release.yml

name: Release

on:
  push:
    tags:
      # Stable tags only. Prerelease tags (vX.Y.Z-beta.N) contain a '-' and
      # are handled by release-beta.yml; every job below is additionally
      # guarded with !contains(github.ref_name, '-') because this 'v*'
      # pattern matches them too.
      - "v*"

permissions:
  contents: write

jobs:
  build-platforms:
    if: ${{ !contains(github.ref_name, '-') }}
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        include:
          - goos: darwin
            platform: macOS
            goarch: amd64
          - goos: darwin
            platform: macOS
            goarch: arm64
          - goos: linux
            platform: Linux
            goarch: amd64
          - goos: linux
            platform: Linux
            goarch: arm64
    steps:
      - name: Checkout
        uses: actions/checkout@v6

      - name: Setup Go
        uses: actions/setup-go@v6
        with:
          go-version-file: go.mod
          cache: true

      - name: Build ${{ matrix.platform }} ${{ matrix.goarch }} archive
        env:
          GOOS: ${{ matrix.goos }}
          GOARCH: ${{ matrix.goarch }}
          PLATFORM: ${{ matrix.platform }}
          VERSION: ${{ github.ref_name }}
          COMMIT: ${{ github.sha }}
        run: |
          set -euo pipefail
          build_date="$(date -u +%Y-%m-%dT%H:%M:%SZ)"
          target="myworktree_${VERSION}_${PLATFORM}_${GOARCH}"
          dist_dir="dist/${target}"
          mkdir -p "${dist_dir}"
          # Only strip debug symbols (-s), keep symbol table (-w removed)
          # to preserve macOS code signing compatibility
          ldflags="-s -X myworktree/internal/version.Version=${VERSION} -X myworktree/internal/version.Commit=${COMMIT} -X myworktree/internal/version.BuildDate=${build_date}"
          CGO_ENABLED=0 GOOS="${GOOS}" GOARCH="${GOARCH}" go build -trimpath -ldflags "${ldflags}" -o "${dist_dir}/myworktree" ./cmd/myworktree
          CGO_ENABLED=0 GOOS="${GOOS}" GOARCH="${GOARCH}" go build -trimpath -ldflags "${ldflags}" -o "${dist_dir}/mw" ./cmd/mw
          cp README.md README.zh-CN.md LICENSE CHANGELOG.md "${dist_dir}/"
          tar -C dist -czf "dist/${target}.tar.gz" "${target}"

      - name: Upload archive
        uses: actions/upload-artifact@v4
        with:
          name: release-${{ matrix.platform }}-${{ matrix.goarch }}
          path: dist/*.tar.gz
          if-no-files-found: error

  codesign-notarize:
    if: ${{ vars.APPLE_ENABLE_CODESIGN == 'true' && !contains(github.ref_name, '-') }}
    runs-on: macos-latest
    needs: build-platforms
    strategy:
      fail-fast: false
      matrix:
        goarch:
          - amd64
          - arm64
    steps:
      - name: Download archive
        uses: actions/download-artifact@v4
        with:
          name: release-macOS-${{ matrix.goarch }}
          path: dist

      - name: Extract and codesign
        env:
          APPLE_DEVELOPER_ID_CERT_BASE64: ${{ secrets.APPLE_DEVELOPER_ID_CERT_BASE64 }}
          APPLE_DEVELOPER_ID_CERT_PASSWORD: ${{ secrets.APPLE_DEVELOPER_ID_CERT_PASSWORD }}
          APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
          APPLE_ID: ${{ secrets.APPLE_ID }}
          APPLE_APP_SPECIFIC_PASSWORD: ${{ secrets.APPLE_APP_SPECIFIC_PASSWORD }}
        run: |
          set -euo pipefail
          archive=$(ls dist/*.tar.gz)
          basename=$(basename "${archive}" .tar.gz)
          mkdir -p dist/extracted
          tar xzf "${archive}" -C dist/extracted

          # Import Apple Developer signing certificate
          KEYCHAIN="build.keychain"
          security create-keychain -p "" "${KEYCHAIN}"
          security default-keychain -s "${KEYCHAIN}"
          security unlock-keychain -p "" "${KEYCHAIN}"
          security set-keychain-settings -lut 21600 "${KEYCHAIN}"
          echo "${APPLE_DEVELOPER_ID_CERT_BASE64}" | base64 -d > cert.p12
          security import cert.p12 -k "${KEYCHAIN}" -P "${APPLE_DEVELOPER_ID_CERT_PASSWORD}" -T /usr/bin/codesign -T /usr/bin/pkgbuild
          security set-key-partition-list -S apple-tool:,apple:,codesign: -s -k "" "${KEYCHAIN}"

          for binary in myworktree mw; do
            # Sign with hardened runtime (required for notarization)
            codesign --force --options runtime --timestamp --sign "${APPLE_TEAM_ID}" \
              "dist/extracted/${basename}/${binary}"
          done

          # Notarize each binary
          for binary in myworktree mw; do
            zip_path="dist/${binary}.zip"
            ditto -c -k --keepParent "dist/extracted/${basename}/${binary}" "${zip_path}"
            xcrun notarytool submit "${zip_path}" \
              --apple-id "${APPLE_ID}" \
              --team-id "${APPLE_TEAM_ID}" \
              --password "${APPLE_APP_SPECIFIC_PASSWORD}" \
              --wait
            xcrun stapler staple "dist/extracted/${basename}/${binary}"
          done

          # Re-pack the signed archive
          tar czf "${archive}" -C dist/extracted "${basename}"

          # Clean up keychain
          security delete-keychain "${KEYCHAIN}"

      - name: Upload signed archive
        uses: actions/upload-artifact@v4
        with:
          name: release-macOS-${{ matrix.goarch }}
          path: dist/*.tar.gz
          if-no-files-found: error
          overwrite: true

  publish:
    runs-on: ubuntu-latest
    needs: [build-platforms, codesign-notarize]
    if: ${{ !failure() && !contains(github.ref_name, '-') }}
    steps:
      - name: Download archives
        uses: actions/download-artifact@v4
        with:
          path: dist
          pattern: release-*
          merge-multiple: true

      - name: Generate checksums
        run: |
          set -euo pipefail
          cd dist
          shasum -a 256 ./*.tar.gz > checksums.txt

      - name: Publish GitHub release
        uses: softprops/action-gh-release@v2
        with:
          generate_release_notes: true
          files: |
            dist/*.tar.gz
            dist/checksums.txt