release.yml

name: Create GitHub Release

on:
  push:
    tags:
      - "v*"

permissions:
  contents: write

jobs:
  release:
    runs-on: xcode-27

    steps:
      - name: Checkout
        uses: actions/checkout@v7

      - name: Install Metal toolchain
        run: xcodebuild -downloadComponent MetalToolchain

      - name: Validate release version
        env:
          RELEASE_TAG: ${{ github.ref_name }}
        run: |
          BUILD_SETTINGS="$(
            xcodebuild \
              -project ComputerSolitaire.xcodeproj \
              -scheme ComputerSolitaire \
              -configuration Release \
              -destination "generic/platform=macOS" \
              -showBuildSettings
          )"
          MARKETING_VERSIONS="$(printf '%s\n' "$BUILD_SETTINGS" | awk '$1 == "MARKETING_VERSION" && $2 == "=" { print $3 }' | sort -u)"
          VERSION_COUNT="$(printf '%s\n' "$MARKETING_VERSIONS" | awk 'NF { count++ } END { print count + 0 }')"

          if [[ "$VERSION_COUNT" -ne 1 ]]; then
            echo "Expected exactly one MARKETING_VERSION, but found $VERSION_COUNT."
            printf '%s\n' "$MARKETING_VERSIONS"
            exit 1
          fi

          EXPECTED_TAG="v$MARKETING_VERSIONS"
          if [[ "$RELEASE_TAG" != "$EXPECTED_TAG" ]]; then
            echo "Release tag $RELEASE_TAG does not match MARKETING_VERSION $MARKETING_VERSIONS."
            echo "Expected tag: $EXPECTED_TAG"
            exit 1
          fi


      - name: Import Apple signing certificate
        env:
          P12_BASE64: ${{ secrets.APPLE_CERT_P12_BASE64 }}
          P12_PASSWORD: ${{ secrets.APPLE_CERT_PASSWORD }}
          APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
        run: |
          KEYCHAIN_PATH="$RUNNER_TEMP/computer-solitaire-signing.keychain-db"
          CERT_PATH="$RUNNER_TEMP/computer-solitaire-signing.p12"
          echo "KEYCHAIN_PATH=$KEYCHAIN_PATH" >> "$GITHUB_ENV"

          if [[ -z "${P12_BASE64:-}" || -z "${P12_PASSWORD:-}" || -z "${APPLE_TEAM_ID:-}" ]]; then
            echo "Missing required signing secrets: APPLE_CERT_P12_BASE64, APPLE_CERT_PASSWORD, APPLE_TEAM_ID"
            exit 1
          fi

          printf '%s' "$P12_BASE64" | base64 -D -o "$CERT_PATH"

          security create-keychain -p "" "$KEYCHAIN_PATH"
          security set-keychain-settings -lut 21600 "$KEYCHAIN_PATH"
          security unlock-keychain -p "" "$KEYCHAIN_PATH"
          security import "$CERT_PATH" \
            -k "$KEYCHAIN_PATH" \
            -P "$P12_PASSWORD" \
            -T /usr/bin/codesign \
            -T /usr/bin/security
          security set-key-partition-list \
            -S apple-tool:,apple: \
            -s \
            -k "" \
            "$KEYCHAIN_PATH"
          security list-keychains -d user -s "$KEYCHAIN_PATH" login.keychain-db

      - name: Build macOS app archive
        env:
          RELEASE_TAG: ${{ github.ref_name }}
        run: |
          # CURRENT_PROJECT_VERSION override: the Sparkle feed compares
          # CFBundleVersion, so released builds stamp the marketing version
          # there. The project file itself keeps a plain build number.
          xcodebuild archive \
            -project ComputerSolitaire.xcodeproj \
            -scheme ComputerSolitaire \
            -destination "generic/platform=macOS" \
            -archivePath build/ComputerSolitaire.xcarchive \
            -configuration Release \
            CODE_SIGN_STYLE=Manual \
            CODE_SIGN_IDENTITY="Developer ID Application" \
            DEVELOPMENT_TEAM="${{ secrets.APPLE_TEAM_ID }}" \
            OTHER_CODE_SIGN_FLAGS="--keychain $KEYCHAIN_PATH" \
            CURRENT_PROJECT_VERSION="${RELEASE_TAG#v}" \
            ARCHS=arm64

