release.yml

---
name: Release

on:
  push:
    tags:
      - "v*"
  workflow_dispatch:
    inputs:
      version:
        description: "Release version without the leading v, for example 0.1.0"
        required: true
        type: string

permissions:
  contents: write

concurrency:
  group: release-${{ github.ref }}
  cancel-in-progress: false

jobs:
  dmg-and-homebrew:
    name: Build DMG and update Homebrew tap
    runs-on: macos-26

    env:
      TRIMCONTROL_SIGN_IDENTITY: ${{ vars.TRIMCONTROL_SIGN_IDENTITY }}
      TRIMCONTROL_REQUIRE_SIGN_IDENTITY: "1"
      HOMEBREW_TAP_REPOSITORY: ${{ vars.HOMEBREW_TAP_REPOSITORY }}

    steps:
      - name: Check out source
        uses: actions/checkout@v6
        with:
          fetch-depth: 0

      - name: Resolve release version
        run: |
          set -euo pipefail

          if [[ "${GITHUB_REF_TYPE}" == "tag" ]]; then
            tag="${GITHUB_REF_NAME}"
            version="${tag#v}"
          else
            version="${{ inputs.version }}"
            tag="v${version#v}"
            version="${version#v}"
          fi

          if [[ -z "$version" || "$version" == "$tag" ]]; then
            echo "Could not resolve release version from $tag" >&2
            exit 1
          fi

          if [[ ! "$version" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
            echo "Release version must be stable semantic version like 0.1.0." >&2
            exit 1
          fi

          if [[ "$tag" != "v$version" ]]; then
            echo "Release tag must be v$version." >&2
            exit 1
          fi

          echo "VERSION=$version" >> "$GITHUB_ENV"
          echo "TAG=$tag" >> "$GITHUB_ENV"
          echo "TRIMCONTROL_VERSION=$version" >> "$GITHUB_ENV"
          echo "TRIMCONTROL_BUILD_NUMBER=${GITHUB_RUN_NUMBER}" >> "$GITHUB_ENV"

      - name: Import Developer ID certificate
        env:
          APPLE_CERTIFICATE_P12: ${{ secrets.APPLE_CERTIFICATE_P12 }}
          APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
        run: script/import_codesign_certificate.sh

      - name: Test
        run: swift test

      - name: Build signed DMG
        run: script/package_dmg.sh --version "$VERSION" --arch arm64

      - name: Prepare App Store Connect key
        env:
          APP_STORE_CONNECT_PRIVATE_KEY: ${{ secrets.APP_STORE_CONNECT_PRIVATE_KEY }}
          APP_STORE_CONNECT_KEY_ID: ${{ secrets.APP_STORE_CONNECT_KEY_ID }}
        run: |
          set -euo pipefail
          : "${APP_STORE_CONNECT_PRIVATE_KEY:?Set APP_STORE_CONNECT_PRIVATE_KEY secret.}"
          : "${APP_STORE_CONNECT_KEY_ID:?Set APP_STORE_CONNECT_KEY_ID secret.}"

          key_path="$RUNNER_TEMP/AuthKey_${APP_STORE_CONNECT_KEY_ID}.p8"
          printf '%s' "$APP_STORE_CONNECT_PRIVATE_KEY" > "$key_path"
          chmod 600 "$key_path"
          echo "APP_STORE_CONNECT_KEY_PATH=$key_path" >> "$GITHUB_ENV"

      - name: Notarize DMG
        env:
          APP_STORE_CONNECT_KEY_ID: ${{ secrets.APP_STORE_CONNECT_KEY_ID }}
          APP_STORE_CONNECT_ISSUER_ID: ${{ secrets.APP_STORE_CONNECT_ISSUER_ID }}
        run: script/notarize_dmg.sh "dist/release/TrimControl-$VERSION-arm64.dmg"

      - name: Publish GitHub release
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          set -euo pipefail

          dmg="dist/release/TrimControl-$VERSION-arm64.dmg"
          sha_file="$dmg.sha256"

          if git rev-parse -q --verify "refs/tags/$TAG" >/dev/null; then
            target_args=(--verify-tag)
          else
            target_args=(--target "$GITHUB_SHA")
          fi

          gh release create "$TAG" \
            "$dmg#TrimControl $VERSION arm64 DMG" \
            "$sha_file#TrimControl $VERSION arm64 SHA-256" \
            --title "TrimControl $VERSION" \
            --generate-notes \
            "${target_args[@]}"

      - name: Update Homebrew tap
        env:
          HOMEBREW_TAP_TOKEN: ${{ secrets.HOMEBREW_TAP_TOKEN }}
        run: |
          set -euo pipefail

          : "${HOMEBREW_TAP_TOKEN:?Set HOMEBREW_TAP_TOKEN with push access to the tap repo.}"

          tap_repo="${HOMEBREW_TAP_REPOSITORY:-subdepthtech/homebrew-trimcontrol}"
          tap_path="$RUNNER_TEMP/homebrew-tap"
          dmg="dist/release/TrimControl-$VERSION-arm64.dmg"
          sha256="$(shasum --algorithm 256 "$dmg" | awk '{print $1}')"
          download_url="https://github.com/${GITHUB_REPOSITORY}/releases/download/${TAG}/TrimControl-${VERSION}-arm64.dmg"

          GH_TOKEN="$HOMEBREW_TAP_TOKEN" gh repo view "$tap_repo" --json nameWithOwner >/dev/null

          auth_header="$(printf 'x-access-token:%s' "$HOMEBREW_TAP_TOKEN" | base64 | tr -d '\n')"
          git -c "http.https://github.com/.extraheader=AUTHORIZATION: basic ${auth_header}" \
            clone "https://github.com/${tap_repo}.git" "$tap_path"
          git -C "$tap_path" config \
            http.https://github.com/.extraheader \
            "AUTHORIZATION: basic ${auth_header}"

          TAP_PATH="$tap_path" \
            VERSION="$VERSION" \
            SHA256="$sha256" \
            DOWNLOAD_URL="$download_url" \
            script/update_homebrew_cask.sh

          brew style "$tap_path/Casks/trimcontrol.rb"

          git -C "$tap_path" config user.name "github-actions[bot]"
          git -C "$tap_path" config user.email "41898282+github-actions[bot]@users.noreply.github.com"
          git -C "$tap_path" add Casks/trimcontrol.rb

          if git -C "$tap_path" diff --cached --quiet; then
            echo "Homebrew cask already up to date."
            exit 0
          fi

          git -C "$tap_path" commit -m "trimcontrol: update to $VERSION"
          git -C "$tap_path" push

      - name: Clean up signing material
        if: always()
        run: |
          set -euo pipefail

          if [[ -n "${APP_STORE_CONNECT_KEY_PATH:-}" ]]; then
            rm -f "$APP_STORE_CONNECT_KEY_PATH"
          fi

          if [[ -n "${TRIMCONTROL_SIGNING_KEYCHAIN_PATH:-}" ]]; then
            security delete-keychain "$TRIMCONTROL_SIGNING_KEYCHAIN_PATH" >/dev/null 2>&1 || true
            rm -f "$TRIMCONTROL_SIGNING_KEYCHAIN_PATH"
          fi