release.yml

name: Build & Release

on:
  push:
    tags:
      - 'v*'

permissions:
  contents: write

concurrency:
  group: textream-release
  cancel-in-progress: false

jobs:
  version:
    runs-on: macos-15
    outputs:
      tag: ${{ steps.version.outputs.tag }}
      number: ${{ steps.version.outputs.number }}
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          ref: master
          token: ${{ secrets.GITHUB_TOKEN }}

      - name: Get version from tag
        id: version
        run: |
          TAG="${GITHUB_REF#refs/tags/}"
          VERSION="${TAG#v}"
          echo "tag=${TAG}" >> "$GITHUB_OUTPUT"
          echo "number=${VERSION}" >> "$GITHUB_OUTPUT"

      - name: Update macOS app version in Xcode project
        run: |
          ruby .github/set-macos-marketing-version.rb "${{ steps.version.outputs.number }}"

      - name: Commit version bump
        run: |
          git config user.name "github-actions[bot]"
          git config user.email "github-actions[bot]@users.noreply.github.com"
          git add Textream/Textream.xcodeproj/project.pbxproj
          git commit -m "Bump version to ${{ steps.version.outputs.number }}" || echo "No changes to commit"
          git push origin HEAD:refs/heads/master

  build:
    needs: version
    strategy:
      fail-fast: false
      matrix:
        include:
          - runner: macos-15
            xcode: /Applications/Xcode_16.2.app/Contents/Developer
            suffix: "-macos15"
          - runner: macos-26
            xcode: /Applications/Xcode_26.0.app/Contents/Developer
            suffix: ""
    runs-on: ${{ matrix.runner }}
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          ref: ${{ github.ref }}

      - name: Update macOS app version
        run: |
          ruby .github/set-macos-marketing-version.rb "${{ needs.version.outputs.number }}"

      - name: Select Xcode
        run: sudo xcode-select -s ${{ matrix.xcode }}

      - name: Import Developer ID certificate
        env:
          DEVELOPER_ID_P12_BASE64: ${{ secrets.DEVELOPER_ID_P12_BASE64 }}
          DEVELOPER_ID_P12_PASSWORD: ${{ secrets.DEVELOPER_ID_P12_PASSWORD }}
        run: |
          CERTIFICATE_PATH="$RUNNER_TEMP/developer-id.p12"
          INTERMEDIATE_PATH="$RUNNER_TEMP/DeveloperIDG2CA.cer"
          KEYCHAIN_PATH="$RUNNER_TEMP/textream-signing.keychain-db"
          KEYCHAIN_PASSWORD="$(openssl rand -hex 24)"

          printf '%s' "$DEVELOPER_ID_P12_BASE64" | base64 --decode > "$CERTIFICATE_PATH"
          chmod 600 "$CERTIFICATE_PATH"
          curl --fail --silent --show-error \
            https://www.apple.com/certificateauthority/DeveloperIDG2CA.cer \
            --output "$INTERMEDIATE_PATH"

          security create-keychain -p "$KEYCHAIN_PASSWORD" "$KEYCHAIN_PATH"
          security set-keychain-settings -lut 21600 "$KEYCHAIN_PATH"
          security unlock-keychain -p "$KEYCHAIN_PASSWORD" "$KEYCHAIN_PATH"
          security import "$INTERMEDIATE_PATH" -k "$KEYCHAIN_PATH"
          security import "$CERTIFICATE_PATH" \
            -k "$KEYCHAIN_PATH" \
            -P "$DEVELOPER_ID_P12_PASSWORD" \
            -f pkcs12 \
            -T /usr/bin/codesign
          security set-key-partition-list \
            -S apple-tool:,apple:,codesign: \
            -s \
            -k "$KEYCHAIN_PASSWORD" \
            "$KEYCHAIN_PATH"
          security list-keychains -d user -s "$KEYCHAIN_PATH"

