release.yml

name: Release Artifacts

permissions:
  contents: write

on:
  push:
    branches:
      - main
    tags:
      - "v*"
  workflow_dispatch:
    inputs:
      require_signed_package:
        description: "Require a signed package"
        required: false
        default: "false"

jobs:
  build-release-artifacts:
    runs-on: macos-latest
    env:
      CI_REQUIRE_SIGNED_PACKAGE: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.require_signed_package == 'true' && '1' || '0' }}
    steps:
      - name: Check out repository
        uses: actions/checkout@v4

      - name: Build release package
        run: make package

      - name: Validate package
        run: |
          PKG_PATH="$(ls -1t dist/DevStackMenu-*.pkg 2>/dev/null | head -n 1)"
          if [ "${CI_REQUIRE_SIGNED_PACKAGE}" = "1" ]; then
            ./Scripts/verify-package.sh "$PKG_PATH" 1
          else
            ./Scripts/verify-package.sh "$PKG_PATH" 0
          fi

      - name: Sign and optional notarize package
        env:
          CODESIGN_INSTALLER_IDENTITY: ${{ secrets.CODESIGN_INSTALLER_IDENTITY }}
          MACOS_INSTALLER_CERT_P12_BASE64: ${{ secrets.MACOS_INSTALLER_CERT_P12_BASE64 }}
          MACOS_INSTALLER_CERT_PASSWORD: ${{ secrets.MACOS_INSTALLER_CERT_PASSWORD }}
          NOTARYTOOL_KEY_ID: ${{ secrets.NOTARYTOOL_KEY_ID }}
          NOTARYTOOL_ISSUER_ID: ${{ secrets.NOTARYTOOL_ISSUER_ID }}
          NOTARYTOOL_KEY_P8_BASE64: ${{ secrets.NOTARYTOOL_KEY_P8_BASE64 }}
        run: |
          PKG_PATH="$(ls -1t dist/DevStackMenu-*.pkg 2>/dev/null | head -n 1)"
          if [ -n "${CODESIGN_INSTALLER_IDENTITY}" ] && [ -n "${MACOS_INSTALLER_CERT_P12_BASE64}" ]; then
            if [ -n "${NOTARYTOOL_KEY_ID}" ] && [ -n "${NOTARYTOOL_ISSUER_ID}" ] && [ -n "${NOTARYTOOL_KEY_P8_BASE64}" ]; then
              export REQUIRE_NOTARIZE=1
            else
              export REQUIRE_NOTARIZE=0
            fi
            ./Scripts/sign-notarize-package.sh "$PKG_PATH"
          else
            if [ "${CI_REQUIRE_SIGNED_PACKAGE}" = "1" ]; then
              echo "Signing requested but secrets are not configured." >&2
              exit 1
            fi
            echo "Signing secrets are not configured; skipping signing."
          fi

      - name: Re-check package
        run: |
          PKG_PATH="$(ls -1t dist/DevStackMenu-*.pkg 2>/dev/null | head -n 1)"
          ./Scripts/verify-package.sh "$PKG_PATH" "$CI_REQUIRE_SIGNED_PACKAGE"

      - name: Publish package to GitHub release
        if: github.ref_type == 'tag'
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          PKG_PATH="$(ls -1t dist/DevStackMenu-*.pkg 2>/dev/null | head -n 1)"
          if gh release view "${{ github.ref_name }}" --repo "${GITHUB_REPOSITORY}" >/dev/null 2>&1; then
            gh release upload "${{ github.ref_name }}" "$PKG_PATH" --repo "${GITHUB_REPOSITORY}" --clobber
          else
            gh release create "${{ github.ref_name }}" "$PKG_PATH" --repo "${GITHUB_REPOSITORY}" --title "${{ github.ref_name }}" --notes "Release ${GITHUB_REF_NAME}"
          fi

      - name: Upload installer package
        uses: actions/upload-artifact@v4
        with:
          name: devstackmenu-package
          path: dist/*.pkg