release.yml

name: Release

on:
  push:
    tags:
      - 'v*'
  workflow_dispatch:
    inputs:
      tag:
        description: 'Release tag (e.g., v0.2.0)'
        required: true

permissions:
  contents: write

# WO-520@v2: accidental duplicate attempts for one tag must not race asset and formula writes.
concurrency:
  group: release-${{ github.event_name == 'workflow_dispatch' && inputs.tag || github.ref_name }}
  cancel-in-progress: false

jobs:
  resolve:
    name: Resolve Tag
    runs-on: ubuntu-22.04
    outputs:
      tag: ${{ steps.tag.outputs.tag }}
      ref: ${{ steps.tag.outputs.ref }}
    steps:
      - name: Resolve tag and ref
        id: tag
        run: |
          if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
            echo "tag=${{ github.event.inputs.tag }}" >> "$GITHUB_OUTPUT"
            echo "ref=${{ github.event.inputs.tag }}" >> "$GITHUB_OUTPUT"
          else
            echo "tag=${{ github.ref_name }}" >> "$GITHUB_OUTPUT"
            echo "ref=${{ github.ref }}" >> "$GITHUB_OUTPUT"
          fi

  validate-tag:
    name: Validate Tag vs Source Version
    runs-on: ubuntu-22.04
    needs: resolve
    steps:
      - uses: actions/checkout@v7
        with:
          ref: ${{ needs.resolve.outputs.ref }}

      - name: Check source version matches tag
        run: |
          TAG="${{ needs.resolve.outputs.tag }}"
          EXPECTED="${TAG#v}"
          SOURCE=$(grep -oE '"[0-9]+\.[0-9]+\.[0-9]+"' Sources/PastewatchCore/Version.swift | tr -d '"')
          if [ "$SOURCE" = "$EXPECTED" ]; then
            echo "✓ Tag ${TAG} matches source version ${SOURCE}"
          else
            COMMIT=$(git rev-parse HEAD)
            echo "::error::Tag/source version mismatch — aborting release"
            echo ""
            echo "  Tag:            ${TAG}"
            echo "  Source version: ${SOURCE}"
            echo "  Tagged commit:  ${COMMIT}"
            echo ""
            echo "Remediation:"
            echo "  git tag -d ${TAG} && git push --delete origin ${TAG}"
            echo "  # ensure the bump commit (Version.current = \"${EXPECTED}\") is on main"
            echo "  git tag ${TAG} <bump-commit-sha>"
            echo "  git push origin ${TAG}"
            exit 1
          fi

  test:
    name: Test
    runs-on: macos-14
    needs: [resolve, validate-tag]
    steps:
      - uses: actions/checkout@v7
        with:
          ref: ${{ needs.resolve.outputs.ref }}

      - name: Select Xcode
        run: sudo xcode-select -s /Applications/Xcode_15.2.app

      - name: Run Tests
        run: swift test

  build-linux:
    name: Build Linux Release
    runs-on: ubuntu-22.04
    needs: [resolve, test]
    steps:
      - uses: actions/checkout@v7
        with:
          ref: ${{ needs.resolve.outputs.ref }}

      - uses: swift-actions/setup-swift@v2
        with:
          swift-version: "5.9"

      - name: Build CLI
        run: |
          swift build -c release --product PastewatchCLI
          mkdir -p release
          cp .build/release/PastewatchCLI release/pastewatch-cli-linux-amd64

      - name: Generate SHA256
        run: |
          cd release
          sha256sum pastewatch-cli-linux-amd64 > pastewatch-cli-linux-amd64.sha256

      - name: Upload artifacts
        uses: actions/upload-artifact@v7
        with:
          name: linux-release
          path: release/

  build-linux-arm64:
    name: Build Linux Release (arm64)
    runs-on: ubuntu-22.04-arm
    needs: [resolve, test]
    # Build inside the official Swift arm64 image. swift-actions/setup-swift@v2
    # installs the x86_64 toolchain on arm64 runners (the swift binary is an
    # x86_64 ELF, so the arm64 host cannot exec it), which fails the job.
    container: swift:5.9-jammy
    steps:
      - uses: actions/checkout@v7
        with:
          ref: ${{ needs.resolve.outputs.ref }}

      - name: Build CLI
        run: |
          swift build -c release --product PastewatchCLI
          mkdir -p release
          cp .build/release/PastewatchCLI release/pastewatch-cli-linux-arm64

