ci.yml

# CI + Alpha Release
# Triggers: push to develop (alpha releases), pull requests to develop or main
# Builds binaries for all platforms, signs/notarizes, creates pre-release, updates homebrew-tap
name: CI

on:
  push:
    branches: [develop]
    paths-ignore:
      - '*.md'
      - 'docs/**'
      - 'LICENSE'
      - '.gitignore'
      - '_kos/**'
      - '_bmad/**'
      - '_bmad-custom/**'
      - '_bmad-output/**'
      - '.github/workflows/release.yml'
  pull_request:
    branches: [develop, main]

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

permissions:
  contents: read
  pull-requests: write

jobs:
  quality-gate:
    name: Quality Gate
    runs-on: ubuntu-latest
    timeout-minutes: 10
    steps:
      - name: Harden the runner (Audit all outbound calls)
        uses: step-security/harden-runner@8d3c67de8e2fe68ef647c8db1e6a09f647780f40 # v2.19.0
        with:
          egress-policy: audit

      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
        with:
          persist-credentials: false

      - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6
        with:
          go-version-file: 'go.mod'

      - name: Install gofumpt
        run: go install mvdan.cc/gofumpt@v0.7.0

      - name: Check formatting (gofumpt)
        run: |
          UNFORMATTED=$(gofumpt -l .)
          if [ -n "$UNFORMATTED" ]; then
            echo "::error::Files need formatting with gofumpt:"
            echo "$UNFORMATTED"
            exit 1
          fi

      - name: Run go vet
        run: go vet ./...

      - name: Run golangci-lint
        uses: golangci/golangci-lint-action@1e7e51e771db61008b38414a730f564565cf7c20 # v9

      - name: Run tests with coverage and race detector
        run: go test ./... -v -count=1 -race -coverprofile=coverage.out -covermode=atomic

      - name: Display coverage summary
        run: go tool cover -func=coverage.out

      - name: Enforce coverage floor
        env:
          COVERAGE_THRESHOLD: '75'
        run: |
          COVERAGE=$(go tool cover -func=coverage.out | grep '^total:' | awk '{print $NF}' | tr -d '%')
          echo "Total coverage: ${COVERAGE}%  (threshold: ${COVERAGE_THRESHOLD}%)"
          if [ "$(echo "$COVERAGE < $COVERAGE_THRESHOLD" | bc -l)" -eq 1 ]; then
            echo "::error::Coverage ${COVERAGE}% is below the ${COVERAGE_THRESHOLD}% threshold"
            exit 1
          fi

      - name: Post coverage comment on PR
        if: github.event_name == 'pull_request'
        continue-on-error: true
        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
        with:
          script: |
            const fs = require('fs');
            const { execSync } = require('child_process');
            const summary = execSync('go tool cover -func=coverage.out').toString();
            const totalLine = summary.split('\n').find(l => l.startsWith('total:'));
            const coverage = totalLine ? totalLine.match(/[\d.]+%/)?.[0] : 'unknown';
            const body = `## Coverage Report\n\n**Total coverage: ${coverage}**\n\n<details>\n<summary>Package breakdown</summary>\n\n\`\`\`\n${summary}\`\`\`\n</details>`;
            const { data: comments } = await github.rest.issues.listComments({
              owner: context.repo.owner,
              repo: context.repo.repo,
              issue_number: context.issue.number,
            });
            const existing = comments.find(c => c.body.startsWith('## Coverage Report'));
            if (existing) {
              await github.rest.issues.updateComment({
                owner: context.repo.owner,
                repo: context.repo.repo,
                comment_id: existing.id,
                body,
              });
            } else {
              await github.rest.issues.createComment({
                owner: context.repo.owner,
                repo: context.repo.repo,
                issue_number: context.issue.number,
                body,
              });
            }

      - name: Validate build
        run: go build -o /dev/null ./cmd/switchboard

  build-binaries:
    name: Build Binaries
    needs: quality-gate
    if: github.event_name == 'push' && github.ref == 'refs/heads/develop'
    runs-on: ubuntu-latest
    steps:
      - name: Harden the runner (Audit all outbound calls)
        uses: step-security/harden-runner@8d3c67de8e2fe68ef647c8db1e6a09f647780f40 # v2.19.0
        with:
          egress-policy: audit

