release.yml

name: Release

on:
  workflow_dispatch:
    inputs:
      version_bump:
        description: Version bump type
        required: true
        default: patch
        type: choice
        options:
          - patch
          - minor
          - major
  push:
    tags:
      - 'v*'

concurrency:
  group: release
  cancel-in-progress: false

permissions: {}

env:
  XCODE_PROJECT: "BrowserClutch.xcodeproj"
  XCODE_SCHEME: "BrowserClutch"
  APP_NAME: "BrowserClutch"

jobs:
  checks:
    name: Checks
    runs-on: macos-15
    permissions:
      contents: read
    steps:
      - name: Checkout
        uses: actions/checkout@v6

      - name: Lint
        run: |
          brew install swiftlint
          swiftlint --strict

      - name: Test
        run: |
          xcodebuild test \
            -project BrowserClutch.xcodeproj \
            -scheme BrowserClutch \
            -destination 'platform=macOS'

  create-tag:
    name: Create Tag
    needs: checks
    if: github.event_name == 'workflow_dispatch'
    runs-on: ubuntu-latest
    environment: release
    permissions:
      contents: write
    outputs:
      version: ${{ steps.bump.outputs.version }}
      tag: ${{ steps.bump.outputs.tag }}
    steps:
      - name: Checkout
        uses: actions/checkout@v6
        with:
          fetch-depth: 0

      - name: Verify main branch
        run: |
          if [ "${{ github.ref }}" != "refs/heads/main" ]; then
            echo "::error::Release must be run from main branch, not ${{ github.ref }}"
            exit 1
          fi

      - name: Read current version and bump
        id: bump
        run: |
          CURRENT=$(git describe --tags --abbrev=0 2>/dev/null | sed 's/^v//' || echo "0.0.0")
          echo "Current version: $CURRENT"
          IFS='.' read -r MAJOR MINOR PATCH <<< "$CURRENT"

          case "${{ inputs.version_bump }}" in
            major)
              MAJOR=$((MAJOR + 1))
              MINOR=0
              PATCH=0
              ;;
            minor)
              MINOR=$((MINOR + 1))
              PATCH=0
              ;;
            patch)
              PATCH=$((PATCH + 1))
              ;;
          esac

          NEW_VERSION="$MAJOR.$MINOR.$PATCH"
          echo "version=$NEW_VERSION" >> $GITHUB_OUTPUT
          echo "tag=v$NEW_VERSION" >> $GITHUB_OUTPUT
          echo "New version: $NEW_VERSION"

      - name: Create and push tag
        run: |
          git config user.name "github-actions[bot]"
          git config user.email "github-actions[bot]@users.noreply.github.com"
          git tag -a "${{ steps.bump.outputs.tag }}" -m "Release ${{ steps.bump.outputs.tag }}"
          git push origin "${{ steps.bump.outputs.tag }}"

  build-and-release:
    name: Build, Sign & Release
    needs: [checks, create-tag]
    if: always() && needs.checks.result == 'success' && (needs.create-tag.result == 'success' || needs.create-tag.result == 'skipped')
    runs-on: macos-15
    environment: release
    permissions:
      contents: write
    env:
      RELEASE_TAG: ${{ needs.create-tag.outputs.tag || github.ref_name }}
    steps:
      - name: Checkout
        uses: actions/checkout@v6
        with:
          ref: ${{ env.RELEASE_TAG }}
          fetch-depth: 0
          token: ${{ secrets.GITHUB_TOKEN }}

      - name: Get version from tag
        id: version
        run: |
          VERSION=${RELEASE_TAG#v}
          echo "version=$VERSION" >> $GITHUB_OUTPUT
          echo "Version: $VERSION"

          IFS='.' read -r MAJOR MINOR PATCH <<< "$VERSION"
          BUILD=$((MAJOR * 10000 + MINOR * 100 + PATCH))

          /usr/libexec/PlistBuddy -c "Set :CFBundleShortVersionString $VERSION" BrowserClutch/Info.plist
          /usr/libexec/PlistBuddy -c "Set :CFBundleVersion $BUILD" BrowserClutch/Info.plist

      - name: Get previous tag
        id: prev_tag
        run: |
          PREV_TAG=$(git describe --tags --abbrev=0 HEAD^ 2>/dev/null || echo "")
          echo "tag=$PREV_TAG" >> $GITHUB_OUTPUT
          echo "Previous tag: $PREV_TAG"

