release.yml

name: Release

on:
  push:
    tags:
      - 'v*'

permissions:
  contents: write
  packages: write
  id-token: write

jobs:
  goreleaser:
    name: GoReleaser
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Set up Go
        uses: actions/setup-go@v5
        with:
          go-version-file: go.mod
          cache: true

      - name: Set up QEMU
        uses: docker/setup-qemu-action@v3

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Log in to GitHub Container Registry
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Run GoReleaser
        uses: goreleaser/goreleaser-action@v6
        with:
          distribution: goreleaser
          version: latest
          args: release --clean
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          HOMEBREW_TAP_TOKEN: ${{ secrets.HOMEBREW_TAP_TOKEN }}

  macos-pkg:
    name: Build macOS Installer (${{ matrix.arch }})
    runs-on: macos-latest
    needs: goreleaser   # wait for the release to be created first
    strategy:
      matrix:
        include:
          - arch: amd64
            goarch: amd64
          - arch: arm64
            goarch: arm64

    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Set up Go
        uses: actions/setup-go@v5
        with:
          go-version-file: go.mod
          cache: true

      - name: Build binary
        env:
          GOARCH: ${{ matrix.goarch }}
          CGO_ENABLED: "0"
        run: |
          VERSION="${GITHUB_REF_NAME}"
          go build \
            -ldflags "-s -w -X main.version=${VERSION}" \
            -o deepdiffdb \
            ./cmd/deepdiffdb

      - name: Build .pkg installer
        run: |
          VERSION="${GITHUB_REF_NAME}"
          VER_CLEAN="${VERSION#v}"   # v1.4.2 → 1.4.2
          ARCH="${{ matrix.arch }}"
          PKG_NAME="deepdiff-db-${VERSION}-darwin-${ARCH}.pkg"

          # ── 1. Payload: mirrors the install layout on the target volume ──
          #    pkgbuild --install-location / means pkg-payload/ is the root.
          #    Binary lands at /usr/local/bin/deepdiffdb after install.
          mkdir -p pkg-payload/usr/local/bin
          cp deepdiffdb pkg-payload/usr/local/bin/deepdiffdb

          # ── 2. Component package ─────────────────────────────────────────
          pkgbuild \
            --root pkg-payload \
            --install-location / \
            --identifier com.iamvirul.deepdiffdb \
            --version "${VER_CLEAN}" \
            deepdiffdb-component.pkg

          # ── 3. Distribution XML — substitute version placeholders ────────
          mkdir -p dist-resources
          sed \
            -e "s/__APP_VERSION__/${VER_CLEAN}/g" \
            -e "s/__APP_TITLE__/DeepDiff DB ${VER_CLEAN}/g" \
            .github/macos-installer/distribution.xml > dist-resources/distribution.xml

          # Copy HTML resource pages referenced by the distribution XML
          cp .github/macos-installer/welcome.html    dist-resources/welcome.html
          cp .github/macos-installer/readme.html     dist-resources/readme.html
          cp .github/macos-installer/conclusion.html dist-resources/conclusion.html

          # ── 4. Distribution package (the installer wizard the user sees) ─
          productbuild \
            --distribution dist-resources/distribution.xml \
            --resources dist-resources \
            --package-path . \
            "${PKG_NAME}"

          echo "PKG_NAME=${PKG_NAME}" >> "$GITHUB_ENV"
          echo "VERSION=${VERSION}"   >> "$GITHUB_ENV"

      - name: Sign .pkg with Developer ID
        # Requires secrets: MACOS_CERTIFICATE (base64 .p12), MACOS_CERTIFICATE_PWD,
        # MACOS_KEYCHAIN_PWD, MACOS_IDENTITY ("Developer ID Installer: Name (TEAMID)").
        # Skipped gracefully when secrets are not configured.
        env:
          MACOS_CERTIFICATE:     ${{ secrets.MACOS_CERTIFICATE }}
          MACOS_CERTIFICATE_PWD: ${{ secrets.MACOS_CERTIFICATE_PWD }}
          MACOS_KEYCHAIN_PWD:    ${{ secrets.MACOS_KEYCHAIN_PWD }}
          MACOS_IDENTITY:        ${{ secrets.MACOS_IDENTITY }}
        run: |
          if [ -z "${MACOS_CERTIFICATE}" ]; then
            echo "⚠️  MACOS_CERTIFICATE not set — skipping code signing."
            echo "    Users will see a Gatekeeper warning on first open."
            exit 0
          fi

