release.yml

# Release
# =======
# Release pipeline triggered via workflow_dispatch.
# Delegates to org-infra reusable workflows for preflight
# validation and GoReleaser execution with supply chain
# artifacts (cosign signatures and SBOMs).
#
# Preflight validates semver format, tag uniqueness (with
# re-run resilience), semver ordering, CI check status,
# and unreleased commits before creating an annotated tag.
#
# After release, signs macOS archives with Apple Developer
# ID and notarizes them. A dedicated publish-cask job then
# downloads the final archive (signed or unsigned) from the
# GitHub Release, computes the SHA from the actual artifact,
# patches the Homebrew cask, and pushes to the tap.
#
# Fixes: https://github.com/unbound-force/unbound-force/issues/428

name: Release

on:
  workflow_dispatch:
    inputs:
      tag:
        description: 'Release tag (e.g., v0.2.0)'
        required: true
        type: string
      skip_semver_check:
        description: 'Skip semver ordering verification'
        type: boolean
        default: false
      skip_ci_checks:
        description: 'Skip CI check verification on HEAD'
        type: boolean
        default: false
      skip_unreleased_check:
        description: 'Skip unreleased commits verification'
        type: boolean
        default: false

permissions: {}

jobs:
  preflight:
    name: Preflight
    uses: complytime/org-infra/.github/workflows/reusable_release_preflight.yml@0c784711926c9864f027ec565fd7c06a382d80f8 # v0.7.1
    with:
      tag: ${{ inputs.tag }}
      allow_prerelease: true
      ci_checks: '["Build and Test"]'
      skip_semver_check: ${{ inputs.skip_semver_check }}
      skip_ci_checks: ${{ inputs.skip_ci_checks }}
      skip_unreleased_check: ${{ inputs.skip_unreleased_check }}
    permissions:
      contents: write
      checks: read

  release:
    name: Release
    needs: preflight
    if: needs.preflight.outputs.tag != ''
    uses: complytime/org-infra/.github/workflows/reusable_release_goreleaser.yml@0c784711926c9864f027ec565fd7c06a382d80f8 # v0.7.1
    with:
      tag: ${{ needs.preflight.outputs.tag }}
    permissions:
      contents: write
      id-token: write

  check-signing-secrets:
    name: Check Signing Secrets
    needs: preflight
    if: needs.preflight.outputs.tag != ''
    runs-on: ubuntu-latest
    permissions: {}
    timeout-minutes: 5
    outputs:
      has_signing_secrets: ${{ steps.check.outputs.has_signing_secrets }}
    steps:
      - name: Check signing secrets
        id: check
        run: |
          if [ -n "$MACOS_SIGN_P12" ]; then
            echo "has_signing_secrets=true" >> "$GITHUB_OUTPUT"
          else
            echo "has_signing_secrets=false" >> "$GITHUB_OUTPUT"
          fi
        env:
          MACOS_SIGN_P12: ${{ secrets.MACOS_SIGN_P12 }}

  sign-macos:
    name: Sign macOS
    runs-on: macos-latest
    needs: [preflight, release, check-signing-secrets]
    if: needs.check-signing-secrets.outputs.has_signing_secrets == 'true'
    permissions:
      contents: write
    timeout-minutes: 30
    env:
      RELEASE_TAG: ${{ needs.preflight.outputs.tag }}
    steps:
      - name: Import certificate into Keychain
        run: |
          set -euo pipefail
          KEYCHAIN_PATH=$RUNNER_TEMP/app-signing.keychain-db
          KEYCHAIN_PASSWORD="$(openssl rand -base64 32)"

          echo -n "$MACOS_SIGN_P12" | base64 --decode -o "$RUNNER_TEMP/cert.p12"
          security create-keychain -p "$KEYCHAIN_PASSWORD" "$KEYCHAIN_PATH"
          security set-keychain-settings -lut 21600 "$KEYCHAIN_PATH"
          security unlock-keychain -p "$KEYCHAIN_PASSWORD" "$KEYCHAIN_PATH"
          security import "$RUNNER_TEMP/cert.p12" -P "$MACOS_SIGN_PASSWORD" -A -t cert -f pkcs12 -k "$KEYCHAIN_PATH"
          security set-key-partition-list -S apple-tool:,apple: -k "$KEYCHAIN_PASSWORD" "$KEYCHAIN_PATH"
          security list-keychain -d user -s "$KEYCHAIN_PATH"
        env:
          MACOS_SIGN_P12: ${{ secrets.MACOS_SIGN_P12 }}
          MACOS_SIGN_PASSWORD: ${{ secrets.MACOS_SIGN_PASSWORD }}

      - name: Prepare notary key
        run: |
          set -euo pipefail
          echo -n "$MACOS_NOTARY_KEY" | base64 --decode -o "$RUNNER_TEMP/notary_key.p8"
        env:
          MACOS_NOTARY_KEY: ${{ secrets.MACOS_NOTARY_KEY }}

      - name: Download darwin archive
        run: |
          set -euo pipefail
          gh release download "$RELEASE_TAG" --repo "$GITHUB_REPOSITORY" \
            --pattern "replicator_*_darwin_arm64.tar.gz" --dir ./artifacts

          VERSION="${RELEASE_TAG#v}"
          if [ ! -f "./artifacts/replicator_${VERSION}_darwin_arm64.tar.gz" ]; then
            echo "::error::Expected darwin_arm64 archive not found after download"
            exit 1
          fi
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

