release.yml

name: Release

on:
  workflow_dispatch:
    inputs:
      tag:
        description: 'Tag to release (e.g., v1.0.0)'
        required: true
        type: string

env:
  APP_NAME: Pindrop
  SCHEME: Pindrop
  CONFIGURATION: Release
  SPARKLE_VERSION: "2.6.4"

jobs:
  build:
    runs-on: macos-26
    permissions:
      actions: read
      contents: write

    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          fetch-depth: 0
          ref: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.tag || github.ref }}

      - name: Setup Xcode
        uses: maxim-lobanov/setup-xcode@v1
        with:
          xcode-version: latest-stable

      - name: Install Dependencies
        run: |
          # Install create-dmg for DMG creation
          brew install create-dmg

          # Download Sparkle tools directly (same as justfile)
          echo "📦 Downloading Sparkle ${SPARKLE_VERSION} tools..."
          curl -L -o /tmp/Sparkle.tar.xz "https://github.com/sparkle-project/Sparkle/releases/download/${SPARKLE_VERSION}/Sparkle-${SPARKLE_VERSION}.tar.xz"
          mkdir -p /tmp/sparkle-extract
          tar -xf /tmp/Sparkle.tar.xz -C /tmp/sparkle-extract
          
          # Copy tools to a known location
          mkdir -p bin
          cp /tmp/sparkle-extract/bin/generate_appcast bin/
          cp /tmp/sparkle-extract/bin/sign_update bin/
          chmod +x bin/generate_appcast bin/sign_update
          
          # Cleanup
          rm -rf /tmp/Sparkle.tar.xz /tmp/sparkle-extract
          
          echo "✅ Sparkle tools installed to bin/"
          ls -la bin/

      - name: Get Version
        id: version
        run: |
          git fetch --tags --force

          if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
            VERSION="${{ github.event.inputs.tag }}"
          else
            VERSION="${GITHUB_REF#refs/tags/}"
          fi

          if ! [[ "$VERSION" =~ ^v[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
            echo "❌ Invalid release tag: $VERSION"
            echo "Expected format: vX.Y.Z"
            exit 1
          fi

          TARGET_SHA=$(git rev-list -n 1 "$VERSION")
          if [ -z "$TARGET_SHA" ]; then
            echo "❌ Could not resolve tag $VERSION to a commit"
            exit 1
          fi

          # Remove 'v' prefix for the app version
          APP_VERSION="${VERSION#v}"
          echo "version=$VERSION" >> $GITHUB_OUTPUT
          echo "app_version=$APP_VERSION" >> $GITHUB_OUTPUT
          echo "target_sha=$TARGET_SHA" >> $GITHUB_OUTPUT
          echo "Building version: $VERSION (app: $APP_VERSION, sha: $TARGET_SHA)"

      - name: Wait For CI To Pass
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          TARGET_SHA="${{ steps.version.outputs.target_sha }}"
          echo "Waiting for CI workflow to pass for commit $TARGET_SHA"

          ATTEMPTS=120
          SLEEP_SECONDS=15

          for ((i=1; i<=ATTEMPTS; i++)); do
            RUN_JSON=$(gh run list --workflow ci.yml --commit "$TARGET_SHA" --json databaseId,status,conclusion,url --limit 1)
            COUNT=$(echo "$RUN_JSON" | jq 'length')

            if [ "$COUNT" -eq 0 ]; then
              echo "[$i/$ATTEMPTS] CI run not found yet for $TARGET_SHA"
              sleep "$SLEEP_SECONDS"
              continue
            fi

            STATUS=$(echo "$RUN_JSON" | jq -r '.[0].status')
            CONCLUSION=$(echo "$RUN_JSON" | jq -r '.[0].conclusion')
            URL=$(echo "$RUN_JSON" | jq -r '.[0].url')

            echo "[$i/$ATTEMPTS] CI status=$STATUS conclusion=$CONCLUSION"
            echo "CI run: $URL"

            if [ "$STATUS" != "completed" ]; then
              sleep "$SLEEP_SECONDS"
              continue
            fi

            if [ "$CONCLUSION" = "success" ]; then
              echo "✅ CI passed for $TARGET_SHA"
              exit 0
            fi

            echo "❌ CI did not pass for $TARGET_SHA (conclusion: $CONCLUSION)"
            exit 1
          done

          echo "❌ Timed out waiting for CI to complete for $TARGET_SHA"
          exit 1

      - name: Build App (Self-Signed)
        run: |
          # Build the app in Release mode (self-signed, no Developer account)
          # Disable code signing for CI - app will be ad-hoc signed
          xcodebuild \
            -scheme "${{ env.SCHEME }}" \
            -configuration "${{ env.CONFIGURATION }}" \
            -derivedDataPath DerivedData \
            CODE_SIGN_IDENTITY="" \
            CODE_SIGNING_REQUIRED=NO \
            CODE_SIGNING_ALLOWED=NO \
            build

          # Locate the built app
          APP_PATH="DerivedData/Build/Products/${{ env.CONFIGURATION }}/${{ env.APP_NAME }}.app"
          echo "App built at: $APP_PATH"
          echo "app_path=$APP_PATH" >> $GITHUB_ENV