      # Exporting re-signs all nested code (Sparkle's Autoupdate, Updater.app,
      # and XPC services ship ad-hoc signed) with the Developer ID identity and
      # secure timestamps. Copying the app straight out of the archive leaves
      # those ad-hoc signatures in place and notarization rejects them.
      - name: Export Developer ID app
        run: |
          cat > build/ExportOptions.plist <<'EOF'
          <?xml version="1.0" encoding="UTF-8"?>
          <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
          <plist version="1.0">
          <dict>
            <key>method</key>
            <string>developer-id</string>
            <key>signingStyle</key>
            <string>manual</string>
            <key>signingCertificate</key>
            <string>Developer ID Application</string>
            <key>teamID</key>
            <string>TEAM_ID_PLACEHOLDER</string>
          </dict>
          </plist>
          EOF
          sed -i '' "s/TEAM_ID_PLACEHOLDER/${{ secrets.APPLE_TEAM_ID }}/" build/ExportOptions.plist

          xcodebuild -exportArchive \
            -archivePath build/ComputerSolitaire.xcarchive \
            -exportOptionsPlist build/ExportOptions.plist \
            -exportPath build/export

      - name: Create DMG
        run: |
          mkdir -p dmg-contents

          APP_PATH="$(find build/export -maxdepth 1 -name '*.app' -print -quit)"
          if [[ -z "${APP_PATH}" ]]; then
            echo "No .app bundle found in export output."
            exit 1
          fi

          cp -R "${APP_PATH}" dmg-contents/
          hdiutil create \
            -volname "Computer Solitaire" \
            -srcfolder dmg-contents \
            -ov \
            -format UDZO \
            "ComputerSolitaire-${{ github.ref_name }}-arm64.dmg"

      - name: Sign DMG
        run: |
          DMG_PATH="ComputerSolitaire-${{ github.ref_name }}-arm64.dmg"
          codesign --force \
            --sign "Developer ID Application" \
            --keychain "$KEYCHAIN_PATH" \
            --timestamp \
            "$DMG_PATH"

      - name: Prepare notary API key
        env:
          APPLE_API_KEY_ID: ${{ secrets.APPLE_API_KEY_ID }}
          APPLE_API_ISSUER_ID: ${{ secrets.APPLE_API_ISSUER_ID }}
          APPLE_API_PRIVATE_KEY_BASE64: ${{ secrets.APPLE_API_PRIVATE_KEY_BASE64 }}
        run: |
          if [[ -z "${APPLE_API_KEY_ID:-}" || -z "${APPLE_API_ISSUER_ID:-}" || -z "${APPLE_API_PRIVATE_KEY_BASE64:-}" ]]; then
            echo "Missing required notarization secrets: APPLE_API_KEY_ID, APPLE_API_ISSUER_ID, APPLE_API_PRIVATE_KEY_BASE64"
            exit 1
          fi

          NOTARY_API_KEY_PATH="$RUNNER_TEMP/AuthKey_${APPLE_API_KEY_ID}.p8"
          printf '%s' "$APPLE_API_PRIVATE_KEY_BASE64" | base64 -D -o "$NOTARY_API_KEY_PATH"
          chmod 600 "$NOTARY_API_KEY_PATH"
          echo "NOTARY_API_KEY_PATH=$NOTARY_API_KEY_PATH" >> "$GITHUB_ENV"

      - name: Notarize DMG
        env:
          APPLE_API_KEY_ID: ${{ secrets.APPLE_API_KEY_ID }}
          APPLE_API_ISSUER_ID: ${{ secrets.APPLE_API_ISSUER_ID }}
        run: |
          DMG_PATH="ComputerSolitaire-${{ github.ref_name }}-arm64.dmg"

          # notarytool's exit code reflects "submission completed", not the
          # verdict — an Invalid result can still exit 0. Check the status
          # explicitly and surface Apple's per-file log on failure.
          SUBMIT_OUTPUT="$(xcrun notarytool submit "$DMG_PATH" \
            --key "$NOTARY_API_KEY_PATH" \
            --key-id "$APPLE_API_KEY_ID" \
            --issuer "$APPLE_API_ISSUER_ID" \
            --wait | tee /dev/stderr)"

