release.yml

name: Release

on:
  push:
    tags:
      - 'v*'

permissions:
  contents: write
  attestations: write
  id-token: write

jobs:
  test:
    name: Test and vet
    runs-on: ubuntu-latest

    steps:
      - name: Check out the exact tag
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          fetch-depth: 0
          persist-credentials: false

      - name: Set up Go
        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6
        with:
          go-version-file: go.mod
          cache-dependency-path: go.sum

      - name: Set up Node
        uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5
        with:
          node-version: 22

      - name: Validate the release tag
        shell: bash
        run: |
          tag="${GITHUB_REF_NAME:?}"
          if ! [[ "$tag" =~ ^v(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)(-([0-9A-Za-z-]+)(\.[0-9A-Za-z-]+)*)?(\+([0-9A-Za-z-]+)(\.[0-9A-Za-z-]+)*)?$ ]]; then
            echo "Release tags must be semantic versions such as v1.2.3 or v1.2.3-beta.1." >&2
            exit 1
          fi

      - name: Run tests
        run: go test ./...

      - name: Run vet
        run: go vet ./...

      - name: Run npm launcher tests
        run: npm --prefix npm test

  release:
    name: Build, attest, and publish
    needs: test
    runs-on: macos-14

    steps:
      - name: Check out the exact tag
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          fetch-depth: 0
          persist-credentials: false

      - name: Set up Go
        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6
        with:
          go-version-file: go.mod
          cache-dependency-path: go.sum

      - name: Set up Node
        uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5
        with:
          node-version: 22

      - name: Set up npm Trusted Publishing support
        run: npm install --global npm@latest

      - name: Run macOS smoke tests
        run: go test ./...

      - name: Build supported binaries and Windows portability check
        env:
          VERSION: ${{ github.ref_name }}
        run: |
          make build VERSION="$VERSION"
          make build-windows VERSION="$VERSION"

      - name: Detect signing and notarization credentials
        id: signing
        env:
          APPLE_DEVELOPER_ID_CERTIFICATE_BASE64: ${{ secrets.APPLE_DEVELOPER_ID_CERTIFICATE_BASE64 }}
          APPLE_DEVELOPER_ID_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_DEVELOPER_ID_CERTIFICATE_PASSWORD }}
          APPLE_DEVELOPER_ID_SIGNING_IDENTITY: ${{ secrets.APPLE_DEVELOPER_ID_SIGNING_IDENTITY }}
          APPLE_NOTARY_ISSUER_ID: ${{ secrets.APPLE_NOTARY_ISSUER_ID }}
          APPLE_NOTARY_KEY_ID: ${{ secrets.APPLE_NOTARY_KEY_ID }}
          APPLE_NOTARY_PRIVATE_KEY: ${{ secrets.APPLE_NOTARY_PRIVATE_KEY }}
          APPLE_NOTARY_TEAM_ID: ${{ secrets.APPLE_NOTARY_TEAM_ID }}
        run: |
          if [ -n "$APPLE_DEVELOPER_ID_CERTIFICATE_BASE64" ] && \
             [ -n "$APPLE_DEVELOPER_ID_CERTIFICATE_PASSWORD" ] && \
             [ -n "$APPLE_DEVELOPER_ID_SIGNING_IDENTITY" ] && \
             [ -n "$APPLE_NOTARY_ISSUER_ID" ] && \
             [ -n "$APPLE_NOTARY_KEY_ID" ] && \
             [ -n "$APPLE_NOTARY_PRIVATE_KEY" ] && \
             [ -n "$APPLE_NOTARY_TEAM_ID" ]; then
            echo 'available=true' >> "$GITHUB_OUTPUT"
          else
            echo 'available=false' >> "$GITHUB_OUTPUT"
          fi

      - name: Sign macOS binaries
        if: ${{ steps.signing.outputs.available == 'true' }}
        env:
          APPLE_DEVELOPER_ID_CERTIFICATE_BASE64: ${{ secrets.APPLE_DEVELOPER_ID_CERTIFICATE_BASE64 }}
          APPLE_DEVELOPER_ID_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_DEVELOPER_ID_CERTIFICATE_PASSWORD }}
          APPLE_DEVELOPER_ID_SIGNING_IDENTITY: ${{ secrets.APPLE_DEVELOPER_ID_SIGNING_IDENTITY }}
        run: |
          certificate="$RUNNER_TEMP/developer-id.p12"
          keychain="$RUNNER_TEMP/daemons-release.keychain-db"
          printf '%s' "$APPLE_DEVELOPER_ID_CERTIFICATE_BASE64" | base64 --decode > "$certificate"
          security create-keychain -p '' "$keychain"
          security set-keychain-settings -lut 21600 "$keychain"
          security unlock-keychain -p '' "$keychain"
          security import "$certificate" -k "$keychain" -P "$APPLE_DEVELOPER_ID_CERTIFICATE_PASSWORD" -T /usr/bin/codesign
          security set-key-partition-list -S apple-tool:,apple: -s -k '' "$keychain"
          for binary in dist/daemons-darwin-amd64 dist/daemons-darwin-arm64; do
            codesign --force --options runtime --timestamp --keychain "$keychain" --sign "$APPLE_DEVELOPER_ID_SIGNING_IDENTITY" "$binary"
            codesign --verify --deep --strict --verbose=2 "$binary"
          done