      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
        with:
          persist-credentials: false

      - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6
        with:
          go-version-file: 'go.mod'

      - name: Generate version
        id: version
        run: |
          VERSION="0.1.0-alpha.$(date -u +%Y%m%d).${GITHUB_SHA::7}"
          TAG="alpha-$(date -u +%Y%m%d-%H%M%S)-${GITHUB_SHA::7}"
          echo "version=$VERSION" >> "$GITHUB_OUTPUT"
          echo "tag=$TAG" >> "$GITHUB_OUTPUT"

      - name: Build alpha binaries
        run: |
          LDFLAGS="-X main.version=${{ steps.version.outputs.version }}"
          GOOS=darwin GOARCH=arm64 go build -ldflags "$LDFLAGS" -o switchboard-a-darwin-arm64 ./cmd/switchboard
          GOOS=darwin GOARCH=amd64 go build -ldflags "$LDFLAGS" -o switchboard-a-darwin-amd64 ./cmd/switchboard
          GOOS=linux GOARCH=amd64 go build -ldflags "$LDFLAGS" -o switchboard-a-linux-amd64 ./cmd/switchboard
          GOOS=linux GOARCH=arm64 go build -ldflags "$LDFLAGS" -o switchboard-a-linux-arm64 ./cmd/switchboard

      - name: Upload binaries
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        with:
          name: binaries
          path: switchboard-a-*
          retention-days: 14

    outputs:
      version: ${{ steps.version.outputs.version }}
      tag: ${{ steps.version.outputs.tag }}

  sign-and-notarize:
    name: Sign & Notarize
    needs: build-binaries
    if: vars.SIGNING_ENABLED == 'true'
    environment: release
    runs-on: macos-latest
    steps:
      - name: Harden the runner (Audit all outbound calls)
        uses: step-security/harden-runner@8d3c67de8e2fe68ef647c8db1e6a09f647780f40 # v2.19.0
        with:
          egress-policy: audit

      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
        with:
          persist-credentials: false

      - name: Download binaries
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
        with:
          name: binaries

      - name: Import certificates
        env:
          APPLE_CERTIFICATE_P12: ${{ secrets.APPLE_CERTIFICATE_P12 }}
          APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
          APPLE_INSTALLER_CERTIFICATE_P12: ${{ secrets.APPLE_INSTALLER_CERTIFICATE_P12 }}
          APPLE_INSTALLER_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_INSTALLER_CERTIFICATE_PASSWORD }}
        run: |
          security create-keychain -p "" build.keychain
          security default-keychain -s build.keychain
          security unlock-keychain -p "" build.keychain

          echo "$APPLE_CERTIFICATE_P12" | base64 --decode > cert.p12
          security import cert.p12 -k build.keychain -P "$APPLE_CERTIFICATE_PASSWORD" -T /usr/bin/codesign
          rm cert.p12

          echo "$APPLE_INSTALLER_CERTIFICATE_P12" | base64 --decode > installer-cert.p12
          security import installer-cert.p12 -k build.keychain -P "$APPLE_INSTALLER_CERTIFICATE_PASSWORD" -T /usr/bin/pkgbuild -T /usr/bin/productbuild -T /usr/bin/productsign
          rm installer-cert.p12

          curl -sfo /tmp/DeveloperIDG2CA.cer https://www.apple.com/certificateauthority/DeveloperIDG2CA.cer
          security add-certificates -k build.keychain /tmp/DeveloperIDG2CA.cer
          rm /tmp/DeveloperIDG2CA.cer

          security set-key-partition-list -S apple-tool:,apple: -s -k "" build.keychain

      - name: Sign darwin binaries
        env:
          APPLE_SIGNING_IDENTITY: ${{ secrets.APPLE_SIGNING_IDENTITY }}
        run: |
          codesign --force --options runtime --sign "$APPLE_SIGNING_IDENTITY" --timestamp switchboard-a-darwin-arm64
          codesign --force --options runtime --sign "$APPLE_SIGNING_IDENTITY" --timestamp switchboard-a-darwin-amd64

      - name: Verify signatures
        run: |
          codesign --verify --deep --strict switchboard-a-darwin-arm64
          codesign --verify --deep --strict switchboard-a-darwin-amd64

