release.yml

name: Release

on:
  push:
    tags:
      - "v*"
  workflow_dispatch:
    inputs:
      tag:
        description: "Release tag, for example v1.1.0"
        required: true
      publish:
        description: "Create the GitHub release and update the stable Homebrew cask"
        required: false
        default: false
        type: boolean

permissions:
  contents: write

jobs:
  release:
    runs-on: macos-26
    timeout-minutes: 45

    steps:
      - name: Checkout code
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
        with:
          fetch-depth: 0
          ref: ${{ github.event_name == 'workflow_dispatch' && format('refs/tags/{0}', inputs.tag) || github.ref }}

      - name: Select Xcode
        run: sudo xcode-select -s /Applications/Xcode_26.2.app/Contents/Developer

      - name: Determine release version
        id: version
        env:
          INPUT_TAG: ${{ inputs.tag }}
          REF_TAG: ${{ github.ref_name }}
        run: |
          set -euo pipefail

          if [ -n "$INPUT_TAG" ]; then
            TAG="$INPUT_TAG"
          else
            TAG="$REF_TAG"
          fi

          if [[ ! "$TAG" =~ ^v[0-9]+[.][0-9]+[.][0-9]+(-[0-9A-Za-z][0-9A-Za-z.-]*)?$ ]]; then
            echo "Invalid release tag: $TAG" >&2
            exit 1
          fi

          VERSION="${TAG#v}"
          BUNDLE_VERSION="${VERSION%%-*}"
          COMMIT_SHA=$(git rev-parse HEAD)
          PRERELEASE=false
          if [ "$VERSION" != "$BUNDLE_VERSION" ]; then
            PRERELEASE=true
          fi

          {
            echo "tag=$TAG"
            echo "version=$VERSION"
            echo "bundle_version=$BUNDLE_VERSION"
            echo "commit_sha=$COMMIT_SHA"
            echo "prerelease=$PRERELEASE"
          } >> "$GITHUB_OUTPUT"
          echo "Releasing OpenInCode $VERSION from $COMMIT_SHA"

      - name: Verify Homebrew tap credentials
        if: (github.event_name == 'push' || inputs.publish) && steps.version.outputs.prerelease != 'true'
        env:
          HOMEBREW_REPO_SSH_KEY: ${{ secrets.HOMEBREW_REPO_SSH_KEY }}
        run: |
          if [ -z "$HOMEBREW_REPO_SSH_KEY" ]; then
            echo "::error::HOMEBREW_REPO_SSH_KEY must be a write-enabled deploy key for sozercan/homebrew-repo."
            exit 1
          fi

      - name: Run focused tests
        run: ./scripts/test.sh

      - name: Configure release signing
        id: signing
        env:
          MACOS_CERTIFICATE: ${{ secrets.MACOS_CERTIFICATE }}
          MACOS_CERTIFICATE_PWD: ${{ secrets.MACOS_CERTIFICATE_PWD }}
          MACOS_KEYCHAIN_PWD: ${{ secrets.MACOS_KEYCHAIN_PWD }}
          EXPECTED_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
          REQUIRE_SIGNED_RELEASE: ${{ github.event_name == 'push' || inputs.publish }}
        run: |
          set -euo pipefail

          fallback_to_adhoc() {
            local reason="$1"
            if [ "$REQUIRE_SIGNED_RELEASE" = "true" ]; then
              echo "ERROR: $reason" >&2
              exit 1
            fi
            echo "::warning::$reason Falling back to ad-hoc signing; this build will not be notarized."
            echo "identity=-" >> "$GITHUB_OUTPUT"
            echo "mode=adhoc" >> "$GITHUB_OUTPUT"
          }

          if [ "$REQUIRE_SIGNED_RELEASE" = "true" ] && [ -z "$EXPECTED_TEAM_ID" ]; then
            echo "ERROR: APPLE_TEAM_ID is required for public release signing." >&2
            exit 1
          fi

          if [ -z "$MACOS_CERTIFICATE" ] || [ -z "$MACOS_CERTIFICATE_PWD" ] || [ -z "$MACOS_KEYCHAIN_PWD" ]; then
            fallback_to_adhoc "macOS signing secrets are not configured."
            exit 0
          fi

