stable-macos.yml

name: stable-macos

permissions:
  contents: write

on:
  workflow_dispatch:
    inputs:
      force_version:
        type: boolean
        description: Force update version
      generate_assets:
        type: boolean
        description: Generate assets (creates downloadable artifacts when not deploying)
      checkout_pr:
        type: string
        description: Checkout PR
      cortexide_commit:
        type: string
        description: Checkout specific CortexIDE commit
      cortexide_release:
        type: string
        description: Custom release number
  repository_dispatch:
    types: [stable]
  push:
    branches: [ master ]
    paths-ignore:
    - '**/*.md'
    - 'upstream/*.json'
  pull_request:
    branches: [ master ]
    paths-ignore:
    - '**/*.md'

env:
  APP_NAME: CortexIDE
  # ASSETS_REPOSITORY is where all the downloads are.
  # VSCodium has this be the current repo, but we use a separate binaries repo:
  # ASSETS_REPOSITORY: ${{ github.repository }}

  ASSETS_REPOSITORY: ${{ github.repository_owner }}/cortexide-binaries
  BINARY_NAME: cortexide
  GH_REPO_PATH: ${{ github.repository_owner }}/cortexide-binaries
  ORG_NAME: ${{ github.repository_owner }}
  OS_NAME: osx
  VERSIONS_REPOSITORY: ${{ github.repository_owner }}/cortexide-versions
  VSCODE_QUALITY: stable

jobs:
  build:
    runs-on: ${{ matrix.runner }}
    env:
      VSCODE_ARCH: ${{ matrix.vscode_arch }}
    strategy:
      fail-fast: false
      matrix:
        include:
          - runner: macos-14
            vscode_arch: x64
          - runner: macos-14
            vscode_arch: arm64

    steps:
      - uses: actions/checkout@v4
        with:
          ref: ${{ env.GITHUB_BRANCH }}

      - name: Switch to relevant branch
        env:
          PULL_REQUEST_ID: ${{ github.event.inputs.checkout_pr }}
        run: . get_pr.sh

      - name: Setup Node.js environment
        uses: actions/setup-node@v4
        with:
          node-version: '22.15.1'

      - name: Setup Python 3
        uses: actions/setup-python@v5
        with:
          python-version: '3.11'
        if: env.VSCODE_ARCH == 'x64'

      - name: Setup Rust
        uses: dtolnay/rust-toolchain@stable
        with:
          targets: ${{ matrix.vscode_arch == 'x64' && 'x86_64-apple-darwin' || 'aarch64-apple-darwin' }}

      - name: Clone CortexIDE repo
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          CORTEXIDE_COMMIT: ${{ github.event.inputs.cortexide_commit }}
          CORTEXIDE_RELEASE: ${{ github.event.inputs.cortexide_release }}
        run: . get_repo.sh

      - name: Check PR or cron
        env:
          GENERATE_ASSETS: ${{ github.event.inputs.generate_assets }}
        run: . check_cron_or_pr.sh

      - name: Check existing VSCodium tags/releases
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: . check_tags.sh
        if: env.SHOULD_DEPLOY == 'yes'

      - name: Build
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          CARGO_NET_GIT_FETCH_WITH_CLI: "true"
          NODE_OPTIONS: "--max-old-space-size=12288"
        run: |
          echo "Building CortexIDE for macOS ${VSCODE_ARCH}..."
          echo "This will compile TypeScript, build React components, and package the application"
          ./build.sh
        if: env.SHOULD_BUILD == 'yes'

      - name: Prepare assets
        env:
          CERTIFICATE_OSX_APP_PASSWORD: ${{ secrets.CERTIFICATE_OSX_APP_PASSWORD }}
          CERTIFICATE_OSX_ID: ${{ secrets.CERTIFICATE_OSX_ID }}
          CERTIFICATE_OSX_P12_DATA: ${{ secrets.CERTIFICATE_OSX_P12_DATA }}
          CERTIFICATE_OSX_P12_PASSWORD: ${{ secrets.CERTIFICATE_OSX_P12_PASSWORD }}
          CERTIFICATE_OSX_TEAM_ID: ${{ secrets.CERTIFICATE_OSX_TEAM_ID }}
        run: ./prepare_assets.sh
        if: env.SHOULD_BUILD == 'yes' && (env.SHOULD_DEPLOY == 'yes' || github.event.inputs.generate_assets == 'true')

      - name: Release
        env:
          GITHUB_TOKEN: ${{ secrets.RELEASE_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
        run: ./release.sh
        if: env.SHOULD_BUILD == 'yes' && env.SHOULD_DEPLOY == 'yes'

      - name: Update versions repo
        env:
          FORCE_UPDATE: ${{ github.event.inputs.force_version }}
          GITHUB_TOKEN: ${{ secrets.RELEASE_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
          GITHUB_USERNAME: ${{ github.repository_owner }}
        run: ./update_version.sh
        if: env.SHOULD_DEPLOY == 'yes'

      - name: Upload assets
        uses: actions/upload-artifact@v4
        with:
          name: bin-${{ matrix.vscode_arch }}
          path: assets/
          retention-days: 7
        if: env.SHOULD_BUILD == 'yes' && (env.SHOULD_DEPLOY == 'no' && github.event.inputs.generate_assets == 'true')

      - name: Clean up keychain
        if: always()
        run: |
          KEYCHAIN=$RUNNER_TEMP/build.keychain

          if [ -f "$KEYCHAIN" ];
          then
            security delete-keychain $KEYCHAIN
          fi