      - name: Build app bundles
        run: |
          VERSION="${{ needs.build-binaries.outputs.version }}"
          chmod +x scripts/create-app.sh

          ./scripts/create-app.sh switchboard-a-darwin-arm64 "$VERSION" .
          mv Switchboard.app Switchboard-arm64.app

          ./scripts/create-app.sh switchboard-a-darwin-amd64 "$VERSION" .
          mv Switchboard.app Switchboard-amd64.app

      - name: Sign app bundles
        env:
          APPLE_SIGNING_IDENTITY: ${{ secrets.APPLE_SIGNING_IDENTITY }}
        run: |
          codesign --force --deep --options runtime --sign "$APPLE_SIGNING_IDENTITY" --timestamp Switchboard-arm64.app
          codesign --force --deep --options runtime --sign "$APPLE_SIGNING_IDENTITY" --timestamp Switchboard-amd64.app

      - name: Build dmg images
        run: |
          VERSION="${{ needs.build-binaries.outputs.version }}"
          chmod +x scripts/create-dmg.sh

          ./scripts/create-dmg.sh Switchboard-arm64.app "$VERSION" switchboard-arm64.dmg
          ./scripts/create-dmg.sh Switchboard-amd64.app "$VERSION" switchboard-amd64.dmg

      - name: Build pkg installers
        env:
          APPLE_INSTALLER_IDENTITY: ${{ secrets.APPLE_INSTALLER_IDENTITY }}
        run: |
          if ! security find-identity -v build.keychain | grep -q "$APPLE_INSTALLER_IDENTITY"; then
            echo "::error::APPLE_INSTALLER_IDENTITY not found in keychain"
            security find-identity -v build.keychain
            exit 1
          fi

          VERSION="${{ needs.build-binaries.outputs.version }}"
          chmod +x scripts/create-pkg.sh

          ./scripts/create-pkg.sh switchboard-a-darwin-arm64 "$VERSION" "$APPLE_INSTALLER_IDENTITY" switchboard-arm64.pkg
          ./scripts/create-pkg.sh switchboard-a-darwin-amd64 "$VERSION" "$APPLE_INSTALLER_IDENTITY" switchboard-amd64.pkg

      - name: Notarize and staple all artifacts
        env:
          APPLE_NOTARIZATION_APPLE_ID: ${{ secrets.APPLE_NOTARIZATION_APPLE_ID }}
          APPLE_NOTARIZATION_PASSWORD: ${{ secrets.APPLE_NOTARIZATION_PASSWORD }}
          APPLE_NOTARIZATION_TEAM_ID: ${{ secrets.APPLE_NOTARIZATION_TEAM_ID }}
        run: |
          for ARTIFACT in switchboard-arm64.pkg switchboard-amd64.pkg switchboard-arm64.dmg switchboard-amd64.dmg; do
            echo "Notarizing $ARTIFACT..."
            xcrun notarytool submit "$ARTIFACT" \
              --apple-id "$APPLE_NOTARIZATION_APPLE_ID" \
              --password "$APPLE_NOTARIZATION_PASSWORD" \
              --team-id "$APPLE_NOTARIZATION_TEAM_ID" \
              --wait --timeout 14400
            xcrun stapler staple "$ARTIFACT"
          done

      - name: Upload signed binaries and installers
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        with:
          name: signed-binaries
          path: |
            switchboard-a-darwin-arm64
            switchboard-a-darwin-amd64
            switchboard-arm64.pkg
            switchboard-amd64.pkg
            switchboard-arm64.dmg
            switchboard-amd64.dmg
          retention-days: 14

      - name: Cleanup keychain
        if: always()
        run: security delete-keychain build.keychain || true

  alpha-release:
    name: Create Alpha Release
    needs: [build-binaries, sign-and-notarize]
    if: |
      always() &&
      needs.build-binaries.result == 'success' &&
      (needs.sign-and-notarize.result == 'success' || needs.sign-and-notarize.result == 'skipped')
    permissions:
      contents: write
    environment: release
    runs-on: ubuntu-latest
    steps:
      - name: Harden the runner (Audit all outbound calls)
        uses: step-security/harden-runner@8d3c67de8e2fe68ef647c8db1e6a09f647780f40 # v2.19.0
        with:
          egress-policy: audit