      - name: Generate SHA256
        run: |
          cd release
          sha256sum pastewatch-cli-linux-arm64 > pastewatch-cli-linux-arm64.sha256

      - name: Upload artifacts
        uses: actions/upload-artifact@v7
        with:
          name: linux-arm64-release
          path: release/

  build:
    name: Build Release
    runs-on: macos-14
    needs: [resolve, test, build-linux, build-linux-arm64]
    steps:
      - uses: actions/checkout@v7
        with:
          ref: ${{ needs.resolve.outputs.ref }}

      - name: Select Xcode
        run: sudo xcode-select -s /Applications/Xcode_15.2.app

      - name: Build Release Binaries (Universal)
        run: |
          swift build -c release --arch arm64
          swift build -c release --arch x86_64
          mkdir -p release
          lipo -create .build/arm64-apple-macosx/release/PastewatchCLI .build/x86_64-apple-macosx/release/PastewatchCLI -output release/pastewatch-cli
          codesign -s - -f release/pastewatch-cli
          cp .build/arm64-apple-macosx/release/Pastewatch release/pastewatch

      - name: Create App Bundle
        run: |
          VERSION="${{ needs.resolve.outputs.tag }}"
          VERSION="${VERSION#v}"
          mkdir -p "release/Pastewatch.app/Contents/MacOS"
          mkdir -p "release/Pastewatch.app/Contents/Resources"
          cp .build/release/Pastewatch "release/Pastewatch.app/Contents/MacOS/Pastewatch"
          cp Sources/Pastewatch/Resources/AppIcon.icns "release/Pastewatch.app/Contents/Resources/AppIcon.icns"
          cat > "release/Pastewatch.app/Contents/Info.plist" << EOF
          <?xml version="1.0" encoding="UTF-8"?>
          <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
          <plist version="1.0">
          <dict>
              <key>CFBundleDevelopmentRegion</key>
              <string>en</string>
              <key>CFBundleExecutable</key>
              <string>Pastewatch</string>
              <key>CFBundleIconFile</key>
              <string>AppIcon</string>
              <key>CFBundleIdentifier</key>
              <string>com.ppiankov.pastewatch</string>
              <key>CFBundleInfoDictionaryVersion</key>
              <string>6.0</string>
              <key>CFBundleName</key>
              <string>Pastewatch</string>
              <key>CFBundlePackageType</key>
              <string>APPL</string>
              <key>CFBundleShortVersionString</key>
              <string>${VERSION}</string>
              <key>CFBundleVersion</key>
              <string>1</string>
              <key>LSMinimumSystemVersion</key>
              <string>14.0</string>
              <key>LSUIElement</key>
              <true/>
              <key>NSHighResolutionCapable</key>
              <true/>
              <key>NSUserNotificationAlertStyle</key>
              <string>banner</string>
          </dict>
          </plist>
          EOF

      - name: Create DMG
        run: |
          TAG="${{ needs.resolve.outputs.tag }}"
          hdiutil create -volname "Pastewatch" -srcfolder release/Pastewatch.app -ov -format UDZO "release/Pastewatch-${TAG}.dmg"

      - name: Create ZIP
        run: |
          TAG="${{ needs.resolve.outputs.tag }}"
          cd release
          zip -r "Pastewatch-${TAG}.zip" Pastewatch.app

      - name: Generate SHA256 checksums
        run: |
          TAG="${{ needs.resolve.outputs.tag }}"
          cd release
          shasum -a 256 "Pastewatch-${TAG}.dmg" > "Pastewatch-${TAG}.dmg.sha256"
          shasum -a 256 "Pastewatch-${TAG}.zip" > "Pastewatch-${TAG}.zip.sha256"
          shasum -a 256 pastewatch > pastewatch.sha256
          shasum -a 256 pastewatch-cli > pastewatch-cli.sha256

      - name: Download Linux amd64 artifacts
        uses: actions/download-artifact@v8
        with:
          name: linux-release
          path: release/

      - name: Download Linux arm64 artifacts
        uses: actions/download-artifact@v8
        with:
          name: linux-arm64-release
          path: release/

