macos.yaml

name: macos

on:
  push:
    branches:
      - main
    tags:
      - '[0-9]+.[0-9]+.[0-9]+'
  pull_request:
    types: [opened, synchronize]
  workflow_dispatch:

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:

  macos-build:
    runs-on: ${{ matrix.config.os }}
    strategy:
      fail-fast: false
      matrix:
        config:
          - { os: macos-14, arch: x64 }
          - { os: macos-14, arch: arm64 }

    steps:
      - name: Sync repository
        uses: actions/checkout@v6

      - name: Install Conan
        uses: conan-io/setup-conan@v1
        with:
          cache_packages: true

      - name: Install and cache Homebrew tools
        uses: tecolicom/actions-use-homebrew-tools@v1
        with:
          tools: qt@5 create-dmg
          cache: yes

      - name: Conan install
        run: |
          conan install . -of build --build=missing -pr:b=default -s build_type=Release -s compiler.cppstd=17

      - name: Build PlotJuggler
        run: |
          export CMAKE_PREFIX_PATH=$(brew --prefix qt@5)
          cmake --preset conan-release -S . -B build -DPJ_INSTALLATION="macos"
          cmake --build build --config Release

      - name: Create .app bundle
        if: startsWith(github.ref, 'refs/tags/') || github.event_name == 'workflow_dispatch'
        run: |
          mkdir -p PlotJuggler.app/Contents/MacOS
          mkdir -p PlotJuggler.app/Contents/Resources

          # Copy binary and all plugins from build/bin
          cp -r build/bin/* PlotJuggler.app/Contents/MacOS/

          # Copy icon (macOS supports PNG directly)
          cp plotjuggler.png PlotJuggler.app/Contents/Resources/plotjuggler.png

          # Create Info.plist
          cat > PlotJuggler.app/Contents/Info.plist <<EOF
          <?xml version="1.0" encoding="UTF-8"?>
          <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
          <plist version="1.0">
          <dict>
            <key>CFBundleExecutable</key>
            <string>plotjuggler</string>
            <key>CFBundleIdentifier</key>
            <string>io.plotjuggler.application</string>
            <key>CFBundleName</key>
            <string>PlotJuggler</string>
            <key>CFBundleVersion</key>
            <string>${{ github.ref_name }}</string>
            <key>CFBundleShortVersionString</key>
            <string>${{ github.ref_name }}</string>
            <key>CFBundlePackageType</key>
            <string>APPL</string>
            <key>CFBundleIconFile</key>
            <string>plotjuggler.png</string>
            <key>LSMinimumSystemVersion</key>
            <string>10.15</string>
            <key>NSHighResolutionCapable</key>
            <true/>
          </dict>
          </plist>
          EOF

      - name: Bundle Qt dependencies
        if: startsWith(github.ref, 'refs/tags/') || github.event_name == 'workflow_dispatch'
        run: |
          export PATH="$(brew --prefix qt@5)/bin:$PATH"
          macdeployqt PlotJuggler.app -verbose=2

      - name: Import Code Signing Certificate
        if: startsWith(github.ref, 'refs/tags/') || github.event_name == 'workflow_dispatch'
        uses: apple-actions/import-codesign-certs@v6
        with:
          p12-file-base64: ${{ secrets.MACOS_CERTIFICATE }}
          p12-password: ${{ secrets.MACOS_CERTIFICATE_PWD }}

      - name: List signing identities
        if: startsWith(github.ref, 'refs/tags/') || github.event_name == 'workflow_dispatch'
        run: |
          echo "=== Available signing identities ==="
          security find-identity -v -p codesigning

      - name: Sign Application Bundle
        if: startsWith(github.ref, 'refs/tags/') || github.event_name == 'workflow_dispatch'
        env:
          MACOS_SIGNING_IDENTITY: ${{ secrets.MACOS_SIGNING_IDENTITY }}
        run: |
          # Sign all nested binaries, libraries, and frameworks first
          find PlotJuggler.app -type f \( -name "*.dylib" -o -name "*.so" -o -perm +111 \) -exec \
            /usr/bin/codesign --force --options runtime --sign "$MACOS_SIGNING_IDENTITY" --timestamp {} \;

