release.yml

name: Release

on:
  push:
    tags:
      - 'v[0-9]+.[0-9]+.[0-9]+'   # matches "v<number>.<number>.<number>"
      - 'v[0-9]+.[0-9]+.[0-9]+-*' # matches "v<number>.<number>.<number>-<string>"

jobs:
   # Check prerequisites for the workflow
  prereqs:
    name: Prerequisites
    runs-on: ubuntu-latest
    outputs:
      tag_name: ${{ steps.tag.outputs.name }}           # The full name of the tag, e.g. v1.0.0
      tag_version: ${{ steps.tag.outputs.version }}     # The version number (without preceding "v"), e.g. 1.0.0
    steps:
      - name: Determine tag to build
        run: |
          echo "name=${GITHUB_REF#refs/tags/}" >> $GITHUB_OUTPUT
          echo "version=${GITHUB_REF#refs/tags/v}" >> $GITHUB_OUTPUT
        id: tag

  package:
    needs: prereqs
    name: ${{matrix.jobs.jobname}}
    strategy:
      fail-fast: false
      matrix:
        jobs:
          - jobname: Create MacOS .pkg (x86_64)
            goarch: amd64
            pool: macos-latest
            artifact: _dist/*.pkg
            environment: release
          - jobname: Create MacOS .pkg (ARM64)
            goarch: arm64
            pool: macos-latest
            artifact: _dist/*.pkg
            environment: release
          - jobname: Create binary Debian package (x86_64)
            goarch: amd64
            pool: ubuntu-latest
            artifact: _dist/*.deb
    env:
      GOARCH: ${{matrix.jobs.goarch}}
    environment: ${{matrix.jobs.environment}}
    runs-on: ${{matrix.jobs.pool}}
    steps:
      - name: Clone repository
        uses: actions/checkout@v3
      - name: Setup Go
        uses: actions/setup-go@v3
        with:
          go-version-file: 'go.mod'
      - uses: ruby/setup-ruby@v1
        with:
          ruby-version: '3.2.1'
      - run: gem install asciidoctor
      - name: Configure MacOS signing
        if: ${{ matrix.jobs.pool == 'macos-latest' }}
        env:
          A1: ${{ secrets.APPLICATION_CERTIFICATE_BASE64 }}
          A2: ${{ secrets.APPLICATION_CERTIFICATE_PASSWORD }}
          A3: ${{ secrets.APPLE_APPLICATION_SIGNING_IDENTITY }}
          I1: ${{ secrets.INSTALLER_CERTIFICATE_BASE64 }}
          I2: ${{ secrets.INSTALLER_CERTIFICATE_PASSWORD }}
          I3: ${{ secrets.APPLE_INSTALLER_SIGNING_IDENTITY }}
          N1: ${{ secrets.APPLE_TEAM_ID }}
          N2: ${{ secrets.APPLE_DEVELOPER_ID }}
          N3: ${{ secrets.APPLE_DEVELOPER_PASSWORD }}
          N4: ${{ secrets.APPLE_KEYCHAIN_PROFILE }}
        run: |
          # Environment configured for signing?
          if [[ -n "$A1" && -n "$A2" && -n "$A3" && -n "$I1" && -n "$I2" && -n "$I3" ]]
          then
            echo "DO_SIGN=1" >> $GITHUB_ENV
          else
            echo "::warning::MacOS signing environment is not fully specified. Skipping configuration."
            exit 0
          fi

          # Signing
          echo "Setting up signing certificates"
          security create-keychain -p pwd $RUNNER_TEMP/buildagent.keychain
          security default-keychain -s $RUNNER_TEMP/buildagent.keychain
          security unlock-keychain -p pwd $RUNNER_TEMP/buildagent.keychain

          echo $A1 | base64 -D > $RUNNER_TEMP/cert.p12
          security import $RUNNER_TEMP/cert.p12 \
            -k $RUNNER_TEMP/buildagent.keychain \
            -P $A2 \
            -T /usr/bin/codesign
          security set-key-partition-list \
            -S apple-tool:,apple:,codesign: \
            -s -k pwd \
            $RUNNER_TEMP/buildagent.keychain

          echo $I1 | base64 -D > $RUNNER_TEMP/cert.p12
          security import $RUNNER_TEMP/cert.p12 \
            -k $RUNNER_TEMP/buildagent.keychain \
            -P $I2 \
            -T /usr/bin/productbuild
          security set-key-partition-list \
            -S apple-tool:,apple:,productbuild: \
            -s -k pwd \
            $RUNNER_TEMP/buildagent.keychain