          KEYCHAIN_PATH="$RUNNER_TEMP/openincode-signing.keychain-db"
          CERT_PATH="$RUNNER_TEMP/openincode-signing.p12"

          if ! printf '%s' "$MACOS_CERTIFICATE" | base64 --decode > "$CERT_PATH"; then
            fallback_to_adhoc "MACOS_CERTIFICATE is not valid base64."
            exit 0
          fi

          security create-keychain -p "$MACOS_KEYCHAIN_PWD" "$KEYCHAIN_PATH"
          security set-keychain-settings -lut 21600 "$KEYCHAIN_PATH"
          security unlock-keychain -p "$MACOS_KEYCHAIN_PWD" "$KEYCHAIN_PATH"

          if ! security import "$CERT_PATH" -P "$MACOS_CERTIFICATE_PWD" \
            -t agg -f pkcs12 -k "$KEYCHAIN_PATH" \
            -T /usr/bin/codesign -T /usr/bin/security; then
            rm -f "$CERT_PATH"
            fallback_to_adhoc "The signing certificate could not be imported."
            exit 0
          fi

          security set-key-partition-list -S apple-tool:,apple:,codesign: \
            -s -k "$MACOS_KEYCHAIN_PWD" "$KEYCHAIN_PATH" >/dev/null

          EXISTING_KEYCHAINS=()
          while IFS= read -r keychain; do
            keychain="${keychain#*\"}"
            keychain="${keychain%%\"*}"
            if [ -n "$keychain" ]; then
              EXISTING_KEYCHAINS+=("$keychain")
            fi
          done < <(security list-keychains -d user)
          security list-keychains -d user -s "$KEYCHAIN_PATH" "${EXISTING_KEYCHAINS[@]}"
          rm -f "$CERT_PATH"

          DEVELOPER_ID=$(security find-identity -v -p codesigning "$KEYCHAIN_PATH" 2>/dev/null \
            | awk -v team="$EXPECTED_TEAM_ID" '
                /Developer ID Application/ && (team == "" || index($0, "(" team ")") > 0) {
                  print $2
                  exit
                }
              ' || true)
          if [ -n "$DEVELOPER_ID" ]; then
            echo "::add-mask::$DEVELOPER_ID"
            echo "identity=$DEVELOPER_ID" >> "$GITHUB_OUTPUT"
            echo "mode=developer-id" >> "$GITHUB_OUTPUT"
            exit 0
          fi

          APPLE_DEVELOPMENT=$(security find-identity -v -p codesigning "$KEYCHAIN_PATH" 2>/dev/null \
            | awk '/Apple Development/ { print $2; exit }' || true)
          if [ -n "$APPLE_DEVELOPMENT" ]; then
            echo "::add-mask::$APPLE_DEVELOPMENT"
            echo "::warning::Using Apple Development signing; this release will not be notarized."
            echo "identity=$APPLE_DEVELOPMENT" >> "$GITHUB_OUTPUT"
            echo "mode=development" >> "$GITHUB_OUTPUT"
            exit 0
          fi

          fallback_to_adhoc "The imported keychain has no usable Developer ID Application or Apple Development identity."

      - name: Build and sign release app
        id: app
        env:
          MARKETING_VERSION: ${{ steps.version.outputs.bundle_version }}
          BUILD_NUMBER: ${{ github.run_number }}
          ARCHES: "arm64 x86_64"
          OPEN_IN_CODE_SIGNING: unsigned
          SIGNING_IDENTITY: ${{ steps.signing.outputs.identity }}
          SIGNING_MODE: ${{ steps.signing.outputs.mode }}
          EXPECTED_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
        run: |
          set -euo pipefail

          ./scripts/build-app.sh release

          APP_PATH="$PWD/.build/app/Open in Code.app"
          PLIST_PATH="$APP_PATH/Contents/Info.plist"
          EXECUTABLE_PATH="$APP_PATH/Contents/MacOS/Open in Code"

          test -d "$APP_PATH"
          test -f "$APP_PATH/Contents/Resources/Assets.car"
          test -f "$APP_PATH/Contents/Resources/vscode.icns"
          test "$(/usr/libexec/PlistBuddy -c 'Print :CFBundleShortVersionString' "$PLIST_PATH")" = "$MARKETING_VERSION"
          test "$(/usr/libexec/PlistBuddy -c 'Print :CFBundleVersion' "$PLIST_PATH")" = "$BUILD_NUMBER"

