release.yml

name: Release

on:
  push:
    tags:
      - 'v*.*.*'
  workflow_dispatch:
    inputs:
      version:
        description: 'Version to release (e.g., 1.0.0)'
        required: true
        type: string

env:
  APP_NAME: icongrabber
  BUNDLE_ID: com.macadmins.icongrabber
  NOTARY_APP_PASSWORD: ${{ secrets.NOTARY_APP_PASSWORD_MAOS }}

jobs:
  build-and-release:
    runs-on: macos-14
    permissions:
      contents: write
    
    steps:
    - name: Checkout code
      uses: actions/checkout@v4
      with:
        fetch-depth: 0
    
    - name: Install Apple Application certificates
      uses: apple-actions/import-codesign-certs@v3
      with:
        keychain-password: ${{ github.run_id }}
        p12-file-base64: ${{ secrets.APP_CERTIFICATES_P12_MAOS }}
        p12-password: ${{ secrets.APP_CERTIFICATES_P12_PASSWORD_MAOS }}
    
    - name: Install Apple Installer certificates
      uses: apple-actions/import-codesign-certs@v3
      with:
        create-keychain: false
        keychain-password: ${{ github.run_id }}
        p12-file-base64: ${{ secrets.PKG_CERTIFICATES_P12_MAOS }}
        p12-password: ${{ secrets.PKG_CERTIFICATES_P12_PASSWORD_MAOS }}
    
    - name: Set version
      id: version
      run: |
        if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
          VERSION="${{ inputs.version }}"
        else
          VERSION=${GITHUB_REF#refs/tags/v}
        fi
        echo "VERSION=$VERSION" >> $GITHUB_OUTPUT
        
        # Detect if this is a pre-release (contains -alpha, -beta, -rc, etc.)
        if [[ "$VERSION" =~ -[a-zA-Z] ]]; then
          echo "PRERELEASE=true" >> $GITHUB_OUTPUT
          echo "Pre-release detected: $VERSION"
        else
          echo "PRERELEASE=false" >> $GITHUB_OUTPUT
          echo "Stable release: $VERSION"
        fi
        echo "Building version: $VERSION"
    
    - name: Set up Swift
      run: |
        swift --version
        xcodebuild -version
    
    - name: Build release binary
      run: |
        echo "Building optimized release binary..."
        mkdir -p bin
        swiftc -O -o bin/${{ env.APP_NAME }} icongrabber-cli/main.swift -framework AppKit
        
        echo "Signing binary..."
        codesign --force --options runtime \
          --sign "Developer ID Application: Mac Admins Open Source (T4SK8ZXCXG)" \
          --timestamp \
          bin/${{ env.APP_NAME }}
        
        echo "Verifying signature..."
        codesign -vvv --deep --strict bin/${{ env.APP_NAME }}
        
        echo "Binary info:"
        ls -lh bin/${{ env.APP_NAME }}
        file bin/${{ env.APP_NAME }}
        otool -L bin/${{ env.APP_NAME }}
    
    - name: Create installation directory structure
      run: |
        mkdir -p pkgroot/usr/local/bin
        mkdir -p pkgroot/usr/local/share/man/man1
        mkdir -p scripts
        
        # Copy binary
        cp bin/${{ env.APP_NAME }} pkgroot/usr/local/bin/
        chmod 755 pkgroot/usr/local/bin/${{ env.APP_NAME }}
        
        # Copy man page if it exists
        if [ -f icongrabber.1 ]; then
          cp icongrabber.1 pkgroot/usr/local/share/man/man1/
          chmod 644 pkgroot/usr/local/share/man/man1/icongrabber.1
        fi
        
        echo "Package structure:"
        find pkgroot -type f -ls
    
    - name: Create postinstall script
      run: |
        cat > scripts/postinstall << 'EOF'
        #!/bin/bash
        
        # Ensure binary is executable
        chmod 755 /usr/local/bin/icongrabber
        
        # Update man database if available
        if command -v makewhatis >/dev/null 2>&1; then
          makewhatis /usr/local/share/man 2>/dev/null || true
        fi
        
        echo "Icon Grabber has been installed successfully!"
        echo "Run 'icongrabber --help' to get started."
        
        exit 0
        EOF
        
        chmod +x scripts/postinstall
    
    - name: Build PKG
      run: |
        VERSION="${{ steps.version.outputs.VERSION }}"
        
        # Build the component package
        pkgbuild \
          --root pkgroot \
          --scripts scripts \
          --identifier "${{ env.BUNDLE_ID }}" \
          --version "$VERSION" \
          --install-location / \
          component.pkg
        
        # Create distribution XML
        cat > distribution.xml << EOF
        <?xml version="1.0" encoding="utf-8"?>
        <installer-gui-script minSpecVersion="1">
            <title>Icon Grabber</title>
            <organization>${{ env.BUNDLE_ID }}</organization>
            <domains enable_localSystem="true"/>
            <options customize="never" require-scripts="false" rootVolumeOnly="true" />
            <!-- Require macOS 15.0 (Sequoia) or later -->
            <allowed-os-versions>
                <os-version min="15.0" />
            </allowed-os-versions>
            <choices-outline>
                <line choice="default">
                    <line choice="${{ env.BUNDLE_ID }}"/>
                </line>
            </choices-outline>
            <choice id="default"/>
            <choice id="${{ env.BUNDLE_ID }}" visible="false">
                <pkg-ref id="${{ env.BUNDLE_ID }}"/>
            </choice>
            <pkg-ref id="${{ env.BUNDLE_ID }}" version="$VERSION" onConclusion="none">component.pkg</pkg-ref>
        </installer-gui-script>
        EOF
        
