jan/.github/workflows/template-build-macos-arm64.yml

name: build-macos
on:
  workflow_call:
    inputs:
      ref:
        required: true
        type: string
        default: 'refs/heads/main'
      public_provider:
        required: true
        type: string
        default: none
        description: 'none: build only, github: build and publish to github, cloudflare: build and publish to cloudflare'
      new_version:
        required: true
        type: string
        default: ''
      cloudflare_r2_path:
        required: false
        type: string
        default: '/latest/'
    secrets:
      CLOUDFLARE_R2_BUCKET_NAME:
        required: false
      CLOUDFLARE_R2_ACCESS_KEY_ID:
        required: false
      CLOUDFLARE_R2_SECRET_ACCESS_KEY:
        required: false
      CLOUDFLARE_ACCOUNT_ID:
        required: false
      CODE_SIGN_P12_BASE64:
        required: false
      CODE_SIGN_P12_PASSWORD:
        required: false
      APPLE_ID:
        required: false
      APPLE_APP_SPECIFIC_PASSWORD:
        required: false
      DEVELOPER_ID:
        required: false

jobs:
  build-macos:
    runs-on: macos-latest
    environment: production
    permissions:
      contents: write
    steps:
      - name: Getting the repo
        uses: actions/checkout@v3
        with:
          ref: ${{ inputs.ref }}

      - name: Installing node
        uses: actions/setup-node@v1
        with:
          node-version: 20

      - name: Install python
        uses: actions/setup-python@v4
        with:
          python-version: '3.9'

      - name: Install jq
        uses: dcarbone/install-jq-action@v2.0.1

      - name: Update app version based on latest release tag with build number
        if: inputs.public_provider != 'github'
        run: |
          echo "Version: ${{ inputs.new_version }}"
          # Update the version in electron/package.json
          jq --arg version "${{ inputs.new_version }}" '.version = $version' electron/package.json > /tmp/package.json
          mv /tmp/package.json electron/package.json

          jq --arg version "${{ inputs.new_version }}" '.version = $version' web/package.json > /tmp/package.json
          mv /tmp/package.json web/package.json

          jq '.build.publish = [{"provider": "generic", "url": "${{ secrets.CLOUDFLARE_R2_PUBLIC_URL }}", "channel": "latest"}, {"provider": "s3", "bucket": "${{ secrets.CLOUDFLARE_R2_BUCKET_NAME }}", "region": "auto", "endpoint": "https://${{ secrets.CLOUDFLARE_ACCOUNT_ID }}.r2.cloudflarestorage.com", "path": "${{ inputs.cloudflare_r2_path }}", "channel": "latest"}]' electron/package.json > /tmp/package.json
          mv /tmp/package.json electron/package.json

          jq --arg teamid "${{ secrets.APPLE_TEAM_ID }}" '.build.mac.notarize.teamId = $teamid' electron/package.json > /tmp/package.json
          mv /tmp/package.json electron/package.json

          cat electron/package.json

      - name: Update app version base on tag
        if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags/') && inputs.public_provider == 'github'
        run: |
          if [[ ! "${VERSION_TAG}" =~ ^v[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
              echo "Error: Tag is not valid!"
              exit 1
          fi
          jq --arg version "${VERSION_TAG#v}" '.version = $version' electron/package.json > /tmp/package.json
          mv /tmp/package.json electron/package.json
          jq --arg version "${VERSION_TAG#v}" '.version = $version' web/package.json > /tmp/package.json
          mv /tmp/package.json web/package.json
          jq --arg teamid "${{ secrets.APPLE_TEAM_ID }}" '.build.mac.notarize.teamId = $teamid' electron/package.json > /tmp/package.json
          mv /tmp/package.json electron/package.json
          cat electron/package.json
        env:
          VERSION_TAG: ${{ inputs.new_version }}

      - name: Get Cer for code signing
        run: base64 -d <<< "$CODE_SIGN_P12_BASE64" > /tmp/codesign.p12
        shell: bash
        env:
          CODE_SIGN_P12_BASE64: ${{ secrets.CODE_SIGN_P12_BASE64 }}

      - uses: apple-actions/import-codesign-certs@v2
        continue-on-error: true
        with:
          p12-file-base64: ${{ secrets.CODE_SIGN_P12_BASE64 }}
          p12-password: ${{ secrets.CODE_SIGN_P12_PASSWORD }}

      - name: Build and publish app to cloudflare r2 or github artifactory
        if: inputs.public_provider != 'github'
        run: |
          # check public_provider is true or not
          echo "public_provider is ${{ inputs.public_provider }}"
          if [ "${{ inputs.public_provider }}" == "none" ]; then
            make build    
          else
            make build-and-publish
          fi
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          CSC_LINK: "/tmp/codesign.p12"
          CSC_KEY_PASSWORD: ${{ secrets.CODE_SIGN_P12_PASSWORD }}
          CSC_IDENTITY_AUTO_DISCOVERY: "true"
          APPLE_ID: ${{ secrets.APPLE_ID }}
          APPLE_APP_SPECIFIC_PASSWORD: ${{ secrets.APPLE_APP_SPECIFIC_PASSWORD }}
          APP_PATH: "."
          DEVELOPER_ID: ${{ secrets.DEVELOPER_ID }}
          AWS_ACCESS_KEY_ID: ${{ secrets.CLOUDFLARE_R2_ACCESS_KEY_ID }}
          AWS_SECRET_ACCESS_KEY: ${{ secrets.CLOUDFLARE_R2_SECRET_ACCESS_KEY }}
          AWS_DEFAULT_REGION: auto
          AWS_EC2_METADATA_DISABLED: "true"

      - name: Build and publish app to github
        if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags/') && inputs.public_provider == 'github'
        run: |
          make build-and-publish
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          CSC_LINK: "/tmp/codesign.p12"
          CSC_KEY_PASSWORD: ${{ secrets.CODE_SIGN_P12_PASSWORD }}
          CSC_IDENTITY_AUTO_DISCOVERY: "true"
          APPLE_ID: ${{ secrets.APPLE_ID }}
          APPLE_APP_SPECIFIC_PASSWORD: ${{ secrets.APPLE_APP_SPECIFIC_PASSWORD }}
          APP_PATH: "."
          DEVELOPER_ID: ${{ secrets.DEVELOPER_ID }}
          ANALYTICS_ID: ${{ secrets.JAN_APP_UMAMI_PROJECT_API_KEY }}
          ANALYTICS_HOST: ${{ secrets.JAN_APP_UMAMI_URL }}

      - name: Upload Artifact
        if: inputs.public_provider != 'github'
        uses: actions/upload-artifact@v2
        with:
          name: jan-mac-arm64-${{ inputs.new_version }}
          path: ./electron/dist/jan-mac-arm64-${{ inputs.new_version }}.dmg

      - name: Upload Artifact
        uses: actions/upload-artifact@v2
        with:
          name: latest-mac-arm64
          path: ./electron/dist/latest-mac.yml