veritas-kanban/.github/workflows/desktop-release.yml

name: Desktop Release

on:
  workflow_dispatch:
    inputs:
      channel:
        description: Update channel to publish.
        required: true
        default: stable
        type: choice
        options:
          - stable
          - beta
          - dev
  release:
    types: [published]

permissions:
  contents: write

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: false

env:
  NODE_VERSION: '22'
  VERITAS_BUILD_SHA: ${{ github.sha }}
  VERITAS_UPDATE_CHANNEL: ${{ github.event.inputs.channel || 'stable' }}

jobs:
  mac-signed:
    name: Signed and Notarized macOS Artifact
    runs-on: macos-15
    steps:
      - uses: actions/checkout@v7

      - uses: pnpm/action-setup@v6

      - uses: actions/setup-node@v6
        with:
          node-version: ${{ env.NODE_VERSION }}
          cache: pnpm

      - name: Verify signing and notarization secrets are configured
        id: notarization-secrets
        env:
          CSC_LINK: ${{ secrets.MACOS_CSC_LINK }}
          CSC_KEY_PASSWORD: ${{ secrets.MACOS_CSC_KEY_PASSWORD }}
          APPLE_API_KEY_BASE64: ${{ secrets.APPLE_API_KEY_BASE64 }}
          APPLE_API_KEY_ID: ${{ secrets.APPLE_API_KEY_ID }}
          APPLE_API_ISSUER: ${{ secrets.APPLE_API_ISSUER }}
          APPLE_ID: ${{ secrets.APPLE_ID }}
          APPLE_APP_SPECIFIC_PASSWORD: ${{ secrets.APPLE_APP_SPECIFIC_PASSWORD }}
          APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
        run: |
          errors=0

          for name in CSC_LINK CSC_KEY_PASSWORD; do
            if [ -z "${!name}" ]; then
              echo "::error::$name is required for signed/notarized desktop releases"
              errors=1
            fi
          done

          api_key_count=0
          for name in APPLE_API_KEY_BASE64 APPLE_API_KEY_ID APPLE_API_ISSUER; do
            if [ -n "${!name}" ]; then
              api_key_count=$((api_key_count + 1))
            fi
          done

          apple_id_count=0
          for name in APPLE_ID APPLE_APP_SPECIFIC_PASSWORD APPLE_TEAM_ID; do
            if [ -n "${!name}" ]; then
              apple_id_count=$((apple_id_count + 1))
            fi
          done

          if [ "${api_key_count}" -gt 0 ] && [ "${api_key_count}" -lt 3 ]; then
            echo "::error::App Store Connect API-key notarization requires APPLE_API_KEY_BASE64, APPLE_API_KEY_ID, and APPLE_API_ISSUER together"
            errors=1
          fi

          if [ "${apple_id_count}" -gt 0 ] && [ "${apple_id_count}" -lt 3 ]; then
            echo "::error::Apple ID notarization requires APPLE_ID, APPLE_APP_SPECIFIC_PASSWORD, and APPLE_TEAM_ID together"
            errors=1
          fi

          if [ "${api_key_count}" -eq 3 ] && [ "${apple_id_count}" -eq 3 ]; then
            echo "::error::Configure exactly one notarization credential set, not both App Store Connect API-key and Apple ID credentials"
            errors=1
          elif [ "${api_key_count}" -eq 3 ]; then
            echo "notarization_mode=api-key" >> "${GITHUB_OUTPUT}"
          elif [ "${apple_id_count}" -eq 3 ]; then
            echo "notarization_mode=apple-id" >> "${GITHUB_OUTPUT}"
          else
            echo "::error::One complete notarization credential set is required: App Store Connect API key or Apple ID/app-specific password"
            errors=1
          fi

          exit "${errors}"

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      - name: Build workspace
        run: pnpm build

      - name: Prepare desktop runtime payload
        run: pnpm --filter @veritas-kanban/desktop package:prepare

      - name: Write App Store Connect API key
        id: notary-key
        if: steps.notarization-secrets.outputs.notarization_mode == 'api-key'
        env:
          APPLE_API_KEY_BASE64: ${{ secrets.APPLE_API_KEY_BASE64 }}
        run: |
          key_path="${RUNNER_TEMP}/AuthKey_${{ secrets.APPLE_API_KEY_ID }}.p8"
          umask 077
          printf '%s' "${APPLE_API_KEY_BASE64}" | base64 --decode > "${key_path}"

          if ! grep -q "BEGIN PRIVATE KEY" "${key_path}"; then
            echo "::error::APPLE_API_KEY_BASE64 does not decode to an App Store Connect API private key"
            exit 1
          fi

          echo "key_path=${key_path}" >> "${GITHUB_OUTPUT}"

      - name: Build, sign, notarize, and stage macOS artifacts
        working-directory: desktop
        env:
          GH_TOKEN: ${{ github.token }}
          CSC_LINK: ${{ secrets.MACOS_CSC_LINK }}
          CSC_KEY_PASSWORD: ${{ secrets.MACOS_CSC_KEY_PASSWORD }}
          APPLE_API_KEY: ${{ steps.notary-key.outputs.key_path }}
          APPLE_API_KEY_ID: ${{ secrets.APPLE_API_KEY_ID }}
          APPLE_API_ISSUER: ${{ secrets.APPLE_API_ISSUER }}
          APPLE_ID: ${{ secrets.APPLE_ID }}
          APPLE_APP_SPECIFIC_PASSWORD: ${{ secrets.APPLE_APP_SPECIFIC_PASSWORD }}
          APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
        run: node ./node_modules/electron-builder/cli.js --mac dmg zip --publish always

      - name: Finalize notarized macOS release assets
        env:
          APPLE_API_KEY: ${{ steps.notary-key.outputs.key_path }}
          APPLE_API_KEY_ID: ${{ secrets.APPLE_API_KEY_ID }}
          APPLE_API_ISSUER: ${{ secrets.APPLE_API_ISSUER }}
          APPLE_ID: ${{ secrets.APPLE_ID }}
          APPLE_APP_SPECIFIC_PASSWORD: ${{ secrets.APPLE_APP_SPECIFIC_PASSWORD }}
          APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
        run: node scripts/finalize-macos-release-assets.mjs

      - name: Upload macOS release assets
        working-directory: desktop
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          set -euo pipefail

          version="$(node -p "require('./package.json').version")"
          tag="v${version}"
          dmg="release/Veritas-Kanban-${version}-mac-arm64.dmg"
          zip="release/Veritas-Kanban-${version}-mac-arm64.zip"

          for file in "${dmg}" "${zip}"; do
            if [ ! -f "${file}" ]; then
              echo "::error::Expected release asset missing: ${file}"
              exit 1
            fi

            if [ "${file}" = "${dmg}" ]; then
              codesign --verify --verbose=2 "${file}"
              spctl -a -vvv -t open --context context:primary-signature "${file}"
            fi

            checksum="$(shasum -a 256 "${file}" | awk '{print $1}')"
            printf '%s  %s\n' "${checksum}" "$(basename "${file}")" > "${file}.sha256"
          done

          assets=(
            "release/latest-mac.yml"
            "${dmg}"
            "${dmg}.blockmap"
            "${dmg}.sha256"
            "${zip}"
            "${zip}.blockmap"
            "${zip}.sha256"
          )

          for file in "${assets[@]}"; do
            if [ ! -f "${file}" ]; then
              echo "::error::Expected release asset missing: ${file}"
              exit 1
            fi
          done

          gh release upload "${tag}" "${assets[@]}" --clobber