          SIGNING_IDENTITY="$(security find-identity -v -p codesigning "$KEYCHAIN_PATH" \
            | awk '/Developer ID Application:/{print $2; exit}')"
          test -n "$SIGNING_IDENTITY"

          echo "SIGNING_IDENTITY=$SIGNING_IDENTITY" >> "$GITHUB_ENV"

      - name: Build universal app
        working-directory: Textream
        run: |
          chmod +x build.sh
          ./build.sh

      - name: Rename DMG
        if: matrix.suffix != ''
        run: mv Textream/build/release/Textream.dmg Textream/build/release/Textream${{ matrix.suffix }}.dmg

      - name: Notarize and validate DMG
        env:
          APPLE_API_ISSUER_ID: ${{ secrets.APPLE_API_ISSUER_ID }}
          APPLE_API_KEY_ID: ${{ secrets.APPLE_API_KEY_ID }}
          APPLE_API_KEY_P8_BASE64: ${{ secrets.APPLE_API_KEY_P8_BASE64 }}
        run: |
          DMG_PATH="Textream/build/release/Textream${{ matrix.suffix }}.dmg"
          NOTARY_KEY_PATH="$RUNNER_TEMP/AuthKey_${APPLE_API_KEY_ID}.p8"
          NOTARY_RESULT_PATH="$RUNNER_TEMP/notary-result.json"
          NOTARY_LOG_PATH="$RUNNER_TEMP/notary-log.json"

          printf '%s' "$APPLE_API_KEY_P8_BASE64" | base64 --decode > "$NOTARY_KEY_PATH"
          chmod 600 "$NOTARY_KEY_PATH"

          set +e
          xcrun notarytool submit "$DMG_PATH" \
            --key "$NOTARY_KEY_PATH" \
            --key-id "$APPLE_API_KEY_ID" \
            --issuer "$APPLE_API_ISSUER_ID" \
            --wait \
            --timeout 30m \
            --output-format json > "$NOTARY_RESULT_PATH"
          NOTARY_EXIT="$?"
          set -e
          cat "$NOTARY_RESULT_PATH"

          SUBMISSION_ID="$(plutil -extract id raw -o - "$NOTARY_RESULT_PATH" 2>/dev/null || true)"
          STATUS="$(plutil -extract status raw -o - "$NOTARY_RESULT_PATH" 2>/dev/null || true)"
          if [ -n "$SUBMISSION_ID" ]; then
            xcrun notarytool log "$SUBMISSION_ID" "$NOTARY_LOG_PATH" \
              --key "$NOTARY_KEY_PATH" \
              --key-id "$APPLE_API_KEY_ID" \
              --issuer "$APPLE_API_ISSUER_ID" || true
            if [ -f "$NOTARY_LOG_PATH" ]; then
              cat "$NOTARY_LOG_PATH"
            fi
          fi
          if [ "$NOTARY_EXIT" -ne 0 ] || [ "$STATUS" != "Accepted" ]; then
            exit 1
          fi

          xcrun stapler staple "$DMG_PATH"
          xcrun stapler validate "$DMG_PATH"
          hdiutil verify "$DMG_PATH"
          codesign --verify --strict --verbose=2 "$DMG_PATH"
          spctl --assess \
            --type open \
            --context context:primary-signature \
            --verbose=4 \
            "$DMG_PATH"

          MOUNT_DIR="$(mktemp -d)"
          cleanup_mount() {
            hdiutil detach "$MOUNT_DIR" -quiet 2>/dev/null || true
            rmdir "$MOUNT_DIR" 2>/dev/null || true
          }
          trap cleanup_mount EXIT
          hdiutil attach "$DMG_PATH" -nobrowse -readonly -mountpoint "$MOUNT_DIR" -quiet
          codesign --verify --deep --strict --verbose=2 "$MOUNT_DIR/Textream.app"
          spctl --assess --type execute --verbose=4 "$MOUNT_DIR/Textream.app"
          hdiutil detach "$MOUNT_DIR" -quiet
          rmdir "$MOUNT_DIR"
          trap - EXIT