          # Import the Developer ID Installer certificate into a temporary keychain
          echo "${MACOS_CERTIFICATE}" | base64 --decode > certificate.p12
          security create-keychain -p "${MACOS_KEYCHAIN_PWD}" build.keychain
          security default-keychain -s build.keychain
          security unlock-keychain -p "${MACOS_KEYCHAIN_PWD}" build.keychain
          security set-keychain-settings -t 3600 -u build.keychain
          security import certificate.p12 \
            -k build.keychain \
            -P "${MACOS_CERTIFICATE_PWD}" \
            -T /usr/bin/productsign
          security set-key-partition-list \
            -S apple-tool:,apple: -s -k "${MACOS_KEYCHAIN_PWD}" build.keychain

          # Sign the distribution package
          productsign \
            --sign "${MACOS_IDENTITY}" \
            "${PKG_NAME}" \
            "${PKG_NAME}-signed.pkg"
          mv "${PKG_NAME}-signed.pkg" "${PKG_NAME}"

          # Clean up keychain and certificate
          security delete-keychain build.keychain
          rm -f certificate.p12

      - name: Notarize and staple .pkg
        # Requires secrets: MACOS_NOTARIZATION_APPLE_ID, MACOS_NOTARIZATION_TEAM_ID,
        # MACOS_NOTARIZATION_PWD (app-specific password).
        # Skipped gracefully when secrets are not configured.
        env:
          MACOS_NOTARIZATION_APPLE_ID: ${{ secrets.MACOS_NOTARIZATION_APPLE_ID }}
          MACOS_NOTARIZATION_TEAM_ID:  ${{ secrets.MACOS_NOTARIZATION_TEAM_ID }}
          MACOS_NOTARIZATION_PWD:      ${{ secrets.MACOS_NOTARIZATION_PWD }}
        run: |
          if [ -z "${MACOS_NOTARIZATION_APPLE_ID}" ] || \
             [ -z "${MACOS_NOTARIZATION_TEAM_ID}" ] || \
             [ -z "${MACOS_NOTARIZATION_PWD}" ]; then
            echo "⚠️  One or more notarization secrets are missing — skipping notarization."
            exit 0
          fi

          xcrun notarytool submit "${PKG_NAME}" \
            --apple-id  "${MACOS_NOTARIZATION_APPLE_ID}" \
            --team-id   "${MACOS_NOTARIZATION_TEAM_ID}" \
            --password  "${MACOS_NOTARIZATION_PWD}" \
            --wait

          # Staple the notarization ticket so Gatekeeper works offline
          xcrun stapler staple "${PKG_NAME}"

      - name: Wrap .pkg in DMG
        run: |
          DMG_NAME="${PKG_NAME%.pkg}.dmg"
          mkdir -p dmg-stage
          cp "${PKG_NAME}" dmg-stage/

          hdiutil create \
            -volname "DeepDiff DB ${VERSION}" \
            -srcfolder dmg-stage \
            -ov \
            -format UDZO \
            "${DMG_NAME}"

          echo "DMG_NAME=${DMG_NAME}" >> "$GITHUB_ENV"

      - name: Upload DMG to GitHub release
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          gh release upload "${GITHUB_REF_NAME}" "${DMG_NAME}" --clobber

  windows-installer:
    name: Build Windows Installer (amd64)
    runs-on: windows-latest
    needs: goreleaser   # wait for the release to be created first

    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Set up Go
        uses: actions/setup-go@v5
        with:
          go-version-file: go.mod
          cache: true

      - name: Build Windows binary
        shell: bash
        env:
          GOARCH: amd64
          GOOS: windows
          CGO_ENABLED: "0"
        run: |
          VERSION="${GITHUB_REF_NAME}"
          go build \
            -ldflags "-s -w -X main.version=${VERSION}" \
            -o deepdiffdb.exe \
            ./cmd/deepdiffdb

      - name: Install NSIS
        shell: bash
        run: |
          choco install nsis --no-progress -y
          # Chocolatey's PATH update does not propagate to later steps.
          # Append the NSIS directory explicitly so makensis is found.
          echo "C:/Program Files (x86)/NSIS" >> "$GITHUB_PATH"

      - name: Prepare NSIS script and resources
        shell: bash
        run: |
          VERSION="${GITHUB_REF_NAME}"
          VER_CLEAN="${VERSION#v}"   # strip leading 'v': v1.4.1 → 1.4.1

          # Substitute the __APP_VERSION__ placeholder in the template
          sed "s/__APP_VERSION__/${VER_CLEAN}/g" \
            .github/windows-installer.nsi > installer.nsi

          echo "INSTALLER_NAME=deepdiff-db-${VERSION}-windows-amd64-installer.exe" \
            >> "$GITHUB_ENV"

      - name: Compile installer
        shell: bash
        run: makensis installer.nsi

      - name: Upload installer to GitHub release
        shell: bash
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          gh release upload "${GITHUB_REF_NAME}" "${INSTALLER_NAME}" --clobber