openswarm/.github/workflows/release-macos.yml

name: Release (macOS)

# Builds + signs + notarizes the macOS DMGs (arm64 + x64) and uploads them to the
# GitHub Release matching electron/package.json's version. This is the macOS half
# of the unified release: it triggers on the SAME `v*` tag as
# release-windows.yml, so one tag fans out to two parallel platform jobs that
# both check out the same commit. Because each build stamps build-info.json from
# `git rev-parse HEAD`, the SHA in the shipped DMG and EXE are identical.
#
# Required repository secrets (Settings -> Secrets and variables -> Actions):
#   APPLE_ID                      Apple Developer account email (notarization)
#   APPLE_APP_SPECIFIC_PASSWORD   app-specific password for that Apple ID
#   APPLE_TEAM_ID                 Apple Developer Team ID
#   CSC_LINK                      base64-encoded Developer ID Application .p12
#   CSC_KEY_PASSWORD              password for that .p12
#   EVS_ACCOUNT_NAME              castlabs EVS account name (Widevine VMP signing; free signup)
#   EVS_PASSWD                    password for that EVS account
#   GOOGLE_OAUTH_CLIENT_ID        shipped in production .env (Google OAuth)
#   GOOGLE_OAUTH_CLIENT_SECRET    shipped in production .env (Google OAuth)
#
# NOTE: untested in CI as of authoring. Verify the secrets above are present and
# do one dry run with workflow_dispatch publish=false before relying on a tag.

on:
  push:
    tags:
      - 'v*'
  workflow_dispatch:
    inputs:
      publish:
        description: 'Publish to GitHub Releases (otherwise artifact only)'
        required: true
        default: 'false'
        type: choice
        options:
          - 'false'
          - 'true'

permissions:
  contents: write

jobs:
  # Release-readiness gate (mirrors release-windows): the dogfood loop must have validated 12 consecutive clean runs per platform OR the v* tag halts before any DMG is built.
  release-gate:
    if: false  # bypassed through v1.2.75: dogfood loop not yet at 12 clean runs, shipping Mac now (mirrors release-windows); remove this line to re-arm the gate
    runs-on: ubuntu-latest
    permissions: { contents: read, actions: read }
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with: { node-version: '20.18.1' }
      - name: Fetch latest preflight-tunings from dogfood
        env:
          GH_TOKEN: ${{ github.token }}
        shell: bash
        run: |
          set -e
          run_id=$(gh run list --workflow dogfood.yml --branch eric/lock --limit 1 --json databaseId --jq '.[0].databaseId' || true)
          if [ -z "$run_id" ]; then echo "no dogfood runs yet; release cannot proceed"; exit 1; fi
          gh run download "$run_id" --name preflight-tunings --dir scripts/ci/ || { echo "no preflight-tunings artifact"; exit 1; }
      - name: Verify release readiness
        shell: bash
        run: node scripts/ci/verify-release-readiness.js

  build-macos:
    runs-on: macos-latest
    timeout-minutes: 90

    env:
      APPLE_ID:                   ${{ secrets.APPLE_ID }}
      APPLE_APP_SPECIFIC_PASSWORD: ${{ secrets.APPLE_APP_SPECIFIC_PASSWORD }}
      APPLE_TEAM_ID:              ${{ secrets.APPLE_TEAM_ID }}
      CSC_LINK:                   ${{ secrets.CSC_LINK }}
      CSC_KEY_PASSWORD:           ${{ secrets.CSC_KEY_PASSWORD }}
      EVS_ACCOUNT_NAME:           ${{ secrets.EVS_ACCOUNT_NAME }}
      EVS_PASSWD:                 ${{ secrets.EVS_PASSWD }}
      PUBLISH_INPUT:              ${{ github.event.inputs.publish }}

    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          # Exact pin to match the bundled runtime + the Windows job.
          node-version: '20.18.1'

      - name: Setup Python (for building bundled python-env)
        uses: actions/setup-python@v5
        with:
          python-version: '3.13'

      # Widevine VMP signing tool. The afterPack hook invokes `castlabs_evs.vmp
      # sign-pkg` with the EVS_* secrets; without this the build aborts (publish
      # path sets VMP_REQUIRE_SIGN=1) rather than ship a DMG with dead Spotify DRM.
      - name: Install castlabs-evs (Widevine VMP signing)
        if: ${{ env.APPLE_ID != '' }}
        shell: bash
        run: python3 -m pip install --upgrade castlabs-evs

      - name: Build app
        # Skip (green) when Apple signing secrets aren't in CI: Mac ships via local
        # publish.sh, so a secret-less CI run should no-op, not fail red.
        if: ${{ env.APPLE_ID != '' }}
        shell: bash
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          GOOGLE_OAUTH_CLIENT_ID:     ${{ secrets.GOOGLE_OAUTH_CLIENT_ID }}
          GOOGLE_OAUTH_CLIENT_SECRET: ${{ secrets.GOOGLE_OAUTH_CLIENT_SECRET }}
        run: |
          set -euo pipefail
          should_publish=false
          if [[ "$GITHUB_EVENT_NAME" == "push" ]]; then should_publish=true; fi
          if [[ "$GITHUB_EVENT_NAME" == "workflow_dispatch" && "$PUBLISH_INPUT" == "true" ]]; then should_publish=true; fi

          version="$(node -p "require('./electron/package.json').version")"
          if [[ "$version" == *-* ]]; then
            # Do NOT set EP_PRE_RELEASE: the GH pre-release checkbox hides the release
            # from the releases.atom feed electron-updater reads, so even experimental
            # clients can't discover it (matches release-windows.yml fix).
            echo "Version $version is EXPERIMENTAL (semver-suffix channel; NOT a GH pre-release)"
          else
            echo "Version $version is STABLE"
          fi

          if $should_publish; then
            echo "Build mode: PUBLISH"
            bash scripts/build-app.sh --publish
          else
            echo "Build mode: SIGN (artifact only)"
            bash scripts/build-app.sh --sign
          fi

      # Gatekeeper gate: after build-app.sh signs + notarizes, prove the shipped
      # .app is codesign-valid (--deep --strict), Gatekeeper-accepted (spctl
      # --assess), and carries a stapled notarization ticket. An app that built but
      # didn't notarize launches to a Gatekeeper block on every user's Mac, so that
      # must fail the release here. --require-signed exits non-zero unless all hold.
      # NOTE: like the rest of this workflow, this mac path is unverified locally
      # (no Mac on hand); first exercise it via workflow_dispatch publish=false.
      - name: Verify the shipped app is signed + notarized
        if: ${{ env.APPLE_ID != '' }}
        shell: bash
        run: |
          set -euo pipefail
          node scripts/ci/verify-signature.js --require-signed

      - name: Upload artifact (non-publish runs)
        if: github.event_name == 'workflow_dispatch' && github.event.inputs.publish != 'true'
        uses: actions/upload-artifact@v4
        with:
          name: openswarm-macos
          path: |
            electron/dist/*.dmg
            electron/dist/latest-mac.yml
          if-no-files-found: error
          retention-days: 14