      - name: Import Apple certificate
        env:
          APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }}
          APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
        run: |
          KEYCHAIN_PATH=$RUNNER_TEMP/app-signing.keychain-db
          KEYCHAIN_PASSWORD=$(openssl rand -base64 32)

          security create-keychain -p "$KEYCHAIN_PASSWORD" "$KEYCHAIN_PATH"
          security set-keychain-settings -lut 21600 "$KEYCHAIN_PATH"
          security unlock-keychain -p "$KEYCHAIN_PASSWORD" "$KEYCHAIN_PATH"

          echo "$APPLE_CERTIFICATE" | base64 --decode > $RUNNER_TEMP/certificate.p12
          security import $RUNNER_TEMP/certificate.p12 \
            -P "$APPLE_CERTIFICATE_PASSWORD" \
            -A -t cert -f pkcs12 \
            -k "$KEYCHAIN_PATH"
          security set-key-partition-list -S apple-tool:,apple: \
            -k "$KEYCHAIN_PASSWORD" "$KEYCHAIN_PATH"
          security list-keychain -d user -s "$KEYCHAIN_PATH" $(security list-keychain -d user | tr -d '"')

          rm $RUNNER_TEMP/certificate.p12

          # Verify identity is available
          security find-identity -v -p codesigning "$KEYCHAIN_PATH"

      - name: Build archive
        env:
          APPLE_SIGNING_IDENTITY: ${{ secrets.APPLE_SIGNING_IDENTITY }}
          APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
        run: |
          xcodebuild -project "$XCODE_PROJECT" \
            -scheme "$XCODE_SCHEME" \
            -configuration Release \
            -archivePath build/$APP_NAME.xcarchive \
            CODE_SIGN_IDENTITY="$APPLE_SIGNING_IDENTITY" \
            DEVELOPMENT_TEAM="$APPLE_TEAM_ID" \
            CODE_SIGN_STYLE="Manual" \
            OTHER_CODE_SIGN_FLAGS="--options=runtime" \
            archive

      - name: Export app
        env:
          APPLE_SIGNING_IDENTITY: ${{ secrets.APPLE_SIGNING_IDENTITY }}
          APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
        run: |
          cat > ExportOptions.plist << EOF
          <?xml version="1.0" encoding="UTF-8"?>
          <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
          <plist version="1.0">
          <dict>
              <key>destination</key>
              <string>export</string>
              <key>method</key>
              <string>developer-id</string>
              <key>signingStyle</key>
              <string>manual</string>
              <key>signingCertificate</key>
              <string>${APPLE_SIGNING_IDENTITY}</string>
              <key>teamID</key>
              <string>${APPLE_TEAM_ID}</string>
          </dict>
          </plist>
          EOF

          xcodebuild -exportArchive \
            -archivePath build/$APP_NAME.xcarchive \
            -exportPath build \
            -exportOptionsPlist ExportOptions.plist

      - name: Notarize app
        env:
          APPLE_ID: ${{ secrets.APPLE_ID }}
          APPLE_PASSWORD: ${{ secrets.APPLE_PASSWORD }}
          APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
        run: |
          ditto -c -k --keepParent "build/$APP_NAME.app" "build/$APP_NAME.zip"

          xcrun notarytool submit "build/$APP_NAME.zip" \
            --apple-id "$APPLE_ID" \
            --password "$APPLE_PASSWORD" \
            --team-id "$APPLE_TEAM_ID" \
            --wait

          xcrun stapler staple "build/$APP_NAME.app"

          rm "build/$APP_NAME.zip"

      - name: Create Sparkle update zip
        run: |
          ditto -c -k --keepParent "build/$APP_NAME.app" "build/$APP_NAME-${{ steps.version.outputs.version }}.zip"

      - name: Sign update with Sparkle
        env:
          SPARKLE_ED_PRIVATE_KEY: ${{ secrets.SPARKLE_ED_PRIVATE_KEY }}
        run: |
          SPARKLE_VERSION="2.8.1"
          curl -sL "https://github.com/sparkle-project/Sparkle/releases/download/${SPARKLE_VERSION}/Sparkle-${SPARKLE_VERSION}.tar.xz" -o sparkle.tar.xz
          mkdir -p sparkle-tools
          tar -xf sparkle.tar.xz -C sparkle-tools
          rm sparkle.tar.xz

          # Write EdDSA key to temp file (sign_update requires -f flag, not stdin pipe)
          echo "$SPARKLE_ED_PRIVATE_KEY" > "$RUNNER_TEMP/sparkle_key"

          ZIP_FILE="build/$APP_NAME-${{ steps.version.outputs.version }}.zip"
          SIGN_UPDATE=$(find sparkle-tools -name sign_update -type f | head -1)
          SIGN_OUTPUT=$("$SIGN_UPDATE" "$ZIP_FILE" -f "$RUNNER_TEMP/sparkle_key")

          rm -f "$RUNNER_TEMP/sparkle_key"

          ED_SIGNATURE=$(echo "$SIGN_OUTPUT" | grep -o 'sparkle:edSignature="[^"]*"' | cut -d'"' -f2)
          FILE_LENGTH=$(stat -f%z "$ZIP_FILE")

          echo "ed_signature=$ED_SIGNATURE" >> $GITHUB_OUTPUT
          echo "file_length=$FILE_LENGTH" >> $GITHUB_OUTPUT
        id: sparkle_sign

