release.yml

name: Release

# Tagging is the release: `git tag v1.2.0 && git push --tags` builds the app and
# publishes it. Also runnable by hand to rehearse a build without tagging.
on:
  push:
    tags: ["v*"]
  workflow_dispatch:

permissions:
  contents: write

jobs:
  build:
    runs-on: macos-latest
    steps:
      - uses: actions/checkout@v7
        with:
          fetch-depth: 0 # build.sh reads tags and the commit count

      - name: Build
        run: ./build.sh

      # Two assets: a DMG for people who just want to drag it to Applications,
      # and a zip for scripted installs. `ditto` rather than `zip` for the
      # latter — it preserves the bundle's symlinks and resource forks.
      - name: Package
        run: |
          VERSION="${GITHUB_REF_NAME#v}"
          [ "$GITHUB_REF_TYPE" = tag ] || VERSION="dev-${GITHUB_SHA::7}"
          ditto -c -k --keepParent build/ScreenBox.app "ScreenBox-$VERSION.zip"
          ./scripts/make-dmg.sh "$VERSION"
          mv "build/ScreenBox-$VERSION.dmg" .
          echo "DMG=ScreenBox-$VERSION.dmg" >> "$GITHUB_ENV"
          echo "ZIP=ScreenBox-$VERSION.zip" >> "$GITHUB_ENV"

      - name: Upload build artifacts
        uses: actions/upload-artifact@v7
        with:
          name: ScreenBox
          path: |
            ${{ env.DMG }}
            ${{ env.ZIP }}

      # The app is only ad-hoc signed, so Gatekeeper quarantines it on download.
      # The release notes have to say how to get past that.
      - name: Publish release
        if: github.ref_type == 'tag'
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          # Re-running a tag build shouldn't fail the job just because the
          # release already exists — replace the asset instead.
          if gh release view "$GITHUB_REF_NAME" >/dev/null 2>&1; then
            gh release upload "$GITHUB_REF_NAME" "$DMG" "$ZIP" --clobber
          else
            gh release create "$GITHUB_REF_NAME" "$DMG" "$ZIP" \
              --title "$GITHUB_REF_NAME" \
              --notes-file .github/install-notes.md \
              --generate-notes
          fi

      # Homebrew installs come from Orva-Studio/homebrew-tap, which pins the
      # version and the zip's checksum. Point it at the release we just made.
      # TAP_TOKEN is a PAT with contents:write on that repo — github.token is
      # scoped to this one and can't push there.
      - name: Update the Homebrew cask
        if: github.ref_type == 'tag'
        env:
          GH_TOKEN: ${{ secrets.TAP_TOKEN }}
        run: |
          VERSION="${GITHUB_REF_NAME#v}"
          SHA=$(shasum -a 256 "$ZIP" | cut -d' ' -f1)

          git clone --depth 1 \
            "https://x-access-token:$GH_TOKEN@github.com/Orva-Studio/homebrew-tap.git" tap
          CASK=tap/Casks/screenbox.rb

          # Only the two pinned lines change; the rest of the cask is hand-kept.
          sed -i '' \
            -e "s|^  version \".*\"|  version \"$VERSION\"|" \
            -e "s|^  sha256 \".*\"|  sha256 \"$SHA\"|" \
            "$CASK"

          cd tap
          git diff --quiet && { echo "Cask already at $VERSION"; exit 0; }
          git config user.name "github-actions[bot]"
          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
          git commit -qam "Update ScreenBox to $VERSION"
          git push -q