          # Environment configured for notarization?
          if [[ -n "$N1" && -n "$N2" && -n "$N3" && -n "$N4" ]]
          then
            echo "DO_NOTARIZE=1" >> $GITHUB_ENV
          else
            echo "::warning::Successfully configured MacOS signing, but cannot set up notarization. Skipping configuration."
            exit 0
          fi

          # Notarizing
          echo "Setting up notarytool"
          xcrun notarytool store-credentials \
            --team-id $N1 \
            --apple-id $N2 \
            --password $N3 \
            "$N4"
      - name: Build the release artifact
        env:
          A3: ${{ secrets.APPLE_APPLICATION_SIGNING_IDENTITY }}
          I3: ${{ secrets.APPLE_INSTALLER_SIGNING_IDENTITY }}
          N4: ${{ secrets.APPLE_KEYCHAIN_PROFILE }}
        shell: bash
        run: |
          make package VERSION=${{ needs.prereqs.outputs.tag_version }} \
                       APPLE_APP_IDENTITY="$([[ -n "$DO_SIGN" ]] && echo "$A3" || echo '')" \
                       APPLE_INST_IDENTITY="$([[ -n "$DO_SIGN" ]] && echo "$I3" || echo '')" \
                       APPLE_KEYCHAIN_PROFILE="$([[ -n "$DO_NOTARIZE" ]] && echo "$N4" || echo '')"
      - name: Get the release artifact
        shell: bash
        run: |
          artifacts=(${{matrix.jobs.artifact}})

          # Get path to, and name of, artifact
          artifactPath="${artifacts[0]}"
          artifactName=$(basename "$artifactPath")

          # Export variables to environment
          echo "artifactPath=$artifactPath" >> $GITHUB_ENV
          echo "artifactName=$artifactName" >> $GITHUB_ENV
      - name: Upload release artifact
        uses: actions/upload-artifact@v3
        with:
          name: ${{env.artifactName}}
          path: ${{github.workspace}}/${{env.artifactPath}}
          if-no-files-found: error

  create-github-release:
    needs: [prereqs, package]
    name: Create release with artifacts
    runs-on: ubuntu-latest
    steps:
      - name: Download packages
        uses: actions/download-artifact@v3
        with:
          path: artifacts-raw
      - name: Consolidate artifact directory
        shell: bash
        run: |
          # This step is needed to extract the artifacts from their wrapper
          # parent directories. For more details, see
          # https://github.com/actions/download-artifact#download-all-artifacts
          mkdir artifacts
          mv artifacts-raw/*/* artifacts/
      - name: Create release & attach artifacts
        uses: actions/github-script@v6
        with:
          script: |
            const fs = require('fs');
            const path = require('path');

            var releaseMetadata = {
              owner: context.repo.owner,
              repo: context.repo.repo
            };

            // Create the release
            var tagName = "${{ needs.prereqs.outputs.tag_name }}";
            var createdRelease = await github.rest.repos.createRelease({
              ...releaseMetadata,
              draft: true,
              tag_name: tagName,
              name: tagName,
              generate_release_notes: true
            });
            releaseMetadata.release_id = createdRelease.data.id;

            // Upload contents of directory to the release created above
            async function uploadDirectoryToRelease(directory, includeExtensions=[]) {
              return fs.promises.readdir(directory)
                .then(async(files) => Promise.all(
                  files.filter(file => {
                    return includeExtensions.length==0 || includeExtensions.includes(path.extname(file).toLowerCase());
                  })
                  .map(async (file) => {
                    var filePath = path.join(directory, file);
                    return github.rest.repos.uploadReleaseAsset({
                      ...releaseMetadata,
                      name: file,
                      headers: {
                        "content-length": (await fs.promises.stat(filePath)).size
                      },
                      data: fs.createReadStream(filePath)
                    });
                  }))
                );
            }

            await Promise.all([
              // Upload all artifacts
              uploadDirectoryToRelease('artifacts', ['.pkg', '.deb'])
            ]);