      - name: Generate appcast.xml
        run: |
          VERSION="${{ steps.version.outputs.version }}"
          DOWNLOAD_URL="https://github.com/${{ github.repository }}/releases/download/${{ env.RELEASE_TAG }}/$APP_NAME-${VERSION}.zip"
          PUB_DATE=$(date -u +"%a, %d %b %Y %H:%M:%S %z")

          cat > "build/appcast.xml" << APPCAST_EOF
          <?xml version="1.0" encoding="utf-8"?>
          <rss version="2.0" xmlns:sparkle="http://www.andymatuschak.org/xml-namespaces/sparkle" xmlns:dc="http://purl.org/dc/elements/1.1/">
            <channel>
              <title>Browser Clutch Updates</title>
              <item>
                <title>Version ${VERSION}</title>
                <pubDate>${PUB_DATE}</pubDate>
                <sparkle:version>${VERSION}</sparkle:version>
                <sparkle:shortVersionString>${VERSION}</sparkle:shortVersionString>
                <sparkle:minimumSystemVersion>14.0</sparkle:minimumSystemVersion>
                <enclosure url="${DOWNLOAD_URL}"
                           type="application/octet-stream"
                           sparkle:edSignature="${{ steps.sparkle_sign.outputs.ed_signature }}"
                           length="${{ steps.sparkle_sign.outputs.file_length }}" />
              </item>
            </channel>
          </rss>
          APPCAST_EOF

      - name: Create DMG
        run: |
          mkdir -p build/dmg
          cp -R "build/$APP_NAME.app" build/dmg/
          ln -s /Applications build/dmg/Applications
          hdiutil create -volname "$APP_NAME" \
            -srcfolder build/dmg \
            -ov -format UDZO \
            "build/$APP_NAME-${{ steps.version.outputs.version }}.dmg"

      - name: Sign DMG
        env:
          APPLE_SIGNING_IDENTITY: ${{ secrets.APPLE_SIGNING_IDENTITY }}
        run: |
          codesign --force --sign "$APPLE_SIGNING_IDENTITY" \
            "build/$APP_NAME-${{ steps.version.outputs.version }}.dmg"

      - name: Notarize DMG
        env:
          APPLE_ID: ${{ secrets.APPLE_ID }}
          APPLE_PASSWORD: ${{ secrets.APPLE_PASSWORD }}
          APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
        run: |
          xcrun notarytool submit \
            "build/$APP_NAME-${{ steps.version.outputs.version }}.dmg" \
            --apple-id "$APPLE_ID" \
            --password "$APPLE_PASSWORD" \
            --team-id "$APPLE_TEAM_ID" \
            --wait

          xcrun stapler staple \
            "build/$APP_NAME-${{ steps.version.outputs.version }}.dmg"

      - name: Build Changelog
        id: changelog
        uses: mikepenz/release-changelog-builder-action@v6
        with:
          configurationJson: |
            {
              "categories": [
                { "title": "## ✨ Features", "labels": ["feature", "enhancement"] },
                { "title": "## 🐛 Bug Fixes", "labels": ["bug", "fix"] },
                { "title": "## 📝 Documentation", "labels": ["documentation"] },
                { "title": "## 🔧 Other", "labels": [] }
              ],
              "template": "#{{CHANGELOG}}\n\n**Full Changelog**: #{{RELEASE_DIFF}}",
              "pr_template": "- #{{TITLE}} (#{{NUMBER}})",
              "empty_template": "No changes since last release."
            }
          fromTag: ${{ steps.prev_tag.outputs.tag }}
          toTag: ${{ env.RELEASE_TAG }}
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

      - name: Create Release
        uses: softprops/action-gh-release@v3
        with:
          tag_name: ${{ env.RELEASE_TAG }}
          name: ${{ env.APP_NAME }} ${{ env.RELEASE_TAG }}
          body: |
            ## Installation
            1. Download the DMG below
            2. Open it and drag ${{ env.APP_NAME }} to Applications
            3. Set as default browser in System Settings → Desktop & Dock

            ${{ steps.changelog.outputs.changelog }}
          files: |
            build/${{ env.APP_NAME }}-${{ steps.version.outputs.version }}.dmg
            build/${{ env.APP_NAME }}-${{ steps.version.outputs.version }}.zip
            build/appcast.xml
          draft: false
          prerelease: false

      - name: Upload artifact
        uses: actions/upload-artifact@v6
        if: always()
        with:
          name: ${{ env.APP_NAME }}-${{ steps.version.outputs.version }}
          path: build/${{ env.APP_NAME }}-${{ steps.version.outputs.version }}.dmg
          if-no-files-found: ignore

      - name: Cleanup keychain
        if: always()
        run: |
          security delete-keychain $RUNNER_TEMP/app-signing.keychain-db || true

  cleanup:
    name: Cleanup on failure
    needs: [create-tag, build-and-release]
    if: failure() && needs.create-tag.result == 'success'
    runs-on: ubuntu-latest
    environment: release
    permissions:
      contents: write
    steps:
      - name: Delete tag and partial release
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          TAG="${{ needs.create-tag.outputs.tag }}"

          RELEASE_ID=$(gh api "repos/${{ github.repository }}/releases/tags/$TAG" --jq '.id' 2>/dev/null || echo "")
          if [ -n "$RELEASE_ID" ]; then
            gh api -X DELETE "repos/${{ github.repository }}/releases/$RELEASE_ID" || true
          fi

          gh api -X DELETE "repos/${{ github.repository }}/git/refs/tags/$TAG" || true
          echo "Cleaned up tag $TAG — fix the issue and retry"