          # Verify app exists
          if [ ! -d "$APP_PATH" ]; then
            echo "Error: App not found at $APP_PATH"
            find DerivedData -name "*.app" -type d
            exit 1
          fi

      - name: Re-sign App Bundle (Strict)
        run: |
          APP_PATH="${{ env.app_path }}"
          chmod +x ./scripts/sign-app-bundle.sh
          ./scripts/sign-app-bundle.sh "$APP_PATH" "-"

      - name: Read Bundle Versions
        run: |
          APP_PATH="${{ env.app_path }}"
          INFO_PLIST="${APP_PATH}/Contents/Info.plist"

          SHORT_VERSION=$(/usr/libexec/PlistBuddy -c "Print :CFBundleShortVersionString" "$INFO_PLIST")
          BUILD_VERSION=$(/usr/libexec/PlistBuddy -c "Print :CFBundleVersion" "$INFO_PLIST")

          echo "bundle_short_version=${SHORT_VERSION}" >> $GITHUB_ENV
          echo "bundle_build_version=${BUILD_VERSION}" >> $GITHUB_ENV

          if [ "$SHORT_VERSION" != "${{ steps.version.outputs.app_version }}" ]; then
            echo "❌ Bundle short version ($SHORT_VERSION) does not match release version (${{ steps.version.outputs.app_version }})"
            exit 1
          fi

          if ! [[ "$BUILD_VERSION" =~ ^[0-9]+$ ]]; then
            echo "❌ Bundle build version ($BUILD_VERSION) must be numeric"
            exit 1
          fi

          if [ "$BUILD_VERSION" -lt 1 ]; then
            echo "❌ Bundle build version ($BUILD_VERSION) must be >= 1"
            exit 1
          fi

          echo "✅ Bundle versions: short=${SHORT_VERSION}, build=${BUILD_VERSION}"

      - name: Create DMG
        id: dmg
        run: |
          APP_PATH="${{ env.app_path }}"
          VERSION="${{ steps.version.outputs.app_version }}"
          DMG_NAME="${{ env.APP_NAME }}-${VERSION}.dmg"
          DMG_PATH="dist/${DMG_NAME}"

          mkdir -p dist

          # Create the DMG (matches scripts/create-dmg-self-signed.sh)
          create-dmg \
            --volname "${{ env.APP_NAME }}" \
            --window-pos 200 120 \
            --window-size 600 400 \
            --icon-size 100 \
            --app-drop-link 450 185 \
            --icon "${{ env.APP_NAME }}.app" 150 185 \
            "${DMG_PATH}" \
            "${APP_PATH}"

          echo "DMG created at: ${DMG_PATH}"
          echo "dmg_path=${DMG_PATH}" >> $GITHUB_ENV
          echo "dmg_name=${DMG_NAME}" >> $GITHUB_ENV

      - name: Sign DMG with EdDSA
        env:
          SPARKLE_EDDSA_PRIVATE_KEY: ${{ secrets.SPARKLE_EDDSA_PRIVATE_KEY }}
        run: |
          if [ -z "$SPARKLE_EDDSA_PRIVATE_KEY" ]; then
            echo "⚠️  Warning: SPARKLE_EDDSA_PRIVATE_KEY secret is not set"
            echo "   Skipping EdDSA signing - updates will not be verifiable!"
            echo "   To enable signing, add your EdDSA private key to GitHub Secrets"
            echo "dmg_signature=" >> $GITHUB_ENV
            exit 0
          fi

          DMG_PATH="${{ env.dmg_path }}"

          # Sign the DMG using Sparkle's sign_update tool
          # The tool outputs: sparkle:edSignature="..." length="..."
          # We extract just the signature value
          SIGN_OUTPUT=$(echo "$SPARKLE_EDDSA_PRIVATE_KEY" | ./bin/sign_update "$DMG_PATH" -f -)
          SIGNATURE=$(echo "$SIGN_OUTPUT" | sed -n 's/.*sparkle:edSignature="\([^"]*\)".*/\1/p')

          echo "✅ DMG signed with EdDSA"
          echo "   Signature: ${SIGNATURE:0:20}..."
          echo "dmg_signature=${SIGNATURE}" >> $GITHUB_ENV

      - name: Generate Appcast
        run: |
          VERSION="${{ env.bundle_short_version }}"
          BUILD_VERSION="${{ env.bundle_build_version }}"
          FULL_VERSION="${{ steps.version.outputs.version }}"
          DMG_NAME="${{ env.dmg_name }}"
          DMG_PATH="${{ env.dmg_path }}"
          SIGNATURE="${{ env.dmg_signature }}"

          # Get DMG size
          DMG_SIZE=$(stat -f%z "$DMG_PATH")

          # Get current date in RFC 2822 format
          PUB_DATE=$(date -R)

          # Build signature attribute if present
          if [ -n "$SIGNATURE" ]; then
            SIG_ATTR="sparkle:edSignature=\"${SIGNATURE}\""
          else
            SIG_ATTR=""
          fi