      - name: Extract release notes from CHANGELOG
        id: notes
        run: |
          TAG="${{ needs.resolve.outputs.tag }}"
          VERSION="${TAG#v}"
          # Extract the [VERSION] section from CHANGELOG.md
          # Matches "## [0.19.0]" and captures until the next "## [" header
          NOTES=$(awk -v ver="## [${VERSION}]" '
            BEGIN { found=0 }
            index($0, ver) == 1 { found=1; next }
            found && /^## \[/ { exit }
            found { print }
          ' CHANGELOG.md | sed '/^$/N;/^\n$/d')

          if [ -z "$NOTES" ]; then
            NOTES="Release ${TAG}"
          fi

          # Write to file to avoid quoting issues
          echo "$NOTES" > /tmp/release-notes.md

      - name: Create Release
        uses: softprops/action-gh-release@v3
        with:
          tag_name: ${{ needs.resolve.outputs.tag }}
          body_path: /tmp/release-notes.md
          files: |
            release/Pastewatch-${{ needs.resolve.outputs.tag }}.dmg
            release/Pastewatch-${{ needs.resolve.outputs.tag }}.dmg.sha256
            release/Pastewatch-${{ needs.resolve.outputs.tag }}.zip
            release/Pastewatch-${{ needs.resolve.outputs.tag }}.zip.sha256
            release/pastewatch
            release/pastewatch.sha256
            release/pastewatch-cli
            release/pastewatch-cli.sha256
            release/pastewatch-cli-linux-amd64
            release/pastewatch-cli-linux-amd64.sha256
            release/pastewatch-cli-linux-arm64
            release/pastewatch-cli-linux-arm64.sha256
          generate_release_notes: false
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

      - name: Update Homebrew formula
        env:
          GH_TOKEN: ${{ secrets.HOMEBREW_TAP_TOKEN }}
        run: |
          TAG="${{ needs.resolve.outputs.tag }}"
          VERSION_NUM="${TAG#v}"
          SHA_MAC=$(shasum -a 256 release/pastewatch-cli | awk '{print $1}')
          SHA_LINUX_AMD64=$(shasum -a 256 release/pastewatch-cli-linux-amd64 | awk '{print $1}')
          SHA_LINUX_ARM64=$(shasum -a 256 release/pastewatch-cli-linux-arm64 | awk '{print $1}')

          cat > /tmp/pastewatch.rb << FORMULA
          # typed: false
          # frozen_string_literal: true

          class Pastewatch < Formula
            desc "Sensitive data scanner — deterministic detection and obfuscation for text content"
            homepage "https://github.com/ppiankov/pastewatch"
            version "${VERSION_NUM}"
            license "MIT"

            on_macos do
              url "https://github.com/ppiankov/pastewatch/releases/download/${TAG}/pastewatch-cli"
              sha256 "${SHA_MAC}"
            end

            on_linux do
              on_intel do
                url "https://github.com/ppiankov/pastewatch/releases/download/${TAG}/pastewatch-cli-linux-amd64"
                sha256 "${SHA_LINUX_AMD64}"
              end
              on_arm do
                url "https://github.com/ppiankov/pastewatch/releases/download/${TAG}/pastewatch-cli-linux-arm64"
                sha256 "${SHA_LINUX_ARM64}"
              end
            end

            def install
              downloaded = Dir["pastewatch-cli*"].first || "pastewatch-cli"
              mv downloaded, "pastewatch-cli" if downloaded != "pastewatch-cli"
              bin.install "pastewatch-cli"
            end

            test do
              assert_match "pastewatch-cli", shell_output("#{bin}/pastewatch-cli version")
            end
          end
          FORMULA

          # Remove leading whitespace from heredoc
          sed -i '' 's/^          //' /tmp/pastewatch.rb

          if [ -n "$GH_TOKEN" ]; then
            EXISTING_SHA=$(gh api repos/ppiankov/homebrew-tap/contents/Formula/pastewatch.rb --jq .sha 2>/dev/null || echo '')
            gh api repos/ppiankov/homebrew-tap/contents/Formula/pastewatch.rb \
              --method PUT \
              --field message="Update pastewatch to ${TAG}" \
              --field content="$(base64 -i /tmp/pastewatch.rb)" \
              --field sha="${EXISTING_SHA}" \
              || echo "Homebrew tap update failed — check HOMEBREW_TAP_TOKEN secret"
          else
            echo "HOMEBREW_TAP_TOKEN not set — skipping Homebrew update"
          fi