build.yml

name: Build apps

on:
  push:
      branches: [main]
  workflow_call:
    inputs:
      version:
        required: false
        type: string
  pull_request:

concurrency:
  group: build-${{ github.ref }}
  cancel-in-progress: true

permissions:
  contents: read

jobs:
    build-macos:
        runs-on: macos-latest
        steps:
        - uses: actions/checkout@v6
        - uses: actions/setup-python@v6
          with:
            python-version: "3.12"
            cache: "pip"
            cache-dependency-path: requirements.txt
        - run: pip install -r ./requirements.txt
        - name: Build for MacOS
          run: pyinstaller build_resources/main_mac.spec
        - if: ${{ github.event_name != 'pull_request' }}
          name: Read version
          id: version
          shell: bash
          run: |
            VER="${{ inputs.version }}"
            if [[ -n "$VER" ]]; then
              echo "version=$VER" >> "$GITHUB_OUTPUT"
            elif [[ -s VERSION ]]; then
              echo "version=$(tr -d '\r' < VERSION | sed 's/^v//')" >> "$GITHUB_OUTPUT"
            else
              echo "version=1.0.0" >> "$GITHUB_OUTPUT"
            fi

        - if: ${{ github.event_name != 'pull_request' }}
          name: Inject version into Info.plist
          env:
            VER: ${{ steps.version.outputs.version }}
            BUILD: ${{ github.run_number }}
          run: |
            PLIST="dist/Wonky Window.app/Contents/Info.plist"
            /usr/libexec/PlistBuddy -c "Set :CFBundleShortVersionString $VER" "$PLIST" \
              || /usr/libexec/PlistBuddy -c "Add :CFBundleShortVersionString string $VER" "$PLIST"
            /usr/libexec/PlistBuddy -c "Set :CFBundleVersion $BUILD" "$PLIST" \
              || /usr/libexec/PlistBuddy -c "Add :CFBundleVersion string $BUILD" "$PLIST"
        - if: ${{ github.event_name != 'pull_request' }}
          name: Import Developer-ID cert
          env:
            CERT_B64: ${{ secrets.MAC_CERT_P12_BASE64 }}
            CERT_PASS: ${{ secrets.MAC_CERT_PASSWORD }}
          run: |
            echo "$CERT_B64" | base64 --decode > /tmp/cert.p12
            security create-keychain -p "" build.keychain
            security default-keychain -s build.keychain
            security unlock-keychain -p "" build.keychain
            security import /tmp/cert.p12 -k build.keychain -P "$CERT_PASS" -T /usr/bin/codesign
            security set-key-partition-list -S apple-tool:,apple:,codesign: -s -k "" build.keychain
          
        - if: ${{ github.event_name != 'pull_request' }}
          name: Codesign app
          env:
            SIGN_ID: ${{ secrets.CODE_SIGN_IDENTITY }}
          run: |
            # Note: Ensure the "Wonky Window.app" name exactly matches the name parameter in your main_mac.spec file
            codesign --force --deep --options runtime \
              --timestamp \
              --sign "$SIGN_ID" \
              "dist/Wonky Window.app"
        - if: ${{ github.event_name != 'pull_request' }}
          name: Notarise & staple
          env:
            AC_USERNAME: ${{ secrets.AC_USERNAME }}
            AC_PASSWORD: ${{ secrets.AC_PASSWORD }}
            AC_TEAMID: ${{ secrets.AC_TEAMID }}
          run: |
            ditto -c -k --keepParent "dist/Wonky Window.app" "WonkyWindow.zip"
            xcrun notarytool submit WonkyWindow.zip \
              --apple-id "$AC_USERNAME" \
              --team-id "$AC_TEAMID" \
              --password "$AC_PASSWORD" \
              --wait
            xcrun stapler staple "dist/Wonky Window.app"
        - if: ${{ github.event_name != 'pull_request' }}
          name: Create dmg file
          run: |
            hdiutil detach "/Volumes/Wonky Window" || true
            mkdir -p "dist/dmg_staging"
            cp -R "dist/Wonky Window.app" "dist/dmg_staging/"
            ln -s /Applications "dist/dmg_staging/Applications"
            hdiutil create -volname "Wonky Window" -srcfolder "dist/dmg_staging" -ov -format UDZO "dist/WonkyWindow-macOS-v${{ steps.version.outputs.version }}.dmg"

        - if: ${{ github.event_name != 'pull_request' }}
          name: Clean up keychain and cert
          run: |
            security delete-keychain build.keychain || true
            rm -f /tmp/cert.p12