          SUBMISSION_ID="$(printf '%s\n' "$SUBMIT_OUTPUT" | awk '$1 == "id:" { print $2; exit }')"
          STATUS="$(printf '%s\n' "$SUBMIT_OUTPUT" | awk '$1 == "status:" { status = $2 } END { print status }')"

          if [[ "$STATUS" != "Accepted" ]]; then
            echo "Notarization verdict: ${STATUS:-unknown} — fetching Apple's log for submission ${SUBMISSION_ID:-unknown}"
            if [[ -n "$SUBMISSION_ID" ]]; then
              xcrun notarytool log "$SUBMISSION_ID" \
                --key "$NOTARY_API_KEY_PATH" \
                --key-id "$APPLE_API_KEY_ID" \
                --issuer "$APPLE_API_ISSUER_ID"
            fi
            exit 1
          fi

      - name: Staple notarization ticket
        run: |
          DMG_PATH="ComputerSolitaire-${{ github.ref_name }}-arm64.dmg"
          xcrun stapler staple "$DMG_PATH"
          xcrun stapler validate "$DMG_PATH"

      - name: Verify signed artifact
        env:
          RELEASE_TAG: ${{ github.ref_name }}
        run: |
          APP_PATH="$(find build/export -maxdepth 1 -name '*.app' -print -quit)"
          if [[ -z "${APP_PATH}" ]]; then
            echo "No .app bundle found in export output."
            exit 1
          fi

          DMG_PATH="ComputerSolitaire-$RELEASE_TAG-arm64.dmg"
          codesign --verify --deep --strict --verbose=2 "$APP_PATH"
          spctl --assess --type execute --verbose=4 "$APP_PATH"
          codesign --verify --verbose=2 "$DMG_PATH"
          xcrun stapler validate "$DMG_PATH"

          # Sparkle's nested helpers must carry the Developer ID signature,
          # not the ad-hoc one they ship with.
          SPARKLE_BIN="$APP_PATH/Contents/Frameworks/Sparkle.framework/Versions/B/Autoupdate"
          if codesign -dvv "$SPARKLE_BIN" 2>&1 | grep -q "Signature=adhoc"; then
            echo "Sparkle helper is still ad-hoc signed; export did not re-sign nested code."
            exit 1
          fi

          # The Sparkle feed keys on the marketing version.
          BUNDLE_VERSION="$(/usr/libexec/PlistBuddy -c 'Print CFBundleVersion' "$APP_PATH/Contents/Info.plist")"
          if [[ "v$BUNDLE_VERSION" != "$RELEASE_TAG" ]]; then
            echo "CFBundleVersion ($BUNDLE_VERSION) does not match the release tag ($RELEASE_TAG)."
            exit 1
          fi

      - name: Create GitHub Release
        env:
          GH_TOKEN: ${{ github.token }}
          RELEASE_TAG: ${{ github.ref_name }}
        run: |
          DMG_PATH="ComputerSolitaire-$RELEASE_TAG-arm64.dmg"
          if gh release view "$RELEASE_TAG" >/dev/null 2>&1; then
            gh release upload "$RELEASE_TAG" "$DMG_PATH" --clobber
            exit 0
          fi

          # Release notes come from this version's CHANGELOG.md section — the
          # same text the Sparkle update dialog shows. Fall back to GitHub's
          # PR-based notes if the section is missing.
          NOTES_FILE="$RUNNER_TEMP/release-notes.md"
          awk -v version="${RELEASE_TAG#v}" '
            $1 == "##" && $2 == version { in_section = 1; next }
            $1 == "##" { in_section = 0 }
            in_section { print }
          ' CHANGELOG.md > "$NOTES_FILE"

          if [[ -s "$NOTES_FILE" ]]; then
            gh release create "$RELEASE_TAG" \
              --title "$RELEASE_TAG" \
              --notes-file "$NOTES_FILE" \
              "$DMG_PATH"
          else
            echo "::warning::CHANGELOG.md has no section for ${RELEASE_TAG#v}; using GitHub-generated notes."
            gh release create "$RELEASE_TAG" \
              --title "$RELEASE_TAG" \
              --generate-notes \
              "$DMG_PATH"
          fi

