build-binaries.yml

name: Build Binaries

on:
  workflow_call:
    inputs:
      version:
        description: "Version string to embed"
        required: true
        type: string
      commit_sha:
        description: "Commit SHA to embed"
        required: true
        type: string
      build_date:
        description: "Build date to embed"
        required: true
        type: string
    secrets:
      DEVELOPER_ID_P12_BASE64:
        description: "Base64-encoded Developer ID certificate"
        required: true
      DEVELOPER_ID_PASSWORD:
        description: "Password for the Developer ID certificate"
        required: true
      APPLE_NOTARIZATION_APPLE_ID_PASSWORD:
        description: "App-specific password for Apple ID notarization"
        required: true

jobs:
  build:
    name: Build ${{ matrix.platform }}
    runs-on: ubuntu-latest
    timeout-minutes: 10
    strategy:
      matrix:
        include:
          - platform: linux-amd64
            goos: linux
            goarch: amd64
          - platform: linux-arm64
            goos: linux
            goarch: arm64
          - platform: darwin-amd64
            goos: darwin
            goarch: amd64
          - platform: darwin-arm64
            goos: darwin
            goarch: arm64
          - platform: windows-amd64
            goos: windows
            goarch: amd64
    steps:
      - name: Checkout
        uses: actions/checkout@v5
        with:
          persist-credentials: false

      - name: Set up Go
        uses: actions/setup-go@v6
        with:
          go-version-file: go.mod
          cache: true
          check-latest: false

      - name: Build CLI
        run: |
          BINARY="github-actions-utils-cli-${{ matrix.platform }}"
          if [ "${{ matrix.goos }}" = "windows" ]; then
            BINARY="${BINARY}.exe"
          fi

          # Build static binary (no CGO, static linking)
          CGO_ENABLED=0 GOOS=${{ matrix.goos }} GOARCH=${{ matrix.goarch }} go build \
            -ldflags "-s -w -extldflags '-static' \
                      -X github.com/techprimate/github-actions-utils-cli/internal/cli/cmd.version=${{ inputs.version }} \
                      -X github.com/techprimate/github-actions-utils-cli/internal/cli/cmd.commit=${{ inputs.commit_sha }} \
                      -X github.com/techprimate/github-actions-utils-cli/internal/cli/cmd.date=${{ inputs.build_date }}" \
            -o "dist/${BINARY}" \
            ./cmd/cli

      - name: Upload artifact
        uses: actions/upload-artifact@v5
        with:
          name: cli-${{ matrix.platform }}
          path: dist/github-actions-utils-cli-*
          retention-days: 1

  sign-and-notarize-macos:
    name: Sign and Notarize macOS Binaries
    needs: build
    runs-on: macos-latest
    timeout-minutes: 20
    steps:
      - name: Download Darwin CLI artifacts
        uses: actions/download-artifact@v6
        with:
          path: dist
          pattern: cli-darwin-*
          merge-multiple: true

      - name: Setup signing certificate
        env:
          CERTIFICATE_BASE64: ${{ secrets.DEVELOPER_ID_P12_BASE64 }}
          CERTIFICATE_PASSWORD: ${{ secrets.DEVELOPER_ID_PASSWORD }}
        run: |
          # Create temporary keychain
          KEYCHAIN_NAME="github-actions-utils-signing.keychain-db"
          KEYCHAIN_PASSWORD=$(openssl rand -hex 32)

          # Delete any existing keychain with the same name
          security delete-keychain "$KEYCHAIN_NAME" 2>/dev/null || true

          # Create and setup keychain
          security create-keychain -p "$KEYCHAIN_PASSWORD" "$KEYCHAIN_NAME"
          security set-keychain-settings -lut 21600 "$KEYCHAIN_NAME"
          security unlock-keychain -p "$KEYCHAIN_PASSWORD" "$KEYCHAIN_NAME"

          # Import certificate
          CERTIFICATE_PATH=$RUNNER_TEMP/certificate.p12
          echo "$CERTIFICATE_BASE64" | base64 --decode -o "$CERTIFICATE_PATH"
          security import "$CERTIFICATE_PATH" -k "$KEYCHAIN_NAME" -P "$CERTIFICATE_PASSWORD" -T /usr/bin/codesign -T /usr/bin/security