        - if: ${{ github.event_name != 'pull_request' }}
          name: Upload MacOS Artifact (DMG)
          uses: actions/upload-artifact@v7
          with:
            name: wonky-window-macos
            path: "dist/WonkyWindow-macOS-v${{ steps.version.outputs.version }}.dmg"
            retention-days: 7
            if-no-files-found: error
    build-windows:
        runs-on: windows-latest
        steps:
        - uses: actions/checkout@v6
        - uses: actions/setup-python@v6
          with:
            python-version: "3.12"
            cache: "pip"
            cache-dependency-path: requirements.txt
        - run: pip install -r ./requirements.txt
        - name: Read version
          id: version
          shell: bash
          run: |
            VER="${{ inputs.version }}"
            if [[ -n "$VER" ]]; then
              echo "version=$VER" >> "$GITHUB_OUTPUT"
            elif [[ -s VERSION ]]; then
              echo "version=$(tr -d '\r' < VERSION | sed 's/^v//')" >> "$GITHUB_OUTPUT"
            else
              echo "version=1.0.0" >> "$GITHUB_OUTPUT"
            fi

        - name: Create version info
          shell: bash
          run: |
            VER="${{ steps.version.outputs.version }}"

            # Strip any suffix after the first non-digit/dot (e.g., "1.3.0-beta" -> "1.3.0")
            NUMVER="$(echo "$VER" | sed 's/[^0-9.].*$//')"

            # Split and pad to 4 integers
            IFS=. read -r MAJOR MINOR PATCH BUILD <<<"$NUMVER"
            : "${MAJOR:=0}"; : "${MINOR:=0}"; : "${PATCH:=0}"; : "${BUILD:=0}"

            cat > version_info.txt <<EOF
            VSVersionInfo(
              ffi=FixedFileInfo(
                filevers=($MAJOR,$MINOR,$PATCH,$BUILD),
                prodvers=($MAJOR,$MINOR,$PATCH,$BUILD)
              ),
              kids=[StringFileInfo([StringTable('040904B0', [
                StringStruct('FileDescription', 'Wonky Window'),
                StringStruct('FileVersion', '$VER'),
                StringStruct('ProductName', 'Wonky Window'),
                StringStruct('ProductVersion', '$VER')
              ])])]
            )
            EOF

        - name: Build for Windows
          env:
            PYI_APP_VERSION: ${{ steps.version.outputs.version }}
          run: pyinstaller build_resources/main_windows.spec
        - name: (Debug) Show dist
          shell: pwsh
          run: |
            Write-Host "---- dist contents ----"
            Get-ChildItem -Force dist
        - name: Upload Windows Artifact (Portable)
          uses: actions/upload-artifact@v7
          with:
            name: wonky-window-windows-portable
            path: "dist/WonkyWindow-windows-portable-v${{ steps.version.outputs.version }}/*"
            retention-days: 7
            if-no-files-found: error
        - if: ${{ github.event_name != 'pull_request' }}
          name: Compile .ISS to .EXE Installer
          uses: Minionguyjpro/Inno-Setup-Action@v1.2.7
          with:
            path: build_resources/setup.iss
            options: /DMyAppVersion=${{ steps.version.outputs.version }}
        - if: ${{ github.event_name != 'pull_request' }}
          name: Upload installer artifact
          uses: actions/upload-artifact@v7
          with:
            name: wonky-window-windows-installer
            path: "output/WonkyWindow-windows-installer-v${{ steps.version.outputs.version }}.exe"
            retention-days: 7
            if-no-files-found: error
    build-linux:
        runs-on: ubuntu-latest
        steps:
        - uses: actions/checkout@v6
        - uses: actions/setup-python@v6
          with:
            python-version: "3.12"
            cache: "pip"
            cache-dependency-path: requirements.txt
        - run: pip install -r ./requirements.txt
        - name: Read version
          id: version
          shell: bash
          run: |
            VER="${{ inputs.version }}"
            if [[ -n "$VER" ]]; then
              echo "version=$VER" >> "$GITHUB_OUTPUT"
            elif [[ -s VERSION ]]; then
              echo "version=$(tr -d '\r' < VERSION | sed 's/^v//')" >> "$GITHUB_OUTPUT"
            else
              echo "version=1.0.0" >> "$GITHUB_OUTPUT"
            fi

        - name: Build for Linux
          env:
            PYI_APP_VERSION: ${{ steps.version.outputs.version }}
            PORTABLE: portable-
          run: pyinstaller build_resources/main_linux.spec
        - if: ${{ github.event_name != 'pull_request' }}
          name: Upload Linux Artifact
          uses: actions/upload-artifact@v7
          with:
            name: wonky-window-linux
            path: "dist/WonkyWindow-linux-v${{ steps.version.outputs.version }}*"
            retention-days: 7
            if-no-files-found: error