          ARCHITECTURES=$(lipo -archs "$EXECUTABLE_PATH")
          echo "Architectures: $ARCHITECTURES"
          [[ "$ARCHITECTURES" == *arm64* ]]
          [[ "$ARCHITECTURES" == *x86_64* ]]

          if [ "$SIGNING_MODE" = "developer-id" ]; then
            codesign --force --options runtime --timestamp \
              --entitlements "Open in Code.entitlements" \
              --sign "$SIGNING_IDENTITY" "$APP_PATH"
          elif [ "$SIGNING_MODE" = "development" ]; then
            codesign --force --options runtime --timestamp=none \
              --entitlements "Open in Code.entitlements" \
              --sign "$SIGNING_IDENTITY" "$APP_PATH"
          else
            codesign --force --options runtime --timestamp=none \
              --entitlements "Open in Code.entitlements" \
              --sign - "$APP_PATH"
          fi

          codesign --verify --deep --strict --verbose=4 "$APP_PATH"
          ENTITLEMENTS=$(codesign -d --entitlements :- "$APP_PATH" 2>/dev/null)
          grep -F 'com.apple.security.automation.apple-events' <<< "$ENTITLEMENTS" >/dev/null

          if [ "$SIGNING_MODE" != "adhoc" ]; then
            SIGNED_TEAM_ID=$(codesign -dvv "$APP_PATH" 2>&1 \
              | sed -n 's/^TeamIdentifier=//p')
            if [ -z "$SIGNED_TEAM_ID" ]; then
              echo "Signed app has no team identifier." >&2
              exit 1
            fi
            if [ -n "$EXPECTED_TEAM_ID" ] && [ "$SIGNED_TEAM_ID" != "$EXPECTED_TEAM_ID" ]; then
              echo "Signed app team ID '$SIGNED_TEAM_ID' does not match APPLE_TEAM_ID '$EXPECTED_TEAM_ID'." >&2
              exit 1
            fi
          fi

          echo "path=$APP_PATH" >> "$GITHUB_OUTPUT"

      - name: Notarize Developer ID app
        if: steps.signing.outputs.mode == 'developer-id' && (github.event_name == 'push' || inputs.publish)
        env:
          APP_PATH: ${{ steps.app.outputs.path }}
          APPLE_ID: ${{ secrets.APPLE_ID }}
          APPLE_APP_SPECIFIC_PASSWORD: ${{ secrets.APPLE_APP_SPECIFIC_PASSWORD }}
          APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
        run: |
          set -euo pipefail

          if [ -z "$APPLE_ID" ] || [ -z "$APPLE_APP_SPECIFIC_PASSWORD" ] || [ -z "$APPLE_TEAM_ID" ]; then
            echo "Developer ID signing requires APPLE_ID, APPLE_APP_SPECIFIC_PASSWORD, and APPLE_TEAM_ID for notarization." >&2
            exit 1
          fi

          NOTARY_ZIP="$RUNNER_TEMP/OpenInCode-notarization.zip"
          ditto -c -k --sequesterRsrc --keepParent "$APP_PATH" "$NOTARY_ZIP"
          xcrun notarytool submit "$NOTARY_ZIP" \
            --apple-id "$APPLE_ID" \
            --password "$APPLE_APP_SPECIFIC_PASSWORD" \
            --team-id "$APPLE_TEAM_ID" \
            --wait
          xcrun stapler staple "$APP_PATH"
          xcrun stapler validate "$APP_PATH"
          spctl --assess --type execute --verbose=4 "$APP_PATH"

      - name: Package release
        id: artifact
        env:
          APP_PATH: ${{ steps.app.outputs.path }}
          VERSION: ${{ steps.version.outputs.version }}
          TAG: ${{ steps.version.outputs.tag }}
        run: |
          set -euo pipefail

          FILE="OpenInCode-v${VERSION}.zip"
          ditto -c -k --sequesterRsrc --keepParent "$APP_PATH" "$FILE"
          unzip -l "$FILE" > "$RUNNER_TEMP/openincode-zip-contents.txt"
          grep -F 'Open in Code.app/Contents/MacOS/Open in Code' \
            "$RUNNER_TEMP/openincode-zip-contents.txt" >/dev/null

          SHA256=$(shasum -a 256 "$FILE" | awk '{print $1}')
          {
            echo "filename=$FILE"
            echo "sha256=$SHA256"
            echo "tag=$TAG"
          } >> "$GITHUB_OUTPUT"