      - name: Sign and notarize
        run: |
          set -euo pipefail
          mkdir -p ./signed
          for archive in ./artifacts/replicator_*_darwin_*.tar.gz; do
            echo "==> Processing $(basename "$archive")"
            workdir=$(mktemp -d)

            tar -xzf "$archive" -C "$workdir"

            codesign --force --timestamp --options runtime \
              --sign "$MACOS_SIGN_IDENTITY" \
              "$workdir/replicator"

            codesign --verify --verbose=2 "$workdir/replicator"

            ditto -c -k "$workdir/replicator" "$workdir/replicator.zip"

            xcrun notarytool submit "$workdir/replicator.zip" \
              --key "$RUNNER_TEMP/notary_key.p8" \
              --key-id "$MACOS_NOTARY_KEY_ID" \
              --issuer "$MACOS_NOTARY_ISSUER_ID" \
              --wait --timeout 20m

            tar -czf "./signed/$(basename "$archive")" -C "$workdir" replicator

            rm -rf "$workdir"
            echo "==> Done: $(basename "$archive")"
          done
        env:
          MACOS_SIGN_IDENTITY: ${{ secrets.MACOS_SIGN_IDENTITY }}
          MACOS_NOTARY_KEY_ID: ${{ secrets.MACOS_NOTARY_KEY_ID }}
          MACOS_NOTARY_ISSUER_ID: ${{ secrets.MACOS_NOTARY_ISSUER_ID }}

      - name: Replace release assets and update checksums
        run: |
          set -euo pipefail
          gh release upload "$RELEASE_TAG" --repo "$GITHUB_REPOSITORY" \
            ./signed/*.tar.gz --clobber

          gh release download "$RELEASE_TAG" --repo "$GITHUB_REPOSITORY" \
            --pattern "checksums.txt" --dir ./

          grep -v darwin checksums.txt > checksums_updated.txt || true

          for archive in ./signed/*.tar.gz; do
            shasum -a 256 "$archive" | sed 's|./signed/||' >> checksums_updated.txt
          done

          mv checksums_updated.txt checksums.txt
          gh release upload "$RELEASE_TAG" --repo "$GITHUB_REPOSITORY" \
            checksums.txt --clobber
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

      - name: Cleanup signing materials
        if: always()
        run: |
          security delete-keychain "$RUNNER_TEMP/app-signing.keychain-db" 2>/dev/null || true
          rm -f "$RUNNER_TEMP/cert.p12" "$RUNNER_TEMP/notary_key.p8"

  publish-cask:
    name: Publish Homebrew Cask
    # Release inputs come from GitHub assets; checkout provides the tested
    # cask integrity script used by both this job and pull-request CI.
    runs-on: ubuntu-latest
    needs: [preflight, release, sign-macos]
    if: >-
      always()
      && needs.release.result == 'success'
      && (needs.sign-macos.result == 'success' || needs.sign-macos.result == 'skipped')
    permissions:
      contents: read
    timeout-minutes: 10
    env:
      RELEASE_TAG: ${{ needs.preflight.outputs.tag }}
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1

      - name: Download final darwin archive and release manifest
        run: |
          set -euo pipefail
          VERSION="${RELEASE_TAG#v}"

          gh release download "$RELEASE_TAG" --repo "$GITHUB_REPOSITORY" \
            --pattern "replicator_*_darwin_arm64.tar.gz" --dir ./artifacts
          gh release download "$RELEASE_TAG" --repo "$GITHUB_REPOSITORY" \
            --pattern "checksums.txt" --dir ./artifacts

          ARCHIVE="./artifacts/replicator_${VERSION}_darwin_arm64.tar.gz"
          if [ ! -f "$ARCHIVE" ]; then
            echo "::error::darwin_arm64 archive not found in release assets"
            exit 1
          fi
          if [ ! -f "./artifacts/checksums.txt" ]; then
            echo "::error::checksums.txt not found in release assets"
            exit 1
          fi
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

      - name: Download cask template from release
        run: |
          set -euo pipefail
          gh release download "$RELEASE_TAG" --repo "$GITHUB_REPOSITORY" \
            --pattern "replicator.rb" --dir ./cask-staging

          if [ ! -f "./cask-staging/replicator.rb" ]; then
            echo "::error::replicator.rb cask template not found in release assets"
            exit 1
          fi
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

      - name: Patch cask with actual SHA
        run: |
          set -euo pipefail
          VERSION="${RELEASE_TAG#v}"
          ARCHIVE="./artifacts/replicator_${VERSION}_darwin_arm64.tar.gz"
          CASK_FILE="./cask-staging/replicator.rb"

          .github/scripts/patch-homebrew-cask.sh \
            "$ARCHIVE" ./artifacts/checksums.txt "$CASK_FILE"

      - name: Push to Homebrew tap
        run: |
          set -euo pipefail
          VERSION="${RELEASE_TAG#v}"
          CASK_FILE="./cask-staging/replicator.rb"

          git clone "https://x-access-token:${HOMEBREW_TAP_GITHUB_TOKEN}@github.com/unbound-force/homebrew-tap.git" tap
          cp "$CASK_FILE" tap/Casks/replicator.rb

          cd tap
          git config user.name "github-actions[bot]"
          git config user.email "github-actions[bot]@users.noreply.github.com"
          git add Casks/replicator.rb
          git diff --cached --quiet && { echo "No cask changes needed"; exit 0; }
          git commit -m "feat: update replicator cask to v${VERSION}"
          git push
        env:
          HOMEBREW_TAP_GITHUB_TOKEN: ${{ secrets.HOMEBREW_TAP_TOKEN }}