          # Make keychain available for codesign
          security list-keychains -d user -s "$KEYCHAIN_NAME" $(security list-keychains -d user | sed s/\"//g)
          security set-key-partition-list -S apple-tool:,apple:,codesign: -s -k "$KEYCHAIN_PASSWORD" "$KEYCHAIN_NAME"
          security default-keychain -s "$KEYCHAIN_NAME"

          # Clean up certificate file
          rm -f "$CERTIFICATE_PATH"

          # Store keychain info for cleanup
          echo "KEYCHAIN_NAME=$KEYCHAIN_NAME" >> $GITHUB_ENV
          echo "KEYCHAIN_PASSWORD=$KEYCHAIN_PASSWORD" >> $GITHUB_ENV

      - name: Sign and notarize CLI darwin-amd64
        env:
          APPLE_ID: ${{ vars.APPLE_NOTARIZATION_APPLE_ID_USERNAME }}
          APPLE_ID_PASSWORD: ${{ secrets.APPLE_NOTARIZATION_APPLE_ID_PASSWORD }}
          APPLE_TEAM_ID: ${{ vars.APPLE_NOTARIZATION_TEAM_ID }}
          SIGNING_IDENTITY: ${{ vars.APPLE_NOTARIZATION_SIGNING_IDENTITY }}
        run: |
          cd dist

          # Sign the binary
          codesign --sign "$SIGNING_IDENTITY" \
                   --options runtime \
                   --timestamp \
                   --force \
                   --verbose \
                   github-actions-utils-cli-darwin-amd64

          # Verify signature
          codesign --verify --verbose github-actions-utils-cli-darwin-amd64

          # Create zip and submit for notarization
          zip -q github-actions-utils-cli-darwin-amd64.zip github-actions-utils-cli-darwin-amd64
          xcrun notarytool submit github-actions-utils-cli-darwin-amd64.zip \
                       --apple-id "$APPLE_ID" \
                       --password "$APPLE_ID_PASSWORD" \
                       --team-id "$APPLE_TEAM_ID" \
                       --wait
          rm github-actions-utils-cli-darwin-amd64.zip

      - name: Sign and notarize CLI darwin-arm64
        env:
          APPLE_ID: ${{ vars.APPLE_NOTARIZATION_APPLE_ID_USERNAME }}
          APPLE_ID_PASSWORD: ${{ secrets.APPLE_NOTARIZATION_APPLE_ID_PASSWORD }}
          APPLE_TEAM_ID: ${{ vars.APPLE_NOTARIZATION_TEAM_ID }}
          SIGNING_IDENTITY: ${{ vars.APPLE_NOTARIZATION_SIGNING_IDENTITY }}
        run: |
          cd dist

          # Sign the binary
          codesign --sign "$SIGNING_IDENTITY" \
                   --options runtime \
                   --timestamp \
                   --force \
                   --verbose \
                   github-actions-utils-cli-darwin-arm64

          # Verify signature
          codesign --verify --verbose github-actions-utils-cli-darwin-arm64

          # Create zip and submit for notarization
          zip -q github-actions-utils-cli-darwin-arm64.zip github-actions-utils-cli-darwin-arm64
          xcrun notarytool submit github-actions-utils-cli-darwin-arm64.zip \
                       --apple-id "$APPLE_ID" \
                       --password "$APPLE_ID_PASSWORD" \
                       --team-id "$APPLE_TEAM_ID" \
                       --wait
          rm github-actions-utils-cli-darwin-arm64.zip

      - name: Cleanup keychain
        if: always()
        run: |
          if [ -n "$KEYCHAIN_NAME" ]; then
            security delete-keychain "$KEYCHAIN_NAME" || true
          fi

      - name: Upload signed CLI darwin-amd64
        uses: actions/upload-artifact@v5
        with:
          name: cli-darwin-amd64
          path: dist/github-actions-utils-cli-darwin-amd64
          retention-days: 1
          overwrite: true

      - name: Upload signed CLI darwin-arm64
        uses: actions/upload-artifact@v5
        with:
          name: cli-darwin-arm64
          path: dist/github-actions-utils-cli-darwin-arm64
          retention-days: 1
          overwrite: true