release.yml

name: Release

# Build and publish a macOS release when a version tag is pushed.
#   git tag v0.1.0 && git push origin v0.1.0
on:
  push:
    tags:
      - "v*"

# Allow the workflow to create the GitHub Release and upload assets.
permissions:
  contents: write

jobs:
  release:
    # Apple Silicon runner; we build a universal (arm64 + x86_64) bundle.
    # Must have the macOS 15+ SDK: the screencapturekit crate's `macos_15_0`
    # feature stubs out SCRecordingOutput (warn-only) when built against an
    # older SDK, producing a binary that fails at runtime on every machine.
    runs-on: macos-15

    steps:
      - name: Checkout
        uses: actions/checkout@v4

      # Hard-fail if the runner's SDK is too old instead of shipping a build
      # with SCRecordingOutput silently stubbed out.
      - name: Verify macOS SDK is 15+
        run: |
          set -euo pipefail
          sdk="$(xcrun --show-sdk-version)"
          echo "macOS SDK: $sdk"
          major="${sdk%%.*}"
          if [ "$major" -lt 15 ]; then
            echo "::error::macOS SDK $sdk is too old — SCRecordingOutput (macos_15_0 feature) would be stubbed out. Use a runner/Xcode with SDK 15+."
            exit 1
          fi

      - name: Set up Bun
        uses: oven-sh/setup-bun@v2
        with:
          bun-version: latest

      - name: Set up Rust
        uses: dtolnay/rust-toolchain@stable
        with:
          targets: aarch64-apple-darwin,x86_64-apple-darwin

      - name: Cache Rust build
        uses: swatinem/rust-cache@v2
        with:
          workspaces: src-tauri

      # `bun install` runs the postinstall hook, which fetches the
      # x86_64 + aarch64 ffmpeg sidecars required by `externalBin`.
      - name: Install dependencies
        run: bun install

      # Validate the Apple signing cert up front. tauri-action attempts
      # `security import` whenever APPLE_CERTIFICATE is non-empty and hard-fails
      # on a malformed cert/password. Instead, gate signing on a cert that
      # actually opens, so a missing/broken secret degrades to an ad-hoc build
      # (green CI) and a correct secret auto-enables proper signing.
      - name: Validate Apple signing certificate
        id: check_signing
        env:
          APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }}
          APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
        run: |
          set -euo pipefail
          if [ -z "${APPLE_CERTIFICATE:-}" ]; then
            echo "No APPLE_CERTIFICATE secret set — building ad-hoc signed."
            echo "enabled=false" >> "$GITHUB_OUTPUT"
            exit 0
          fi
          tmp="$(mktemp)"
          trap 'rm -f "$tmp"' EXIT
          if ! printf '%s' "$APPLE_CERTIFICATE" | tr -d '[:space:]' \
               | openssl base64 -d -A > "$tmp" 2>/dev/null || [ ! -s "$tmp" ]; then
            echo "::warning::APPLE_CERTIFICATE is not valid base64 — skipping code signing (ad-hoc build). Re-create the secret with: base64 -i cert.p12 | pbcopy"
            echo "enabled=false" >> "$GITHUB_OUTPUT"
            exit 0
          fi
          if openssl pkcs12 -in "$tmp" -nokeys -passin pass:"${APPLE_CERTIFICATE_PASSWORD:-}" >/dev/null 2>&1 \
             || openssl pkcs12 -legacy -in "$tmp" -nokeys -passin pass:"${APPLE_CERTIFICATE_PASSWORD:-}" >/dev/null 2>&1; then
            echo "Apple certificate validated — code signing enabled."
            echo "enabled=true" >> "$GITHUB_OUTPUT"
          else
            echo "::warning::APPLE_CERTIFICATE could not be opened with APPLE_CERTIFICATE_PASSWORD (corrupt .p12 or wrong password) — skipping code signing (ad-hoc build)."
            echo "enabled=false" >> "$GITHUB_OUTPUT"
          fi

      # Two variants: the Apple env vars must be ABSENT (not empty) when not
      # signing — Tauri's bundler treats a defined-but-empty APPLE_CERTIFICATE
      # as "present" and fails `security import` on the empty data. A
      # `${{ ... || '' }}` expression always defines the var, so we instead
      # split into a signed step and an env-free ad-hoc step.
      # Signed but NOT notarized. We sign with an Apple Development cert from a
      # free account (no paid Developer Program), which can't notarize. The
      # notarization env vars (APPLE_ID / APPLE_PASSWORD / APPLE_TEAM_ID) are
      # deliberately omitted: tauri-action treats them as *defined-but-empty*
      # (a missing secret expands to "") and tries to notarize with blank
      # credentials, which fails ("Invalid credentials" / "Team ID must be at
      # least 3 characters"). Leaving them undefined makes it skip notarization.
      # To enable real notarization later (paid account + Developer ID cert),
      # add them back here with valid secret values.
      - name: Build and release (signed)
        if: steps.check_signing.outputs.enabled == 'true'
        uses: tauri-apps/tauri-action@v0
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }}
          APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
          APPLE_SIGNING_IDENTITY: ${{ secrets.APPLE_SIGNING_IDENTITY }}
        with:
          # Use Bun for the Tauri CLI (repo is Bun-only).
          tauriScript: bun run tauri
          args: --target universal-apple-darwin
          tagName: ${{ github.ref_name }}
          releaseName: "OpenScreen Studio ${{ github.ref_name }}"
          releaseBody: "See the assets below to download and install this version."
          releaseDraft: true
          prerelease: false

      # No Apple env vars at all -> Tauri falls back to ad-hoc signing.
      - name: Build and release (ad-hoc, unsigned)
        if: steps.check_signing.outputs.enabled != 'true'
        uses: tauri-apps/tauri-action@v0
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        with:
          # Use Bun for the Tauri CLI (repo is Bun-only).
          tauriScript: bun run tauri
          args: --target universal-apple-darwin
          tagName: ${{ github.ref_name }}
          releaseName: "OpenScreen Studio ${{ github.ref_name }}"
          releaseBody: "See the assets below to download and install this version."
          releaseDraft: true
          prerelease: false