      - name: Package release archives
        env:
          VERSION: ${{ github.ref_name }}
        run: |
          make package VERSION="$VERSION"
          make verify-archives VERSION="$VERSION"

      - name: Notarize macOS archives
        if: ${{ steps.signing.outputs.available == 'true' }}
        env:
          VERSION: ${{ github.ref_name }}
          APPLE_NOTARY_ISSUER_ID: ${{ secrets.APPLE_NOTARY_ISSUER_ID }}
          APPLE_NOTARY_KEY_ID: ${{ secrets.APPLE_NOTARY_KEY_ID }}
          APPLE_NOTARY_PRIVATE_KEY: ${{ secrets.APPLE_NOTARY_PRIVATE_KEY }}
        run: |
          key="$RUNNER_TEMP/AuthKey_${APPLE_NOTARY_KEY_ID}.p8"
          printf '%s' "$APPLE_NOTARY_PRIVATE_KEY" > "$key"
          chmod 600 "$key"
          for archive in dist/daemons_"$VERSION"_darwin_amd64.zip dist/daemons_"$VERSION"_darwin_arm64.zip; do
            result="$RUNNER_TEMP/$(basename "$archive").notarization.json"
            xcrun notarytool submit "$archive" --key "$key" --key-id "$APPLE_NOTARY_KEY_ID" --issuer "$APPLE_NOTARY_ISSUER_ID" --wait --output-format json > "$result"
            test "$(plutil -extract status raw -o - "$result")" = Accepted
          done

      - name: Generate and verify checksums
        env:
          VERSION: ${{ github.ref_name }}
        run: |
          make checksums VERSION="$VERSION"
          make verify-checksums VERSION="$VERSION"
          binary="dist/daemons-darwin-$(go env GOARCH)"
          test "$("$binary" --version)" = "$VERSION"

      - name: Attest release archives
        uses: actions/attest@1e69f48acb82d1966a394da916b4c1698aa569d6 # v4
        with:
          subject-checksums: dist/SHA256SUMS

      - name: Create a draft release
        env:
          GH_TOKEN: ${{ github.token }}
          VERSION: ${{ github.ref_name }}
        run: |
          if gh release view "$VERSION" --repo "$GITHUB_REPOSITORY" >/dev/null 2>&1; then
            echo "Release $VERSION already exists; continuing."
          else
            gh release create "$VERSION" --repo "$GITHUB_REPOSITORY" --draft --verify-tag --title "daemons $VERSION" --generate-notes
          fi

      - name: Upload and verify every release asset
        env:
          GH_TOKEN: ${{ github.token }}
          VERSION: ${{ github.ref_name }}
        shell: bash
        run: |
          assets=(
            "dist/daemons_${VERSION}_darwin_amd64.zip"
            "dist/daemons_${VERSION}_darwin_arm64.zip"
            "dist/daemons_${VERSION}_linux_amd64.tar.gz"
            "dist/daemons_${VERSION}_linux_arm64.tar.gz"
            'dist/SHA256SUMS'
          )
          gh release upload "$VERSION" "${assets[@]}" --repo "$GITHUB_REPOSITORY" --clobber
          uploaded="$(gh release view "$VERSION" --repo "$GITHUB_REPOSITORY" --json assets --jq '.assets[].name')"
          for asset in "${assets[@]}"; do
            name="$(basename "$asset")"
            grep -Fx "$name" <<< "$uploaded" >/dev/null
          done

      - name: Assemble npm packages from verified release archives
        env:
          VERSION: ${{ github.ref_name }}
        run: |
          npm_version="${VERSION#v}"
          node npm/build-packages.mjs "$npm_version"
          npm --prefix npm test

      - name: Publish npm packages
        env:
          VERSION: ${{ github.ref_name }}
        shell: bash
        run: |
          npm_version="${VERSION#v}"
          for package in npm/platforms/*; do
            package_name="$(node -p "require('./' + process.argv[1]).name" "$package/package.json")"
            if npm view "$package_name@$npm_version" version >/dev/null 2>&1; then
              echo "$package_name@$npm_version already exists on npm; skipping."
            else
              npm publish "$package" --provenance --access public
            fi
          done
          if npm view "daemonsrun@$npm_version" version >/dev/null 2>&1; then
            echo "daemonsrun@$npm_version already exists on npm; skipping."
          else
            npm publish ./npm --provenance --access public
          fi

      - name: Publish the complete release
        env:
          GH_TOKEN: ${{ github.token }}
          VERSION: ${{ github.ref_name }}
        run: gh release edit "$VERSION" --repo "$GITHUB_REPOSITORY" --draft=false

      - name: Remove temporary signing material
        if: ${{ always() && steps.signing.outputs.available == 'true' }}
        run: rm -rf "$RUNNER_TEMP/daemons-release.keychain-db" "$RUNNER_TEMP/developer-id.p12" "$RUNNER_TEMP"/AuthKey_*.p8 "$RUNNER_TEMP"/*.notarization.json