release.yml

name: Release

on:
  push:
    tags:
      - 'v*'

permissions:
  contents: read
  id-token: write

jobs:
  goreleaser:
    name: GoReleaser
    permissions:
      contents: write
    runs-on: ubuntu-latest
    steps:
      - name: Harden the runner (Audit all outbound calls)
        uses: step-security/harden-runner@6c3c2f2c1c457b00c10c4848d6f5491db3b629df # v2.18.0
        with:
          egress-policy: audit

      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
        with:
          fetch-depth: 0
          persist-credentials: false

      - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6
        with:
          go-version-file: 'go.mod'

      - uses: goreleaser/goreleaser-action@9a127d869fb706213d29cdf8eef3a4ea2b869415 # v7
        with:
          version: '~> v2'
          args: release --clean
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          HOMEBREW_TAP_TOKEN: ${{ secrets.HOMEBREW_TAP_TOKEN }}

  sign-stable:
    name: Sign & Notarize Stable
    needs: goreleaser
    if: vars.SIGNING_ENABLED == 'true'
    permissions:
      contents: write
    environment: release
    runs-on: macos-latest
    steps:
      - name: Harden the runner (Audit all outbound calls)
        uses: step-security/harden-runner@6c3c2f2c1c457b00c10c4848d6f5491db3b629df # v2.18.0
        with:
          egress-policy: audit

      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
        with:
          persist-credentials: false

      - name: Extract version from tag
        id: version
        run: |
          TAG="${GITHUB_REF_NAME}"
          VERSION="${TAG#v}"
          echo "tag=$TAG" >> "$GITHUB_OUTPUT"
          echo "version=$VERSION" >> "$GITHUB_OUTPUT"

      - name: Import certificates
        env:
          APPLE_CERTIFICATE_P12: ${{ secrets.APPLE_CERTIFICATE_P12 }}
          APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
        run: |
          # Create temporary keychain
          security create-keychain -p "" build.keychain
          security default-keychain -s build.keychain
          security unlock-keychain -p "" build.keychain

          # Import application certificate
          echo "$APPLE_CERTIFICATE_P12" | base64 --decode > cert.p12
          security import cert.p12 -k build.keychain -P "$APPLE_CERTIFICATE_PASSWORD" -T /usr/bin/codesign
          rm cert.p12

          # Install Apple Developer ID G2 intermediate certificate
          curl -sfo /tmp/DeveloperIDG2CA.cer https://www.apple.com/certificateauthority/DeveloperIDG2CA.cer
          security add-certificates -k build.keychain /tmp/DeveloperIDG2CA.cer
          rm /tmp/DeveloperIDG2CA.cer

          # Allow codesign to access keychain without prompting
          security set-key-partition-list -S apple-tool:,apple: -s -k "" build.keychain

      - name: Download darwin archives from release
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          VERSION="${{ steps.version.outputs.version }}"

          # Download darwin tar.gz archives and checksums from the GoReleaser release
          gh release download "${{ steps.version.outputs.tag }}" \
            --pattern "threedoors_${VERSION}_darwin_arm64.tar.gz" \
            --pattern "threedoors_${VERSION}_darwin_amd64.tar.gz" \
            --pattern "checksums.txt"

          echo "Downloaded release assets:"
          ls -la threedoors_*.tar.gz checksums.txt

      - name: Extract, sign, and re-archive darwin binaries
        env:
          APPLE_SIGNING_IDENTITY: ${{ secrets.APPLE_SIGNING_IDENTITY }}
        run: |
          VERSION="${{ steps.version.outputs.version }}"

          for ARCH in arm64 amd64; do
            ARCHIVE="threedoors_${VERSION}_darwin_${ARCH}.tar.gz"
            WORKDIR="work-${ARCH}"

            echo "=== Processing ${ARCHIVE} ==="

            # Extract archive preserving structure
            mkdir -p "$WORKDIR"
            tar xzf "$ARCHIVE" -C "$WORKDIR"

            # Sign the binary
            codesign --force --options runtime \
              --sign "$APPLE_SIGNING_IDENTITY" \
              --identifier "com.arcavenae.threedoors" \
              --timestamp \
              "${WORKDIR}/threedoors"

            # Verify signature
            codesign --verify --deep --strict "${WORKDIR}/threedoors"
            echo "Signature verified for ${ARCH}"

            # Re-archive with signed binary (preserving original archive contents)
            rm "$ARCHIVE"
            tar czf "$ARCHIVE" -C "$WORKDIR" .

            rm -rf "$WORKDIR"
          done

      - name: Notarize signed binaries
        env:
          APPLE_NOTARIZATION_APPLE_ID: ${{ secrets.APPLE_NOTARIZATION_APPLE_ID }}
          APPLE_NOTARIZATION_PASSWORD: ${{ secrets.APPLE_NOTARIZATION_PASSWORD }}
          APPLE_NOTARIZATION_TEAM_ID: ${{ secrets.APPLE_NOTARIZATION_TEAM_ID }}
        run: |
          VERSION="${{ steps.version.outputs.version }}"

          for ARCH in arm64 amd64; do
            ARCHIVE="threedoors_${VERSION}_darwin_${ARCH}.tar.gz"