      - name: Download signed binaries
        if: needs.sign-and-notarize.result == 'success'
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
        with:
          name: signed-binaries
          path: dist/

      - name: Download unsigned binaries (fallback)
        if: needs.sign-and-notarize.result != 'success'
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
        with:
          name: binaries
          path: dist/

      - name: Download all binaries (for linux)
        if: needs.sign-and-notarize.result == 'success'
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
        with:
          name: binaries
          path: unsigned/

      - name: Collect linux binaries
        if: needs.sign-and-notarize.result == 'success'
        run: |
          cp unsigned/switchboard-a-linux-* dist/
          rm -rf unsigned

      - name: List release files
        run: ls -la dist/

      - name: Create pre-release
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          TAG="${{ needs.build-binaries.outputs.tag }}"
          gh release create "$TAG" \
            --repo "${{ github.repository }}" \
            --prerelease \
            --title "Alpha: $TAG" \
            --notes "$(cat <<NOTES
          Automated alpha release from develop.

          **Version:** ${{ needs.build-binaries.outputs.version }}
          **Commit:** ${{ github.sha }}
          **Signed:** ${{ needs.sign-and-notarize.result == 'success' && 'Yes (Apple Developer ID)' || 'No (unsigned)' }}

          **Binaries:**
          - \`switchboard-a-darwin-arm64\` — macOS Apple Silicon
          - \`switchboard-a-darwin-amd64\` — macOS Intel
          - \`switchboard-a-linux-amd64\` — Linux x86_64
          - \`switchboard-a-linux-arm64\` — Linux ARM64
          NOTES
          )" \
            dist/*

      - name: Clean old alpha releases (keep 30)
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          gh release list --repo "${{ github.repository }}" \
            --json tagName,isPrerelease \
            --jq '[.[] | select(.isPrerelease)] | sort_by(.tagName) | reverse | .[30:] | .[].tagName' \
          | while read -r tag; do
              echo "Deleting old alpha release: $tag"
              gh release delete "$tag" --repo "${{ github.repository }}" --yes --cleanup-tag
            done

  update-homebrew:
    name: Update Homebrew Tap (Alpha)
    needs: [build-binaries, sign-and-notarize, alpha-release]
    if: needs.alpha-release.result == 'success' && needs.sign-and-notarize.result == 'success'
    environment: release
    runs-on: ubuntu-latest
    steps:
      - name: Harden the runner (Audit all outbound calls)
        uses: step-security/harden-runner@8d3c67de8e2fe68ef647c8db1e6a09f647780f40 # v2.19.0
        with:
          egress-policy: audit

      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
        with:
          persist-credentials: false

      - name: Download signed binaries
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
        with:
          name: signed-binaries

      - name: Update Homebrew formula
        env:
          HOMEBREW_TAP_TOKEN: ${{ secrets.HOMEBREW_TAP_TOKEN }}
        run: |
          TAG="${{ needs.build-binaries.outputs.tag }}"
          VERSION="${{ needs.build-binaries.outputs.version }}"

          SHA256_ARM64=$(shasum -a 256 switchboard-a-darwin-arm64 | cut -d' ' -f1)
          SHA256_AMD64=$(shasum -a 256 switchboard-a-darwin-amd64 | cut -d' ' -f1)

          git clone "https://x-access-token:${HOMEBREW_TAP_TOKEN}@github.com/ArcavenAE/homebrew-tap.git" homebrew-tap-repo
          cd homebrew-tap-repo

          mkdir -p Formula
          cp ../Formula/switchboard.rb Formula/switchboard.rb

          sed -i "s/VERSION_PLACEHOLDER/$VERSION/g" Formula/switchboard.rb
          sed -i "s/TAG_PLACEHOLDER/$TAG/g" Formula/switchboard.rb
          sed -i "s/SHA256_ARM64_PLACEHOLDER/$SHA256_ARM64/g" Formula/switchboard.rb
          sed -i "s/SHA256_AMD64_PLACEHOLDER/$SHA256_AMD64/g" Formula/switchboard.rb

          git config user.name "github-actions[bot]"
          git config user.email "github-actions[bot]@users.noreply.github.com"
          git add Formula/switchboard.rb
          git diff --cached --quiet || git commit -m "Update switchboard to $VERSION"
          git push