release.yml

name: release

on:
  push:
    tags: ["v[0-9]+.[0-9]+.[0-9]+"]

permissions:
  contents: write

concurrency:
  group: release-${{ github.ref }}
  cancel-in-progress: false

jobs:
  release:
    strategy:
      fail-fast: false
      max-parallel: 1
      matrix:
        include:
          - os: macos-15
            target: aarch64-apple-darwin
            args: "--target aarch64-apple-darwin"
          - os: macos-15
            target: x86_64-apple-darwin
            args: "--target x86_64-apple-darwin"
          - os: windows-latest
            target: x86_64-pc-windows-msvc
            args: "--bundles nsis"
    runs-on: ${{ matrix.os }}
    timeout-minutes: 120
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1

      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6
        with:
          bun-version: 1.3.14

      - uses: actions-rust-lang/setup-rust-toolchain@166cdcfd11aee3cb47222f9ddb555ce30ddb9659
        with:
          target: ${{ matrix.target }}
          cache-workspaces: src-tauri -> target

      - run: bun install --frozen-lockfile

      - name: verify tag matches versions
        shell: bash
        run: |
          sh scripts/check-version.sh
          git fetch --no-tags --depth=1 origin main:refs/remotes/origin/main
          test "$(git rev-parse HEAD)" = "$(git rev-parse origin/main)"

      - name: verify updater signing configuration
        shell: bash
        env:
          TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
          TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
        run: |
          test -n "$TAURI_SIGNING_PRIVATE_KEY"
          test -n "$TAURI_SIGNING_PRIVATE_KEY_PASSWORD"

      - name: verify Apple signing configuration
        if: startsWith(matrix.os, 'macos')
        shell: bash
        env:
          APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }}
          APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
          APPLE_SIGNING_IDENTITY: ${{ secrets.APPLE_SIGNING_IDENTITY }}
          APPLE_API_KEY: ${{ secrets.APPLE_API_KEY }}
          APPLE_API_ISSUER: ${{ secrets.APPLE_API_ISSUER }}
          APPLE_API_PRIVATE_KEY: ${{ secrets.APPLE_API_PRIVATE_KEY }}
        run: |
          test -n "$APPLE_CERTIFICATE"
          test -n "$APPLE_CERTIFICATE_PASSWORD"
          test -n "$APPLE_SIGNING_IDENTITY"
          test -n "$APPLE_API_KEY"
          test -n "$APPLE_API_ISSUER"
          test -n "$APPLE_API_PRIVATE_KEY"

      - name: prepare Apple notarization key
        if: startsWith(matrix.os, 'macos')
        shell: bash
        env:
          APPLE_API_KEY: ${{ secrets.APPLE_API_KEY }}
          APPLE_API_PRIVATE_KEY: ${{ secrets.APPLE_API_PRIVATE_KEY }}
        run: |
          umask 077
          APPLE_API_KEY_PATH="$RUNNER_TEMP/AuthKey_${APPLE_API_KEY}.p8"
          printf '%s' "$APPLE_API_PRIVATE_KEY" | base64 --decode -o "$APPLE_API_KEY_PATH"
          test -s "$APPLE_API_KEY_PATH"
          printf 'APPLE_API_KEY_PATH=%s\n' "$APPLE_API_KEY_PATH" >> "$GITHUB_ENV"

      - name: import Apple Developer ID certificate
        if: startsWith(matrix.os, 'macos')
        uses: apple-actions/import-codesign-certs@5142e029c445c10ffc7149d172e540235a065466
        with:
          p12-file-base64: ${{ secrets.APPLE_CERTIFICATE }}
          p12-password: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}

      - name: build signed and notarized macOS release
        if: startsWith(matrix.os, 'macos')
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          APPLE_SIGNING_IDENTITY: ${{ secrets.APPLE_SIGNING_IDENTITY }}
          APPLE_API_KEY: ${{ secrets.APPLE_API_KEY }}
          APPLE_API_ISSUER: ${{ secrets.APPLE_API_ISSUER }}
          APPLE_API_KEY_PATH: ${{ env.APPLE_API_KEY_PATH }}
          TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
          TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
        uses: tauri-apps/tauri-action@1deb371b0cd8bd54025b384f1cd735e725c4060f
        with:
          tagName: v__VERSION__
          releaseName: proxybench v__VERSION__
          releaseBody: macOS DMGs are Developer ID signed and notarized by Apple. The Windows NSIS setup wizard is unsigned and may trigger SmartScreen; choose More info, then Run anyway.
          releaseDraft: true
          uploadUpdaterJson: true
          uploadUpdaterSignatures: true
          updaterJsonPreferNsis: true
          tauriScript: bun run tauri
          args: ${{ matrix.args }}

