build.yml

name: build

on:
  push:
    branches: [ main ]
    tags: [ v* ]
    paths-ignore:
      - '**/*.md'
      - '**/*.gitignore'
      - '**/*.gitattributes'
  pull_request:
    branches: [ main, dotnet-vnext ]
  workflow_dispatch:

env:
  ARTIFACTS_PATH: ./artifacts
  DOTNET_CLI_TELEMETRY_OPTOUT: true
  DOTNET_GENERATE_ASPNET_CERTIFICATE: false
  DOTNET_NOLOGO: true
  MACOS_APP_NAME: HelloWorld.app
  MACOS_APP_PATH: ./artifacts/HelloWorld.app
  NUGET_XMLDOC_MODE: skip

permissions: {}

jobs:
  build:
    name: build
    runs-on: macos-latest

    permissions:
      contents: read

    steps:

    - name: Checkout code
      uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
      with:
        filter: 'tree:0'
        persist-credentials: false
        show-progress: false

    - name: Setup .NET SDK
      uses: actions/setup-dotnet@d4c94342e560b34958eacfc5d055d21461ed1c5d # v5.0.0

    - name: Build and publish
      shell: pwsh
      run: ./build.ps1

    - name: Publish artifacts
      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
      with:
        name: app
        path: ${{ env.ARTIFACTS_PATH }}

  notarize:
    needs: build
    runs-on: macos-latest
    if: |
      github.event.repository.fork == false &&
      !contains(fromJSON('["dependabot[bot]", "github-actions[bot]", "renovate[bot]"]'), github.event.pull_request.user.login)

    permissions:
      contents: read

    steps:

    - name: Checkout code
      uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
      with:
        filter: 'tree:0'
        persist-credentials: false
        show-progress: false

    - name: Download artifacts
      uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6.0.0
      with:
        name: app
        path: ${{ env.ARTIFACTS_PATH }}

    - name: Generate macOS app
      shell: pwsh
      run: |
        $Artifacts = "${env:ARTIFACTS_PATH}"
        $AppPath = "${env:MACOS_APP_PATH}"
        $ContentsPath = (Join-Path ${AppPath} "Contents")
        $PublishPath = (Join-Path ${Artifacts} "publish")
        New-Item -Path ${Artifacts} -Name ${env:MACOS_APP_NAME} -ItemType "Directory" | Out-Null
        New-Item -Path ${AppPath} -Name "Contents" -ItemType "Directory" | Out-Null
        New-Item -Path ${ContentsPath} -Name "Resources" -ItemType "Directory" | Out-Null
        Copy-Item -Path ${PublishPath} -Destination (Join-Path ${ContentsPath} "MacOS") -Recurse | Out-Null
        Copy-Item -Path ./src/HelloWorld/Info.plist -Destination ${ContentsPath} | Out-Null

    - name: Configure Xcode
      uses: martincostello/xcode-select@db3d404e6e20374a638c10a68e3d804977ec19cb # node20
      with:
        version: "16.4"

    - name: Import Distribution Certificate
      uses: martincostello/import-signing-certificate@a80a8cdd27ba2b00e0e80480fb66c4149de04061 # node20
      with:
        certificate-data: ${{ secrets.DISTRIBUTION_CERTIFICATE_DATA }}
        certificate-passphrase: ${{ secrets.DISTRIBUTION_CERTIFICATE_PASSPHRASE }}
        keychain-name: ''
        keychain-password: ${{ secrets.KEYCHAIN_PASSWORD }}

    - name: Sign app
      shell: bash
      env:
        APP_NAME: ${{ env.MACOS_APP_PATH }}
        ENTITLEMENTS: ./src/HelloWorld/HelloWorld.entitlements
        SIGNING_IDENTITY: ${{ secrets.SIGNING_IDENTITY }}
      run: |
        chmod +x "${APP_NAME}/Contents/MacOS/HelloWorld"
        find "${APP_NAME}/Contents/MacOS/" | while read -r fname; do
            if [[ -f "${fname}" ]]; then
                echo "Signing ${fname}"
                codesign --force --timestamp --options=runtime --entitlements "${ENTITLEMENTS}" --sign "${SIGNING_IDENTITY}" "${fname}" || true
            fi
        done
        echo "Signing app file"
        codesign --force --timestamp --options=runtime --entitlements "${ENTITLEMENTS}" --sign "${SIGNING_IDENTITY}" "${APP_NAME}"

    - name: Notarize app
      uses: martincostello/xcode-notarize@b461d5783f3d2e7f94e71296e42804b1f81a9dc7 # zizmor: ignore[stale-action-refs] Points to notarytool branch of deprecated action
      with:
        product-path: ${{ env.MACOS_APP_PATH }}
        apple-id: ${{ secrets.NOTARIZATION_USERNAME }}
        app-password: ${{ secrets.NOTARIZATION_PASSWORD }}
        team-id: ${{ secrets.NOTARIZATION_TEAM_ID }}

    - name: Staple app
      uses: martincostello/xcode-staple@6961e581904dea5b988186057568c92667fb03a1 # node20
      with:
        product-path: ${{ env.MACOS_APP_PATH }}

    - name: Package signed app
      run: ditto -V -c -k --keepParent "${MACOS_APP_PATH}" ./artifacts/HelloWorld-osx-x64.zip

    - name: Publish signed app
      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
      with:
        name: app-signed
        path: ./artifacts/HelloWorld-osx-x64.zip

  release:
    if: startsWith(github.ref, 'refs/tags/v')
    name: release
    needs: notarize
    runs-on: macos-latest

    permissions:
      contents: write

    steps:

    - name: Download signed app
      uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6.0.0
      with:
        name: app-signed

    - name: Create GitHub release
      uses: softprops/action-gh-release@5be0e66d93ac7ed76da52eca8bb058f665c3a5fe # v2.4.2
      env:
        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
      with:
        draft: true
        files: '*.zip'