release.yml

name: Release

on:
  push:
    tags:
      - "v*"
  workflow_dispatch:
    inputs:
      version:
        description: "Version number (e.g. 0.1.0)"
        required: false
        default: "0.0.0-dev"

concurrency:
  group: release-${{ github.ref }}
  cancel-in-progress: true

permissions:
  contents: write

jobs:
  build:
    runs-on: macos-26
    environment: Prod
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Install create-dmg
        run: brew install create-dmg

      - name: Install Tuist via mise
        uses: jdx/mise-action@v2
        with:
          install: true

      - name: Import signing certificate
        uses: apple-actions/import-codesign-certs@v3
        with:
          p12-file-base64: ${{ secrets.SIGNING_CERTIFICATE_P12 }}
          p12-password: ${{ secrets.SIGNING_CERTIFICATE_PASSWORD }}

      - name: Write Signing.xcconfig
        run: |
          cat > Configurations/Signing.xcconfig << EOF
          MOEPEEK_CODE_SIGN_STYLE = Manual
          MOEPEEK_CODE_SIGN_IDENTITY = ${{ secrets.SIGNING_IDENTITY }}
          MOEPEEK_DEVELOPMENT_TEAM = ${{ secrets.DEVELOPMENT_TEAM }}
          SPARKLE_ED_PUBLIC_KEY = ${{ secrets.SPARKLE_ED_PUBLIC_KEY }}
          EOF

      - name: Resolve dependencies and generate project
        run: tuist install && tuist generate

      - name: Determine version
        id: version
        run: |
          if [[ "${{ github.ref_type }}" == "tag" ]]; then
            VERSION="${{ github.ref_name }}"
            VERSION="${VERSION#v}"
          else
            VERSION="${{ github.event.inputs.version || '0.0.0-dev' }}"
          fi
          echo "version=$VERSION" >> "$GITHUB_OUTPUT"

      - name: Archive
        run: |
          xcodebuild archive \
            -workspace MoePeek.xcworkspace \
            -scheme MoePeek \
            -configuration Release \
            -archivePath build/MoePeek.xcarchive \
            VALIDATE_STRINGS_FILES_WHILE_COPYING=NO \
            MARKETING_VERSION=${{ steps.version.outputs.version }} \
            CURRENT_PROJECT_VERSION=${{ github.run_number }}

      - name: Verify code signature
        run: |
          APP="build/MoePeek.xcarchive/Products/Applications/MoePeek.app"
          codesign --verify --strict "$APP"

          SIGN_INFO=$(codesign -dvvv "$APP" 2>&1)
          echo "$SIGN_INFO" | grep -E "Authority|Identifier|TeamIdentifier"

          if echo "$SIGN_INFO" | grep -q "TeamIdentifier=not set"; then
            echo "::error::Code signature has no TeamIdentifier (ad-hoc signing). Check SIGNING_IDENTITY and SIGNING_CERTIFICATE secrets."
            exit 1
          fi

      - name: Prepare app bundle
        run: |
          mkdir -p build/app
          cp -R build/MoePeek.xcarchive/Products/Applications/MoePeek.app build/app/

      - name: Create ZIP
        run: |
          ditto -c -k --sequesterRsrc --keepParent build/app/MoePeek.app \
            "MoePeek-v${{ steps.version.outputs.version }}-macOS.zip"

      - name: Package PopClip Extension
        run: |
          ditto -c -k --sequesterRsrc --keepParent \
            PopClipExtension/MoePeek.popclipext \
            "MoePeek.popclipext.zip"

      - name: Check Sparkle signing key
        id: sparkle
        run: |
          if [ -n "$SPARKLE_KEY" ]; then
            echo "has_key=true" >> "$GITHUB_OUTPUT"
          fi
        env:
          SPARKLE_KEY: ${{ secrets.SPARKLE_ED_PRIVATE_KEY }}

      - name: Download Sparkle CLI tools
        if: steps.sparkle.outputs.has_key == 'true'
        run: |
          SPARKLE_VERSION=$(python3 -c "import json; pins=json.load(open('Package.resolved'))['pins']; print(next(p['state']['version'] for p in pins if p['identity']=='sparkle'))")
          echo "Using Sparkle CLI v${SPARKLE_VERSION} (from Package.resolved)"
          mkdir -p /tmp/sparkle
          curl -sL "https://github.com/sparkle-project/Sparkle/releases/download/${SPARKLE_VERSION}/Sparkle-${SPARKLE_VERSION}.tar.xz" | tar xJ -C /tmp/sparkle

      - name: Create DMG
        run: |
          create-dmg \
            --volname "MoePeek" \
            --window-pos 200 120 \
            --window-size 660 400 \
            --icon-size 160 \
            --icon "MoePeek.app" 180 170 \
            --app-drop-link 480 170 \
            --hide-extension "MoePeek.app" \
            "MoePeek-v${{ steps.version.outputs.version }}-macOS.dmg" \
            build/app/ \
            || test $? -eq 1

      - name: Generate appcast
        if: steps.sparkle.outputs.has_key == 'true'
        env:
          SPARKLE_ED_PRIVATE_KEY: ${{ secrets.SPARKLE_ED_PRIVATE_KEY }}
        run: |
          mkdir -p build/release
          cp "MoePeek-v${{ steps.version.outputs.version }}-macOS.zip" build/release/

          # Download existing appcast to preserve history (skip if first release or invalid)
          curl -sfL "https://github.com/cosZone/MoePeek/releases/latest/download/appcast.xml" \
            -o appcast.xml || rm -f appcast.xml

          DOWNLOAD_URL="https://github.com/cosZone/MoePeek/releases/download/v${{ steps.version.outputs.version }}"
          /tmp/sparkle/bin/generate_appcast \
            --ed-key-file <(echo "$SPARKLE_ED_PRIVATE_KEY") \
            --download-url-prefix "$DOWNLOAD_URL/" \
            -o appcast.xml \
            build/release/

      - name: Create GitHub Release
        uses: softprops/action-gh-release@v2
        with:
          tag_name: v${{ steps.version.outputs.version }}
          name: v${{ steps.version.outputs.version }}
          draft: ${{ github.event_name == 'workflow_dispatch' }}
          generate_release_notes: true
          files: |
            MoePeek-v${{ steps.version.outputs.version }}-macOS.zip
            MoePeek-v${{ steps.version.outputs.version }}-macOS.dmg
            MoePeek.popclipext.zip
            appcast.xml