      - name: Upload DMG artifact
        uses: actions/upload-artifact@v4
        with:
          name: dmg${{ matrix.suffix }}
          path: Textream/build/release/Textream${{ matrix.suffix }}.dmg

      - name: Remove signing credentials
        if: always()
        env:
          APPLE_API_KEY_ID: ${{ secrets.APPLE_API_KEY_ID }}
        run: |
          security delete-keychain \
            "$RUNNER_TEMP/textream-signing.keychain-db" 2>/dev/null || true
          rm -f \
            "$RUNNER_TEMP/developer-id.p12" \
            "$RUNNER_TEMP/DeveloperIDG2CA.cer" \
            "$RUNNER_TEMP/AuthKey_${APPLE_API_KEY_ID}.p8" \
            "$RUNNER_TEMP/notary-result.json" \
            "$RUNNER_TEMP/notary-log.json"

  release:
    needs: [version, build]
    runs-on: macos-15
    steps:
      - name: Download all DMGs
        uses: actions/download-artifact@v4
        with:
          path: artifacts
          merge-multiple: true

      - name: Upload DMGs to GitHub Release
        uses: softprops/action-gh-release@v2
        with:
          files: |
            artifacts/Textream.dmg
            artifacts/Textream-macos15.dmg
          name: Textream ${{ needs.version.outputs.tag }}
          draft: false
          prerelease: false
          generate_release_notes: true
          body: |
            ## Installation

            - **Textream.dmg** — for macOS 26 Tahoe and later (recommended, includes Liquid Glass effects)
            - **Textream-macos15.dmg** — for macOS 15 Sequoia

            1. Download the DMG for your macOS version
            2. Open the DMG and drag **Textream** to Applications
            3. Open Textream normally. The app is signed and notarized by Apple.

            Or install via Homebrew:

            ```
            brew install textream
            ```

      - name: Compute DMG SHA256
        id: sha
        run: |
          echo "sha256_26=$(shasum -a 256 artifacts/Textream.dmg | awk '{print $1}')" >> "$GITHUB_OUTPUT"
          echo "sha256_15=$(shasum -a 256 artifacts/Textream-macos15.dmg | awk '{print $1}')" >> "$GITHUB_OUTPUT"

      - name: Update Homebrew Cask tap
        env:
          TAP_REPO_TOKEN: ${{ secrets.TAP_REPO_TOKEN }}
          VERSION: ${{ needs.version.outputs.tag }}
          SHA256_26: ${{ steps.sha.outputs.sha256_26 }}
          SHA256_15: ${{ steps.sha.outputs.sha256_15 }}
        run: |
          VERSION_NUM="${VERSION#v}"
          git clone https://x-access-token:${TAP_REPO_TOKEN}@github.com/f/homebrew-textream.git tap
          mkdir -p tap/Casks
          cat > tap/Casks/textream.rb << CASKEOF
          cask "textream" do
            version "${VERSION_NUM}"

            on_sequoia do
              sha256 "${SHA256_15}"
              url "https://github.com/f/textream/releases/download/v#{version}/Textream-macos15.dmg"
            end

            on_tahoe :or_newer do
              sha256 "${SHA256_26}"
              url "https://github.com/f/textream/releases/download/v#{version}/Textream.dmg"
            end

            name "Textream"
            desc "Teleprompter that highlights scripts in real time as you speak"
            homepage "https://textream.net/"

            depends_on macos: :sequoia

            app "Textream.app"

            zap trash: [
              "~/Library/Preferences/dev.fka.textream.plist",
              "~/Library/Saved Application State/dev.fka.textream.savedState",
            ]
          end
          CASKEOF
          cd tap
          git config user.name "github-actions[bot]"
          git config user.email "github-actions[bot]@users.noreply.github.com"
          git add Casks/textream.rb
          git commit -m "Update Textream to ${VERSION}"
          git push