release.yml

name: Release
on:
  push:
    branches: [main]
    tags:
      - "v*.*.*"
    paths:
      - ".github/workflows/release.yml"
      - ".goreleaser.yaml"
  schedule:
    - cron: "0 0 * * *"
  workflow_dispatch:
concurrency:
  group: release-${{ github.event_name }}-${{ github.ref_name }}
  cancel-in-progress: true
jobs:
  build:
    runs-on: ${{ matrix.os }}
    permissions:
      contents: write
      discussions: write
    strategy:
      matrix:
        include:
          - os: macos-latest
            cache-subdir: darwin
          - os: ubuntu-22.04
            cache-subdir: linux
            _ids: --id linux-x64-wayland --id linux-x64-x11
          - os: ubuntu-22.04-arm
            cache-subdir: linux
            _ids: --id linux-arm64-wayland --id linux-arm64-x11
          - os: windows-latest
            cache-subdir: windows
      fail-fast: false
    outputs:
      cache-hit: ${{ steps.cache-check.outputs.cache-hit }}
    env:
      GORELEASER_KEY: ${{ secrets.GORELEASER_KEY }}
      MACOS_SIGN_P12: ${{ secrets.MACOS_SIGN_P12 }}
      MACOS_SIGN_PASSWORD: ${{ secrets.MACOS_SIGN_PASSWORD }}
      MACOS_NOTARY_ISSUER_ID: ${{ secrets.MACOS_NOTARY_ISSUER_ID }}
      MACOS_NOTARY_KEY: ${{ secrets.MACOS_NOTARY_KEY }}
      MACOS_NOTARY_KEY_ID: ${{ secrets.MACOS_NOTARY_KEY_ID }}
      KEYCHAIN_PASSWORD: ${{ secrets.KEYCHAIN_PASSWORD }}
      MACOS_NOTARY_KEYCHAIN_PROFILE: ${{ secrets.MACOS_NOTARY_KEYCHAIN_PROFILE }}
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - uses: actions/cache@v4
        with:
          path: dist/${{ matrix.cache-subdir }}
          key: goreleaser-${{ matrix.os }}-${{ github.sha }}
          enableCrossOsArchive: ${{ matrix.os == 'windows-latest' }}
          lookup-only: true
          fail-on-cache-miss: false
        id: cache-check
      - if: matrix.os == 'macos-latest'
        run: rustup target add x86_64-apple-darwin
      - if: matrix.os == 'windows-latest'
        run: rustup target add aarch64-pc-windows-msvc
      - if: matrix.os == 'macos-latest'
        run: |
          # create variables
          CERTIFICATE_PATH=$RUNNER_TEMP/goreleaser.p12
          KEY_PATH=$RUNNER_TEMP/goreleaser.p8
          KEYCHAIN_PATH=$RUNNER_TEMP/goreleaser.keychain-db

          # import certificate and key from secrets
          echo -n "$MACOS_SIGN_P12" | base64 --decode -o $CERTIFICATE_PATH
          echo -n "$MACOS_NOTARY_KEY" | base64 --decode -o $KEY_PATH

          # create temporary keychain
          security create-keychain -p "$KEYCHAIN_PASSWORD" $KEYCHAIN_PATH
          security set-keychain-settings -lut 21600 $KEYCHAIN_PATH
          security unlock-keychain -p "$KEYCHAIN_PASSWORD" $KEYCHAIN_PATH

          # import certificate to keychain
          security import $CERTIFICATE_PATH -P "$MACOS_SIGN_PASSWORD" -A -t cert -f pkcs12 -k $KEYCHAIN_PATH
          security set-key-partition-list -S apple-tool:,apple: -k "$KEYCHAIN_PASSWORD" $KEYCHAIN_PATH
          security list-keychain -d user -s $KEYCHAIN_PATH

          # create notary profile
          xcrun notarytool store-credentials "$MACOS_NOTARY_KEYCHAIN_PROFILE" \
            --key "$KEY_PATH" \
            --key-id "$MACOS_NOTARY_KEY_ID" \
            --issuer "$MACOS_NOTARY_ISSUER_ID" \
            --keychain $KEYCHAIN_PATH

          # export the keychain path
          echo "KEYCHAIN_PATH=$KEYCHAIN_PATH" >>$GITHUB_ENV

      - if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags/v') && steps.cache-check.outputs.cache-hit != 'true'
        uses: goreleaser/goreleaser-action@v6.2.1
        with:
          distribution: goreleaser-pro
          version: nightly
          args: release --clean --split ${{ matrix._ids }}
      - if: (github.event_name == 'schedule' || github.event_name == 'workflow_dispatch' || (github.event_name == 'push' && !startsWith(github.ref, 'refs/tags/v'))) && steps.cache-check.outputs.cache-hit != 'true'
        uses: goreleaser/goreleaser-action@v6.2.1
        with:
          distribution: goreleaser-pro
          version: nightly
          args: release --clean --split ${{ matrix._ids }} --nightly --skip=winget
  release:
    # skip if cache exists for same commit, since we probably already released
    if: needs.build.outputs.cache-hit != 'true'
    needs: build
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - uses: actions/cache@v4
        with:
          key: goreleaser-macos-latest-${{ github.sha }}
          path: dist/darwin
          fail-on-cache-miss: true
      - uses: actions/cache@v4
        with:
          key: goreleaser-windows-latest-${{ github.sha }}
          path: dist/windows
          fail-on-cache-miss: true
      - uses: actions/cache@v4
        with:
          key: goreleaser-ubuntu-22.04-arm-${{ github.sha }}
          path: dist/linux
          fail-on-cache-miss: true
      - name: workaround to avoid conflicts b/w linux x64/arm64 caches
        run: |
          # rename linux to linux-arm64, to avoid cache restore conflicts
          mv dist/linux dist/linux-arm64
          # update paths in artifacts.json (dist/linux -> dist/linux-arm64)
          sed -i 's/dist\/linux/dist\/linux-arm64/g' dist/linux-arm64/artifacts.json
      - uses: actions/cache@v4
        with:
          key: goreleaser-ubuntu-22.04-${{ github.sha }}
          path: dist/linux
          fail-on-cache-miss: true
      - uses: goreleaser/goreleaser-action@v6.2.1
        with:
          distribution: goreleaser-pro
          version: nightly
          args: continue --merge
        env:
          CARGO_REGISTRY_TOKEN: ${{ secrets.CARGO_REGISTRY_TOKEN }}
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          GORELEASER_KEY: ${{ secrets.GORELEASER_KEY }}