          # Create the appcast.xml
          cat > dist/appcast.xml << APPCAST_EOF
          <?xml version="1.0" encoding="utf-8"?>
          <rss version="2.0" xmlns:sparkle="http://www.andymatuschak.org/xml-namespaces/sparkle" xmlns:dc="http://purl.org/dc/elements/1.1/">
            <channel>
              <title>${{ env.APP_NAME }} Changelog</title>
              <link>https://github.com/${{ github.repository }}/releases</link>
              <description>Most recent changes with links to updates.</description>
              <language>en</language>
              <item>
                <title>Version ${VERSION}</title>
                <pubDate>${PUB_DATE}</pubDate>
                <enclosure
                  url="https://github.com/${{ github.repository }}/releases/download/${FULL_VERSION}/${DMG_NAME}"
                  sparkle:version="${BUILD_VERSION}"
                  sparkle:shortVersionString="${VERSION}"
                  ${SIG_ATTR}
                  length="${DMG_SIZE}"
                  type="application/octet-stream"
                />
                <sparkle:minimumSystemVersion>14.0</sparkle:minimumSystemVersion>
              </item>
            </channel>
          </rss>
          APPCAST_EOF

          VERSION="$VERSION" BUILD_VERSION="$BUILD_VERSION" python3 - <<'PY'
          import os
          import sys
          import xml.etree.ElementTree as ET

          expected_short = os.environ["VERSION"]
          expected_build = os.environ["BUILD_VERSION"]

          root = ET.parse("dist/appcast.xml").getroot()
          channel = root.find("channel")
          if channel is None:
              print("❌ appcast.xml missing channel element")
              sys.exit(1)

          item = channel.find("item")
          if item is None:
              print("❌ appcast.xml missing item element")
              sys.exit(1)

          enclosure = item.find("enclosure")
          if enclosure is None:
              print("❌ appcast.xml missing enclosure element")
              sys.exit(1)

          sparkle_build = enclosure.attrib.get("{http://www.andymatuschak.org/xml-namespaces/sparkle}version")
          sparkle_short = enclosure.attrib.get("{http://www.andymatuschak.org/xml-namespaces/sparkle}shortVersionString")

          if sparkle_build != expected_build:
              print(f"❌ appcast sparkle:version ({sparkle_build}) != bundle build ({expected_build})")
              sys.exit(1)

          if sparkle_short != expected_short:
              print(f"❌ appcast sparkle:shortVersionString ({sparkle_short}) != bundle short version ({expected_short})")
              sys.exit(1)

          print(f"✅ appcast versions verified: short={sparkle_short}, build={sparkle_build}")
          PY

          echo "✅ Appcast generated at: dist/appcast.xml"
          cat dist/appcast.xml

      - name: Create GitHub Release
        id: create_release
        uses: softprops/action-gh-release@v1
        with:
          tag_name: ${{ steps.version.outputs.version }}
          name: "${{ env.APP_NAME }} ${{ steps.version.outputs.app_version }}"
          draft: false
          prerelease: false
          make_latest: true
          files: |
            ${{ env.dmg_path }}
            dist/appcast.xml
          body: |
            ## ${{ env.APP_NAME }} ${{ steps.version.outputs.app_version }}
            
            ### Installation
            1. Download `${{ env.dmg_name }}`
            2. Open the DMG and drag ${{ env.APP_NAME }} to your Applications folder
            3. Launch from Applications
            
            ### First Launch (Gatekeeper)
            Since this is a self-signed build:
            1. Right-click the app and select Open
            2. If blocked: System Settings → Privacy & Security → Open Anyway
            
            ### Notes
            - macOS 14.0+ required
            - Apple Silicon optimized (Universal binary)
            - Self-signed (no Apple Developer account)
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

      - name: Summary
        run: |
          SIGNED="No (secret not configured)"
          if [ -n "${{ env.dmg_signature }}" ]; then
            SIGNED="Yes"
          fi
          
          echo "## Release Build Complete" >> $GITHUB_STEP_SUMMARY
          echo "" >> $GITHUB_STEP_SUMMARY
          echo "- **Version:** ${{ steps.version.outputs.version }}" >> $GITHUB_STEP_SUMMARY
          echo "- **Build:** ${{ env.bundle_build_version }}" >> $GITHUB_STEP_SUMMARY
          echo "- **DMG:** ${{ env.dmg_name }}" >> $GITHUB_STEP_SUMMARY
          echo "- **EdDSA Signed:** ${SIGNED}" >> $GITHUB_STEP_SUMMARY
          echo "- **Release:** Published automatically as latest" >> $GITHUB_STEP_SUMMARY
          echo "" >> $GITHUB_STEP_SUMMARY
          echo "### Next Steps" >> $GITHUB_STEP_SUMMARY
          echo "1. Review the published release on GitHub" >> $GITHUB_STEP_SUMMARY
          echo "2. Update release notes if needed" >> $GITHUB_STEP_SUMMARY
          echo "3. No appcast commit is required; Sparkle uses releases/latest/download/appcast.xml" >> $GITHUB_STEP_SUMMARY