      - name: notarize and verify macOS DMG
        if: startsWith(matrix.os, 'macos')
        shell: bash
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          APPLE_API_KEY: ${{ secrets.APPLE_API_KEY }}
          APPLE_API_ISSUER: ${{ secrets.APPLE_API_ISSUER }}
          APPLE_API_KEY_PATH: ${{ env.APPLE_API_KEY_PATH }}
        run: |
          APP_PATH="src-tauri/target/${{ matrix.target }}/release/bundle/macos/proxybench.app"
          DMG_DIR="src-tauri/target/${{ matrix.target }}/release/bundle/dmg"
          shopt -s nullglob
          DMGS=("$DMG_DIR"/*.dmg)
          test -d "$APP_PATH"
          test "${#DMGS[@]}" -eq 1
          DMG_PATH="${DMGS[0]}"

          codesign --verify --deep --strict --verbose=2 "$APP_PATH"
          APP_SIGNATURE=$(codesign -d --verbose=4 "$APP_PATH" 2>&1)
          printf '%s\n' "$APP_SIGNATURE" | grep -F "Authority=Developer ID Application:"
          printf '%s\n' "$APP_SIGNATURE" | grep -E 'flags=.*\(.*runtime.*\)'
          xcrun stapler validate -v "$APP_PATH"
          spctl --assess --type execute --verbose=4 "$APP_PATH"

          NOTARY_RESULT=$(xcrun notarytool submit "$DMG_PATH" \
            --key "$APPLE_API_KEY_PATH" \
            --key-id "$APPLE_API_KEY" \
            --issuer "$APPLE_API_ISSUER" \
            --wait --timeout 30m --output-format json)
          if ! printf '%s\n' "$NOTARY_RESULT" | jq -e '.status == "Accepted"'; then
            SUBMISSION_ID=$(printf '%s\n' "$NOTARY_RESULT" | jq -er '.id')
            xcrun notarytool log "$SUBMISSION_ID" \
              --key "$APPLE_API_KEY_PATH" \
              --key-id "$APPLE_API_KEY" \
              --issuer "$APPLE_API_ISSUER"
            exit 1
          fi
          xcrun stapler staple -v "$DMG_PATH"

          codesign --verify --strict --verbose=2 "$DMG_PATH"
          xcrun stapler validate -v "$DMG_PATH"
          spctl --assess --type open --context context:primary-signature --verbose=4 "$DMG_PATH"
          gh release upload "$GITHUB_REF_NAME" "$DMG_PATH" --clobber

      - name: remove Apple notarization key
        if: always() && startsWith(matrix.os, 'macos')
        shell: bash
        run: rm -f "$APPLE_API_KEY_PATH"

      - name: build Windows release
        if: startsWith(matrix.os, 'windows')
        uses: tauri-apps/tauri-action@1deb371b0cd8bd54025b384f1cd735e725c4060f
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
          TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
        with:
          tagName: v__VERSION__
          releaseName: proxybench v__VERSION__
          releaseBody: macOS DMGs are Developer ID signed and notarized by Apple. The Windows NSIS setup wizard is unsigned and may trigger SmartScreen; choose More info, then Run anyway.
          releaseDraft: true
          uploadUpdaterJson: true
          uploadUpdaterSignatures: true
          updaterJsonPreferNsis: true
          tauriScript: bun run tauri
          args: ${{ matrix.args }}

  publish:
    needs: release
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1

      - name: install minisign
        run: sudo apt-get update && sudo apt-get install -y minisign

      - name: validate updater release
        env:
          GH_TOKEN: ${{ github.token }}
          REPO: ${{ github.repository }}
          TAG: ${{ github.ref_name }}
        run: |
          RELEASE_ID=$(gh api --paginate "repos/$REPO/releases?per_page=100" --jq ".[] | select(.draft == true and .name == \"proxybench $TAG\") | .id" | head -n 1)
          test -n "$RELEASE_ID"
          export RELEASE_ID
          sh scripts/validate-release.sh

      - name: generate release notes
        env:
          GH_TOKEN: ${{ github.token }}
          REPO: ${{ github.repository }}
          TAG: ${{ github.ref_name }}
        run: |
          RELEASE_ID=$(gh api --paginate "repos/$REPO/releases?per_page=100" --jq ".[] | select(.draft == true and .name == \"proxybench $TAG\") | .id" | head -n 1)
          test -n "$RELEASE_ID"
          GENERATED_NOTES=$(gh api -X POST "repos/$REPO/releases/generate-notes" -f tag_name="$TAG" --jq .body)
          test -n "$GENERATED_NOTES"
          PLATFORM_NOTICE='macOS DMGs are Developer ID signed and notarized by Apple. The Windows NSIS setup wizard is unsigned and may trigger SmartScreen; choose More info, then Run anyway.'
          jq -n --arg notice "$PLATFORM_NOTICE" --arg notes "$GENERATED_NOTES" '{body: ($notice + "\n\n" + $notes)}' |
            gh api -X PATCH "repos/$REPO/releases/$RELEASE_ID" --input -

      - name: publish release
        env:
          GH_TOKEN: ${{ github.token }}
          REPO: ${{ github.repository }}
          TAG: ${{ github.ref_name }}
        run: |
          RELEASE_ID=$(gh api --paginate "repos/$REPO/releases?per_page=100" --jq ".[] | select(.draft == true and .name == \"proxybench $TAG\") | .id" | head -n 1)
          test -n "$RELEASE_ID"
          gh api -X PATCH "repos/$REPO/releases/$RELEASE_ID" -F tag_name="$TAG" -F draft=false