        # Build the product archive with signing
        productbuild \
          --distribution distribution.xml \
          --package-path . \
          --sign "Developer ID Installer: Mac Admins Open Source (T4SK8ZXCXG)" \
          --timestamp \
          ${{ env.APP_NAME }}-$VERSION.pkg
        
        # Verify package signature
        pkgutil --check-signature ${{ env.APP_NAME }}-$VERSION.pkg
        
        ls -lh ${{ env.APP_NAME }}-$VERSION.pkg
    
    - name: Create tarball with binary
      run: |
        VERSION="${{ steps.version.outputs.VERSION }}"
        
        # Create a tarball for users who prefer not to use PKG
        mkdir -p ${{ env.APP_NAME }}-$VERSION-bin
        cp bin/${{ env.APP_NAME }} ${{ env.APP_NAME }}-$VERSION-bin/
        cp README.md ${{ env.APP_NAME }}-$VERSION-bin/ || true
        cp LICENSE ${{ env.APP_NAME }}-$VERSION-bin/ || true
        
        tar -czf ${{ env.APP_NAME }}-$VERSION-macos-binary.tar.gz ${{ env.APP_NAME }}-$VERSION-bin/
        
        echo "Created tarball:"
        ls -lh ${{ env.APP_NAME }}-$VERSION-macos-binary.tar.gz
    
    - name: Notarize package
      run: |
        VERSION="${{ steps.version.outputs.VERSION }}"
        
        echo "Setting up notarization credentials..."
        xcrun notarytool store-credentials "icongrabber-notary" \
          --apple-id "opensource@macadmins.io" \
          --team-id "T4SK8ZXCXG" \
          --password "$NOTARY_APP_PASSWORD"
        
        echo "Submitting package for notarization..."
        xcrun notarytool submit "${{ env.APP_NAME }}-$VERSION.pkg" \
          --keychain-profile "icongrabber-notary" \
          --wait
        
        echo "Stapling notarization ticket..."
        xcrun stapler staple "${{ env.APP_NAME }}-$VERSION.pkg"
        
        echo "Verifying stapled package..."
        xcrun stapler validate "${{ env.APP_NAME }}-$VERSION.pkg"
        
        echo "Package successfully signed, notarized, and stapled!"
    
    - name: Generate checksums
      run: |
        VERSION="${{ steps.version.outputs.VERSION }}"
        
        shasum -a 256 ${{ env.APP_NAME }}-$VERSION.pkg > checksums.txt
        shasum -a 256 ${{ env.APP_NAME }}-$VERSION-macos-binary.tar.gz >> checksums.txt
        
        echo "Checksums:"
        cat checksums.txt
    
    - name: Get Changelog Entry
      id: changelog_reader
      uses: mindsers/changelog-reader-action@v2
      with:
        validation_depth: 100
        version: ${{ steps.version.outputs.VERSION }}
        path: ./CHANGELOG.md
    
    - name: Generate release notes
      id: release_notes
      run: |
        VERSION="${{ steps.version.outputs.VERSION }}"
        
        cat > release_notes.md << EOF
        ## Icon Grabber v$VERSION
        
        ### 🎉 Release Notes
        
        This release has been automatically built, signed, and notarized by GitHub Actions.
        
        **Security**: Both the binary and installer package are signed with a valid Developer ID certificate and notarized by Apple. The package is stapled for offline verification.
        
        ### Installation
        
        #### Option 1: Install via PKG (Recommended)
        Download \`${{ env.APP_NAME }}-$VERSION.pkg\` and double-click to install.
        
        The PKG installer will:
        - Install the signed binary to \`/usr/local/bin/icongrabber\`
        - Install the man page to \`/usr/local/share/man/man1/\`
        - The package is signed, notarized, and stapled
        #### Option 2: Manual Installation
        Download \`${{ env.APP_NAME }}-$VERSION-macos-binary.tar.gz\`:
        
        \`\`\`bash
        tar -xzf ${{ env.APP_NAME }}-$VERSION-macos-binary.tar.gz
        sudo cp ${{ env.APP_NAME }}-$VERSION-bin/icongrabber /usr/local/bin/
        \`\`\`
        
        ### Verification
        
        Verify the checksums:
        \`\`\`bash
        shasum -a 256 -c checksums.txt
        \`\`\`
        
        ### Usage
        
        \`\`\`bash
        icongrabber --help
        icongrabber /Applications/Safari.app -o safari.png -s 512
        \`\`\`
        
        ### What's Changed
        
        ${{ steps.changelog_reader.outputs.changes }}
        
        ---
        
        **Checksums (SHA-256):**
        \`\`\`
        $(cat checksums.txt)
        \`\`\`
        EOF
        
        cat release_notes.md
    
    - name: Create GitHub Release
      uses: softprops/action-gh-release@v1
      with:
        tag_name: ${{ github.ref_name }}
        name: Release v${{ steps.version.outputs.VERSION }}
        body_path: release_notes.md
        draft: false
        prerelease: ${{ steps.version.outputs.PRERELEASE }}
        files: |
          ${{ env.APP_NAME }}-${{ steps.version.outputs.VERSION }}.pkg
          ${{ env.APP_NAME }}-${{ steps.version.outputs.VERSION }}-macos-binary.tar.gz
          checksums.txt
      env:
        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}