            # Notarization requires a zip — wrap the tar.gz for submission
            ZIP_FOR_NOTARIZATION="threedoors_${VERSION}_darwin_${ARCH}_notarize.zip"
            ditto -c -k --keepParent "$ARCHIVE" "$ZIP_FOR_NOTARIZATION"

            echo "Notarizing ${ARCH} binary..."
            xcrun notarytool submit "$ZIP_FOR_NOTARIZATION" \
              --apple-id "$APPLE_NOTARIZATION_APPLE_ID" \
              --password "$APPLE_NOTARIZATION_PASSWORD" \
              --team-id "$APPLE_NOTARIZATION_TEAM_ID" \
              --wait --timeout 14400

            rm "$ZIP_FOR_NOTARIZATION"
          done

      - name: Import installer certificate
        env:
          APPLE_INSTALLER_CERTIFICATE_P12: ${{ secrets.APPLE_INSTALLER_CERTIFICATE_P12 }}
          APPLE_INSTALLER_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_INSTALLER_CERTIFICATE_PASSWORD }}
        run: |
          echo "$APPLE_INSTALLER_CERTIFICATE_P12" | base64 --decode > installer-cert.p12
          security import installer-cert.p12 -k build.keychain \
            -P "$APPLE_INSTALLER_CERTIFICATE_PASSWORD" \
            -T /usr/bin/productbuild -T /usr/bin/pkgbuild
          rm installer-cert.p12

          # Re-apply partition list so pkgbuild/productbuild can access the key
          security set-key-partition-list -S apple-tool:,apple: -s -k "" build.keychain

      - name: Build macOS pkg installers
        env:
          APPLE_INSTALLER_IDENTITY: ${{ secrets.APPLE_INSTALLER_IDENTITY }}
        run: |
          VERSION="${{ steps.version.outputs.version }}"

          for ARCH in arm64 amd64; do
            ARCHIVE="threedoors_${VERSION}_darwin_${ARCH}.tar.gz"
            PKG="threedoors_${VERSION}_darwin_${ARCH}.pkg"
            WORKDIR="pkg-work-${ARCH}"

            echo "=== Building pkg for ${ARCH} ==="

            # Extract the signed binary from the archive
            mkdir -p "$WORKDIR"
            tar xzf "$ARCHIVE" -C "$WORKDIR"

            # Use the existing create-pkg.sh script
            chmod +x scripts/create-pkg.sh
            ./scripts/create-pkg.sh \
              "${WORKDIR}/threedoors" \
              "$VERSION" \
              "$APPLE_INSTALLER_IDENTITY" \
              "$PKG"

            # Verify pkg signature
            pkgutil --check-signature "$PKG"
            echo "pkg signature verified for ${ARCH}"

            rm -rf "$WORKDIR"
          done

      - name: Notarize pkg installers
        env:
          APPLE_NOTARIZATION_APPLE_ID: ${{ secrets.APPLE_NOTARIZATION_APPLE_ID }}
          APPLE_NOTARIZATION_PASSWORD: ${{ secrets.APPLE_NOTARIZATION_PASSWORD }}
          APPLE_NOTARIZATION_TEAM_ID: ${{ secrets.APPLE_NOTARIZATION_TEAM_ID }}
        run: |
          VERSION="${{ steps.version.outputs.version }}"

          for ARCH in arm64 amd64; do
            PKG="threedoors_${VERSION}_darwin_${ARCH}.pkg"

            echo "Notarizing ${ARCH} pkg..."
            xcrun notarytool submit "$PKG" \
              --apple-id "$APPLE_NOTARIZATION_APPLE_ID" \
              --password "$APPLE_NOTARIZATION_PASSWORD" \
              --team-id "$APPLE_NOTARIZATION_TEAM_ID" \
              --wait --timeout 14400

            # Staple the notarization ticket to the pkg
            xcrun stapler staple "$PKG"
            echo "Notarization stapled for ${ARCH} pkg"
          done

      - name: Update checksums and re-upload to release
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          VERSION="${{ steps.version.outputs.version }}"
          TAG="${{ steps.version.outputs.tag }}"

          # Recalculate checksums for the signed darwin archives
          for ARCH in arm64 amd64; do
            ARCHIVE="threedoors_${VERSION}_darwin_${ARCH}.tar.gz"
            NEW_CHECKSUM=$(shasum -a 256 "$ARCHIVE" | cut -d' ' -f1)

            # Replace the old checksum line for this archive in checksums.txt
            sed -i '' "s|^[a-f0-9]*  ${ARCHIVE}$|${NEW_CHECKSUM}  ${ARCHIVE}|" checksums.txt
          done

          # Add or replace checksums for pkg installers
          for ARCH in arm64 amd64; do
            PKG="threedoors_${VERSION}_darwin_${ARCH}.pkg"
            NEW_CHECKSUM=$(shasum -a 256 "$PKG" | cut -d' ' -f1)

            if grep -q "  ${PKG}$" checksums.txt; then
              # Replace existing pkg checksum (idempotent re-run)
              sed -i '' "s|^[a-f0-9]*  ${PKG}$|${NEW_CHECKSUM}  ${PKG}|" checksums.txt
            else
              # First run — append pkg checksum
              echo "${NEW_CHECKSUM}  ${PKG}" >> checksums.txt
            fi
          done

          echo "Updated checksums.txt:"
          cat checksums.txt

          # Re-upload signed archives, pkg installers, and updated checksums (--clobber replaces existing)
          gh release upload "$TAG" --clobber \
            "threedoors_${VERSION}_darwin_arm64.tar.gz" \
            "threedoors_${VERSION}_darwin_amd64.tar.gz" \
            "threedoors_${VERSION}_darwin_arm64.pkg" \
            "threedoors_${VERSION}_darwin_amd64.pkg" \
            checksums.txt

      - name: Cleanup keychain
        if: always()
        run: security delete-keychain build.keychain || true