build-macos.yml

name: build-macos
on:
    workflow_call:
        inputs:
            dry:
                default: false
                description: Prevent signing and upload
                required: false
                type: boolean
        secrets:
            TAURI_PRIVATE_KEY:
                required: false
            TAURI_KEY_PASSWORD:
                required: false
            MACOS_CODESIGN_P12_B64:
                required: false
            CERT_PASSWORD:
                required: false
            MACOS_CODESIGN_IDENTITY:
                required: false
            APPLE_ID:
                required: false
            APPLE_ID_PASSWORD:
                required: false
            APPLE_TEAM_ID:
                required: false

permissions:
    contents: read

jobs:
    build-macos:
        runs-on: macos-latest
        timeout-minutes: 200
        env:
            HAS_MACOS_CODESIGN: ${{ secrets.MACOS_CODESIGN_P12_B64 != '' && secrets.CERT_PASSWORD != '' && secrets.MACOS_CODESIGN_IDENTITY != '' }}
            HAS_APPLE_NOTARY: ${{ secrets.APPLE_ID != '' && secrets.APPLE_ID_PASSWORD != '' && secrets.APPLE_TEAM_ID != '' }}
            HAS_TAURI_SIGNING: ${{ secrets.TAURI_PRIVATE_KEY != '' }}
        steps:
            - uses: actions/checkout@v4

            - uses: actions/setup-node@v4
              with:
                  node-version: lts/*

            - name: Setup Rust
              uses: dtolnay/rust-toolchain@4be9e76fd7c4901c61fb841f559994984270fce7

            - uses: swatinem/rust-cache@779680da715d629ac1d338a641029a2f4372abb5
              with:
                  workspaces: './src-tauri -> target'

            - name: Install pnpm
              run: npm install -g pnpm@11.8.0

            - name: Download & extract ONNX model (macOS)
              if: ${{ inputs.dry == false }}
              shell: bash
              run: bash .github/scripts/download-parakeet-model.sh resources

            # ── Official Apple code signing ──────────────────────────────
            - name: Import Apple Developer ID certificate
              if: ${{ inputs.dry == false && env.HAS_MACOS_CODESIGN == 'true' }}
              shell: bash
              env:
                  MACOS_CODESIGN_P12_B64: ${{ secrets.MACOS_CODESIGN_P12_B64 }}
                  MACOS_CODESIGN_P12_PASSWORD: ${{ secrets.CERT_PASSWORD }}
                  MACOS_CODESIGN_IDENTITY: ${{ secrets.MACOS_CODESIGN_IDENTITY }}
              run: |
                  set -euo pipefail

                  # Create a temporary keychain
                  KEYCHAIN_PATH="$RUNNER_TEMP/build.keychain-db"
                  KEYCHAIN_PASSWORD="$(openssl rand -base64 32)"

                  security create-keychain -p "$KEYCHAIN_PASSWORD" "$KEYCHAIN_PATH"
                  security set-keychain-settings -lut 21600 "$KEYCHAIN_PATH"
                  security unlock-keychain -p "$KEYCHAIN_PASSWORD" "$KEYCHAIN_PATH"

                  # Import certificate
                  printf '%s' "$MACOS_CODESIGN_P12_B64" | base64 -D -o "$RUNNER_TEMP/codesign.p12"
                  security import "$RUNNER_TEMP/codesign.p12" \
                    -k "$KEYCHAIN_PATH" \
                    -P "$MACOS_CODESIGN_P12_PASSWORD" \
                    -A -t cert -f pkcs12
                  rm -f "$RUNNER_TEMP/codesign.p12"

                  # Allow codesign to access the keychain
                  security set-key-partition-list \
                    -S apple-tool:,apple: \
                    -s -k "$KEYCHAIN_PASSWORD" "$KEYCHAIN_PATH"

                  # Add to search list
                  security list-keychains -d user -s "$KEYCHAIN_PATH" $(security list-keychains -d user | tr -d '"')

                  echo "CODESIGN_IDENTITY=${MACOS_CODESIGN_IDENTITY}" >> "$GITHUB_ENV"
                  echo "KEYCHAIN_PATH=${KEYCHAIN_PATH}" >> "$GITHUB_ENV"
                  echo "APPLE_SIGNING_IDENTITY=${MACOS_CODESIGN_IDENTITY}" >> "$GITHUB_ENV"

            - name: Install frontend deps
              run: pnpm install

            - name: Remove Windows-only hotkey resource
              shell: bash
              run: |
                  node <<'NODE'
                  const fs = require('fs');
                  const path = 'src-tauri/tauri.conf.json';
                  const config = JSON.parse(fs.readFileSync(path, 'utf8'));
                  config.bundle.resources = config.bundle.resources.filter(
                    (resource) => resource !== '../hotkeys/target/release/hyperyap-hotkeys.exe'
                  );
                  fs.writeFileSync(path, `${JSON.stringify(config, null, 4)}\n`);
                  NODE