          # Sign all frameworks
          find PlotJuggler.app/Contents/Frameworks -type d -name "*.framework" -exec \
            /usr/bin/codesign --force --options runtime --sign "$MACOS_SIGNING_IDENTITY" --timestamp {} \; 2>/dev/null || true

          # Sign the main app bundle
          /usr/bin/codesign --force --options runtime --sign "$MACOS_SIGNING_IDENTITY" --timestamp --deep PlotJuggler.app

          # Verify the signature
          /usr/bin/codesign --verify --deep --strict --verbose=2 PlotJuggler.app

      - name: Create DMG
        if: startsWith(github.ref, 'refs/tags/') || github.event_name == 'workflow_dispatch'
        run: |
          DMG_NAME="PlotJuggler-${{ github.ref_name }}-macOS-${{ matrix.config.arch }}.dmg"

          create-dmg \
            --volname "PlotJuggler" \
            --window-pos 200 120 \
            --window-size 800 400 \
            --icon-size 100 \
            --icon "PlotJuggler.app" 200 190 \
            --hide-extension "PlotJuggler.app" \
            --app-drop-link 600 185 \
            --no-internet-enable \
            "$DMG_NAME" \
            "PlotJuggler.app" || true

          # create-dmg may fail if DMG already exists, but creates it anyway
          # Verify DMG was created
          if [ ! -f "$DMG_NAME" ]; then
            echo "DMG creation failed, trying fallback method"
            hdiutil create -volname "PlotJuggler" -srcfolder PlotJuggler.app -ov -format UDZO "$DMG_NAME"
          fi

      - name: Sign DMG
        if: startsWith(github.ref, 'refs/tags/') || github.event_name == 'workflow_dispatch'
        env:
          MACOS_SIGNING_IDENTITY: ${{ secrets.MACOS_SIGNING_IDENTITY }}
        run: |
          DMG_NAME="PlotJuggler-${{ github.ref_name }}-macOS-${{ matrix.config.arch }}.dmg"
          /usr/bin/codesign --force --sign "$MACOS_SIGNING_IDENTITY" --timestamp "$DMG_NAME"
          /usr/bin/codesign --verify --verbose=2 "$DMG_NAME"

      - name: Notarize DMG
        if: startsWith(github.ref, 'refs/tags/') || github.event_name == 'workflow_dispatch'
        env:
          APPLE_ID: ${{ secrets.APPLE_ID }}
          APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
          APPLE_APP_PASSWORD: ${{ secrets.APPLE_APP_PASSWORD }}
        run: |
          DMG_NAME="PlotJuggler-${{ github.ref_name }}-macOS-${{ matrix.config.arch }}.dmg"

          # Submit for notarization with S3 acceleration and timeout
          xcrun notarytool submit "$DMG_NAME" \
            --apple-id "$APPLE_ID" \
            --team-id "$APPLE_TEAM_ID" \
            --password "$APPLE_APP_PASSWORD" \
            --wait \
            --timeout 30m \
            --s3-acceleration

          # Staple the notarization ticket to the DMG
          xcrun stapler staple "$DMG_NAME"

      - name: Upload DMG artifact
        if: startsWith(github.ref, 'refs/tags/') || github.event_name == 'workflow_dispatch'
        uses: actions/upload-artifact@v7
        with:
          name: PlotJuggler-${{ github.ref_name }}-macOS-${{ matrix.config.arch }}.dmg
          path: PlotJuggler-${{ github.ref_name }}-macOS-${{ matrix.config.arch }}.dmg

      - name: Upload to Release
        if: startsWith(github.ref, 'refs/tags/')
        uses: softprops/action-gh-release@v2
        with:
          files: PlotJuggler-${{ github.ref_name }}-macOS-${{ matrix.config.arch }}.dmg
          generate_release_notes: false
          fail_on_unmatched_files: false