      - name: Upload workflow artifact
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: ${{ steps.artifact.outputs.filename }}
          path: ${{ steps.artifact.outputs.filename }}
          retention-days: 30

      - name: Create immutable GitHub release
        id: release
        if: github.event_name == 'push' || inputs.publish
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          TAG: ${{ steps.artifact.outputs.tag }}
          FILE: ${{ steps.artifact.outputs.filename }}
          IS_PRERELEASE: ${{ steps.version.outputs.prerelease }}
        run: |
          set -euo pipefail

          asset_exists() {
            gh release view "$TAG" --json assets --jq '.assets[] | [.name, .state] | @tsv' \
              | awk -F '\t' -v file="$FILE" '
                  $1 == file && $2 == "uploaded" { found = 1 }
                  END { exit(found ? 0 : 1) }
                '
          }

          if ! gh release view "$TAG" >/dev/null 2>&1; then
            if [ "$IS_PRERELEASE" = "true" ]; then
              gh release create "$TAG" "$FILE" \
                --target "${{ steps.version.outputs.commit_sha }}" \
                --title "$TAG" \
                --generate-notes \
                --prerelease || true
            else
              gh release create "$TAG" "$FILE" \
                --target "${{ steps.version.outputs.commit_sha }}" \
                --title "$TAG" \
                --generate-notes || true
            fi

            if ! gh release view "$TAG" >/dev/null 2>&1; then
              echo "Failed to create release $TAG." >&2
              exit 1
            fi
          fi

          if asset_exists; then
            echo "Release $TAG already contains immutable asset $FILE."
          else
            echo "Release $TAG is missing $FILE; restoring the asset without clobbering."
            if ! gh release upload "$TAG" "$FILE"; then
              echo "Asset upload raced with another recovery; verifying the published asset."
              asset_exists || {
                echo "Release $TAG still has no uploaded $FILE asset." >&2
                exit 1
              }
            fi
          fi

          rm -f "$FILE"
          gh release download "$TAG" --pattern "$FILE" --dir .
          PUBLISHED_SHA256=$(shasum -a 256 "$FILE" | awk '{print $1}')
          echo "sha256=$PUBLISHED_SHA256" >> "$GITHUB_OUTPUT"

      - name: Checkout Homebrew tap
        if: (github.event_name == 'push' || inputs.publish) && steps.version.outputs.prerelease != 'true'
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
        with:
          repository: sozercan/homebrew-repo
          ssh-key: ${{ secrets.HOMEBREW_REPO_SSH_KEY }}
          path: homebrew-repo
          fetch-depth: 0

      - name: Publish Homebrew cask
        if: (github.event_name == 'push' || inputs.publish) && steps.version.outputs.prerelease != 'true'
        env:
          VERSION: ${{ steps.version.outputs.version }}
          SHA256: ${{ steps.release.outputs.sha256 }}
          TAG: ${{ steps.artifact.outputs.tag }}
        run: |
          set -euo pipefail

          cd homebrew-repo
          git config user.name "github-actions[bot]"
          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"

          for attempt in 1 2 3 4 5; do
            git fetch origin main
            git reset --hard origin/main

            CURRENT_VERSION="0"
            if [ -f Casks/open-in-code.rb ]; then
              CURRENT_VERSION=$(sed -n 's/^  version "\([^"]*\)"/\1/p' Casks/open-in-code.rb | head -1)
            fi

            if ruby -e '
              require "rubygems"
              current = Gem::Version.new(ARGV.fetch(0))
              candidate = Gem::Version.new(ARGV.fetch(1))
              exit(current > candidate ? 0 : 1)
            ' "$CURRENT_VERSION" "$VERSION"; then
              echo "Homebrew already contains newer version $CURRENT_VERSION; skipping stale release $VERSION."
              exit 0
            fi

            ../scripts/render-homebrew-cask.sh \
              "$VERSION" \
              "$SHA256" \
              Casks/open-in-code.rb
            git add Casks/open-in-code.rb

            if git diff --cached --quiet; then
              echo "Homebrew cask is already up to date."
              exit 0
            fi

            git commit -s -m "Update open-in-code to ${TAG}"
            if git push origin HEAD:main; then
              exit 0
            fi

            echo "Homebrew push attempt $attempt raced with another update; retrying..."
            sleep $((attempt * 5))
          done

          echo "Failed to update the Homebrew cask after retries." >&2
          exit 1