            # ── Build ────────────────────────────────────────────────────
            # APPLE_SIGNING_IDENTITY is set so Tauri signs the .app with
            # hardened runtime during the build (required for notarization)
            - name: Build
              run: pnpm tauri build ${{ inputs.dry && '--no-bundle' || '--bundles dmg' }}

            - name: Sign DMG
              if: ${{ inputs.dry == false && env.HAS_MACOS_CODESIGN == 'true' }}
              shell: bash
              run: |
                  set -euo pipefail
                  identity="${CODESIGN_IDENTITY}"
                  bundle_dir="src-tauri/target/release/bundle"

                  # Sign the DMG
                  dmg_path=$(find "$bundle_dir" -type f -name "*.dmg" | head -n 1)
                  if [ -z "$dmg_path" ]; then
                    echo "::error::No DMG found in $bundle_dir"
                    exit 1
                  fi
                  echo "Signing DMG: $dmg_path"
                  codesign --force --options runtime \
                    --sign "$identity" \
                    --timestamp \
                    "$dmg_path"
                  codesign --verify --strict "$dmg_path"

            # ── Notarization ─────────────────────────────────────────────
            - name: Notarize DMG with Apple
              if: ${{ inputs.dry == false && env.HAS_MACOS_CODESIGN == 'true' && env.HAS_APPLE_NOTARY == 'true' }}
              shell: bash
              env:
                  APPLE_ID: ${{ secrets.APPLE_ID }}
                  APPLE_ID_PASSWORD: ${{ secrets.APPLE_ID_PASSWORD }}
                  APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
              run: |
                  set -euo pipefail
                  bundle_dir="src-tauri/target/release/bundle"
                  dmg_path=$(find "$bundle_dir" -type f -name "*.dmg" | head -n 1)

                  if [ -z "$dmg_path" ]; then
                    echo "No DMG found to notarize."
                    exit 1
                  fi

                  echo "Submitting DMG for notarization: $dmg_path"
                  xcrun notarytool submit "$dmg_path" \
                    --apple-id "$APPLE_ID" \
                    --password "$APPLE_ID_PASSWORD" \
                    --team-id "$APPLE_TEAM_ID" \
                    --wait

                  echo "Stapling notarization ticket to DMG..."
                  xcrun stapler staple "$dmg_path"

                  echo "Verifying staple..."
                  xcrun stapler validate "$dmg_path"

            # ── Tauri update signature ───────────────────────────────────
            - name: Restore Tauri signing key
              if: ${{ inputs.dry == false && env.HAS_TAURI_SIGNING == 'true' }}
              shell: bash
              env:
                  TAURI_PRIVATE_KEY: ${{ secrets.TAURI_PRIVATE_KEY }}
              run: |
                  set -euo pipefail
                  if [ -n "$TAURI_PRIVATE_KEY" ]; then
                    echo "$TAURI_PRIVATE_KEY" | (base64 --decode 2>/dev/null || base64 -D) > tauri.key
                  else
                    echo "No TAURI_PRIVATE_KEY provided; skipping key restoration."
                  fi

            - name: Sign DMG(s) with Tauri signer
              if: ${{ inputs.dry == false && env.HAS_TAURI_SIGNING == 'true' }}
              env:
                  TAURI_PRIVATE_KEY_PATH: tauri.key
                  TAURI_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_KEY_PASSWORD }}
              shell: bash
              run: |
                  files=$(find src-tauri/target/release/bundle -type f -name "*.dmg")
                  if [ -n "$files" ]; then
                    pnpm tauri signer sign $files
                  else
                    echo "No DMG found to sign."
                  fi

            - name: Rename DMG files
              if: ${{ inputs.dry == false }}
              shell: bash
              run: |
                  find src-tauri/target/release/bundle -name "*.dmg" -exec sh -c 'mv "$1" "$(dirname "$1")/HyperYap_aarch64_darwin.dmg"' _ {} \;
                  find src-tauri/target/release/bundle -name "*.sig" -exec sh -c 'mv "$1" "$(dirname "$1")/HyperYap_aarch64_darwin.dmg.sig"' _ {} \;

            # ── Cleanup ──────────────────────────────────────────────────
            - name: Cleanup keychain
              if: always()
              shell: bash
              run: |
                  rm -f tauri.key || true
                  if [ -n "${KEYCHAIN_PATH:-}" ] && [ -f "$KEYCHAIN_PATH" ]; then
                    security delete-keychain "$KEYCHAIN_PATH" || true
                  fi

            - name: Upload artifact (1 day)
              if: ${{ inputs.dry == false }}
              uses: actions/upload-artifact@v4
              with:
                  name: hyperyap-macos
                  path: |
                      src-tauri/target/release/bundle/**/*.dmg
                      src-tauri/target/release/bundle/**/*.sig
                  retention-days: 1