtime --timestamp \
            --sign "Developer ID Application" \
            "$SPARKLE_PATH/Versions/B/Updater.app"

          codesign --force --options runtime --timestamp \
            --sign "Developer ID Application" \
            "$SPARKLE_PATH"

          # Re-sign the main app
          codesign --force --options runtime --timestamp \
            --sign "Developer ID Application" \
            --entitlements Resources/Hinto.entitlements \
            "$APP_PATH"

      - name: Notarize
        env:
          APPLE_ID: ${{ secrets.APPLE_ID }}
          APPLE_PASSWORD: ${{ secrets.APPLE_PASSWORD }}
          APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
        run: |
          cd "$BUILD_PATH"
          ditto -c -k --keepParent "$APP_NAME.app" "$APP_NAME.zip"

          xcrun notarytool submit "$APP_NAME.zip" \
            --apple-id "$APPLE_ID" \
            --password "$APPLE_PASSWORD" \
            --team-id "$APPLE_TEAM_ID" \
            --wait

          xcrun stapler staple "$APP_NAME.app"

      - name: Create DMG
        run: |
          git clone https://github.com/create-dmg/create-dmg.git

          ./create-dmg/create-dmg \
            --volname "$APP_NAME" \
            --window-pos 200 120 \
            --window-size 500 320 \
            --icon-size 80 \
            --icon "$APP_NAME.app" 125 175 \
            --hide-extension "$APP_NAME.app" \
            --app-drop-link 375 175 \
            --no-internet-enable \
            "$APP_NAME.dmg" \
            "$BUILD_PATH/$APP_NAME.app"

      - name: Sign DMG for Sparkle
        id: sparkle_sign
        env:
          SPARKLE_PRIVATE_KEY: ${{ secrets.SPARKLE_PRIVATE_KEY }}
        run: |
          # Download Sparkle tools
          SPARKLE_VERSION="2.6.4"
          curl -L -o /tmp/Sparkle.tar.xz "https://github.com/sparkle-project/Sparkle/releases/download/${SPARKLE_VERSION}/Sparkle-${SPARKLE_VERSION}.tar.xz"
          mkdir -p /tmp/sparkle
          tar -xf /tmp/Sparkle.tar.xz -C /tmp/sparkle

          # Sign the DMG with EdDSA key
          echo "$SPARKLE_PRIVATE_KEY" > /tmp/sparkle_key
          SIGN_OUTPUT=$(/tmp/sparkle/bin/sign_update "$APP_NAME.dmg" --ed-key-file /tmp/sparkle_key)
          rm -f /tmp/sparkle_key
          echo "sign_update output: $SIGN_OUTPUT"

          # Extract just the signature value from: sparkle:edSignature="xxx" length="xxx"
          SIGNATURE=$(echo "$SIGN_OUTPUT" | sed -n 's/.*sparkle:edSignature="\([^"]*\)".*/\1/p')
          echo "signature=$SIGNATURE" >> $GITHUB_OUTPUT
          echo "Extracted signature: $SIGNATURE"

          # Get DMG size
          DMG_SIZE=$(stat -f%z "$APP_NAME.dmg")
          echo "dmg_size=$DMG_SIZE" >> $GITHUB_OUTPUT

      - name: Extract release notes from CHANGELOG
        id: changelog
        run: |
          VERSION=${{ steps.version.outputs.version }}

          # Extract content between current version and next version header (or EOF)
          # Trim leading/trailing blank lines while preserving internal blank lines
          NOTES=$(awk '
            /^## \['"$VERSION"'\]/ { flag=1; next }
            /^## \[/ { flag=0 }
            flag { lines[++n] = $0 }
            END {
              start = 1; while (start <= n && lines[start] == "") start++
              end = n; while (end >= start && lines[end] == "") end--
              for (i = start; i <= end; i++) print lines[i]
            }
          ' Resources/CHANGELOG.md)

          # Handle multiline output
          echo "notes<<EOF" >> $GITHUB_OUTPUT
          echo "$NOTES" >> $GITHUB_OUTPUT
          echo "EOF" >> $GITHUB_OUTPUT

      - name: Create GitHub Release
        uses: softprops/action-gh-release@v2
        with:
          files: ${{ env.APP_NAME }}.dmg
          body: |
            ${{ steps.changelog.outputs.notes }}

            ---
            **Installation:** Download `Hinto.dmg`, open it, and drag Hinto to your Applications folder.
          draft: false
          prerelease: false
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

      - name: Deploy appcast.xml to GitHub Pages
        env:
          VERSION: ${{ steps.version.outputs.version }}
          BUILD_NUMBER: ${{ steps.version.outputs.build_number }}
          SIGNATURE: ${{ steps.sparkle_sign.outputs.signature }}
          DMG_SIZE: ${{ steps.sparkle_sign.outputs.dmg_size }}
          MACOS_MIN_VERSION: ${{ env.MACOS_MIN_VERSION }}
          REPO_URL: https://github.com/yhao3/hinto
          APPCAST_URL: https://yhao3.github.io/hinto/appcast.xml
        run: ./Scripts/ci/deploy-appcast.sh

      - name: Update website version
        env:
          VERSION: ${{ steps.version.outputs.version }}
          HINTO_SITE_PAT: ${{ secrets.HINTO_SITE_PAT }}
        run: |
          curl -X POST \
            -H "Authorization: token $HINTO_SITE_PAT" \
            -H "Accept: application/vnd.github.v3+json" \
            https://api.github.com/repos/yhao3/hinto-site/dispatches \
            -d "{\"event_type\":\"release\",\"client_payload\":{\"version\":\"$VERSION\"}}"

      - name: Cleanup
        if: always()
        run: |
          security delete-keychain $RUNNER_TEMP/app-signing.keychain-db || true
          rm -f $RUNNER_TEMP/certificate.p12