      - name: Cleanup signing keychain
        if: always()
        run: |
          if [[ -n "${KEYCHAIN_PATH:-}" ]]; then
            security delete-keychain "$KEYCHAIN_PATH" || true
          fi
          if [[ -n "${NOTARY_API_KEY_PATH:-}" ]]; then
            rm -f "$NOTARY_API_KEY_PATH"
          fi

  appcast:
    needs: release
    runs-on: xcode-27
    permissions:
      contents: read

    env:
      # Releases older than this predate Sparkle (their CFBundleVersion is
      # stuck at 1), so they never appear in the appcast.
      FIRST_SPARKLE_TAG: v0.8.3
      SPARKLE_VERSION: 2.9.4
      SPARKLE_TOOLS_SHA256: ce89daf967db1e1893ed3ebd67575ed82d3902563e3191ca92aaec9164fbdef9

    steps:
      - name: Checkout
        uses: actions/checkout@v7

      - name: Download release archives
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          mkdir -p archives
          for TAG in $(gh release list --limit 100 --json tagName --jq '.[].tagName'); do
            OLDEST="$(printf '%s\n%s\n' "$FIRST_SPARKLE_TAG" "$TAG" | sort -V | head -1)"
            if [[ "$OLDEST" == "$FIRST_SPARKLE_TAG" ]]; then
              gh release download "$TAG" --pattern '*.dmg' --dir archives
            fi
          done
          ls archives

      - name: Extract release notes from CHANGELOG.md
        run: |
          for DMG in archives/*.dmg; do
            BASENAME="$(basename "$DMG" .dmg)"
            VERSION="$(printf '%s' "$BASENAME" | sed -E 's/^ComputerSolitaire-v([0-9.]+)-arm64$/\1/')"
            awk -v version="$VERSION" '
              $1 == "##" && $2 == version { in_section = 1; next }
              $1 == "##" { in_section = 0 }
              in_section { print }
            ' CHANGELOG.md > "archives/$BASENAME.md"
            if [[ ! -s "archives/$BASENAME.md" ]]; then
              echo "::warning::CHANGELOG.md has no section for $VERSION; its appcast entry will have no release notes."
              rm "archives/$BASENAME.md"
            fi
          done

      - name: Fetch Sparkle tools
        run: |
          curl -sL -o sparkle-tools.tar.xz \
            "https://github.com/sparkle-project/Sparkle/releases/download/$SPARKLE_VERSION/Sparkle-$SPARKLE_VERSION.tar.xz"
          echo "$SPARKLE_TOOLS_SHA256  sparkle-tools.tar.xz" | shasum -a 256 -c -
          mkdir -p sparkle-tools
          tar -xf sparkle-tools.tar.xz -C sparkle-tools

      - name: Generate appcast
        env:
          SPARKLE_ED_PRIVATE_KEY: ${{ secrets.SPARKLE_ED_PRIVATE_KEY }}
        run: |
          if [[ -z "${SPARKLE_ED_PRIVATE_KEY:-}" ]]; then
            echo "Missing required secret: SPARKLE_ED_PRIVATE_KEY"
            exit 1
          fi

          mkdir -p site
          printf '%s' "$SPARKLE_ED_PRIVATE_KEY" | ./sparkle-tools/bin/generate_appcast archives \
            --ed-key-file - \
            --download-url-prefix "https://github.com/austin-smith/ComputerSolitaire/releases/download/" \
            --link "https://github.com/austin-smith/ComputerSolitaire" \
            --embed-release-notes \
            --maximum-versions 5 \
            --maximum-deltas 0 \
            -o site/appcast.xml

          # Each DMG lives under its release's download path, not a flat
          # directory; the tag is recoverable from the filename.
          sed -i '' -E \
            's|(releases/download/)(ComputerSolitaire-(v[0-9.]+)-arm64\.dmg)|\1\3/\2|g' \
            site/appcast.xml

          cat site/appcast.xml

      - name: Upload Pages artifact
        uses: actions/upload-pages-artifact@v5
        with:
          path: site

  deploy-appcast:
    needs: appcast
    runs-on: ubuntu-latest
    permissions:
      pages: write
      id-token: write
    environment:
      name: github-pages
      url: ${{ steps.deployment.outputs.page_url }}

    steps:
      - name: Deploy to GitHub Pages
        id: deployment
        uses: actions/deploy-pages@v5