jan/.github/workflows/template-build-macos-x64.yml

name: build-macos
on:
  workflow_call:
    inputs:
      ref:
        required: true
        type: string
        default: 'refs/heads/main'
      public_provider:
        required: true
        type: string
        default: none
        description: 'none: build only, github: build and publish to github, aws s3: build and publish to aws s3'
      new_version:
        required: true
        type: string
        default: ''
      aws_s3_prefix:
        required: false
        type: string
        default: '/latest/'
    secrets:
      DELTA_AWS_S3_BUCKET_NAME:
        required: false
      DELTA_AWS_ACCESS_KEY_ID:
        required: false
      DELTA_AWS_SECRET_ACCESS_KEY:
        required: false
      CODE_SIGN_P12_BASE64:
        required: false
      CODE_SIGN_P12_PASSWORD:
        required: false
      APPLE_ID:
        required: false
      APPLE_APP_SPECIFIC_PASSWORD:
        required: false
      DEVELOPER_ID:
        required: false

jobs:
  build-macos:
    runs-on: macos-13
    environment: production
    permissions:
      contents: write
    steps:
      - name: Getting the repo
        uses: actions/checkout@v3
        with:
          ref: ${{ inputs.ref }}

      - name: Installing node
        uses: actions/setup-node@v1
        with:
          node-version: 20

      - name: Install jq
        uses: dcarbone/install-jq-action@v2.0.1

      - name: Update app version based on latest release tag with build number
        if: inputs.public_provider != 'github'
        run: |
          echo "Version: ${{ inputs.new_version }}"
          # Update the version in electron/package.json
          jq --arg version "${{ inputs.new_version }}" '.version = $version' electron/package.json > /tmp/package.json
          mv /tmp/package.json electron/package.json

          jq --arg version "${{ inputs.new_version }}" '.version = $version' web/package.json > /tmp/package.json
          mv /tmp/package.json web/package.json

          jq '.build.publish = [{"provider": "generic", "url": "${{ secrets.CLOUDFLARE_R2_PUBLIC_URL }}", "channel": "latest"}, {"provider": "s3", "acl": null, "bucket": "${{ secrets.DELTA_AWS_S3_BUCKET_NAME }}", "region": "${{ secrets.DELTA_AWS_REGION}}", "path": "${{ inputs.aws_s3_prefix }}", "channel": "latest"}]' electron/package.json > /tmp/package.json
          mv /tmp/package.json electron/package.json

          jq --arg teamid "${{ secrets.APPLE_TEAM_ID }}" '.build.mac.notarize.teamId = $teamid' electron/package.json > /tmp/package.json
          mv /tmp/package.json electron/package.json

          cat electron/package.json

      - name: Update app version base on tag
        if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags/') && inputs.public_provider == 'github'
        run: |
          if [[ ! "${VERSION_TAG}" =~ ^v[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
              echo "Error: Tag is not valid!"
              exit 1
          fi
          jq --arg version "${VERSION_TAG#v}" '.version = $version' electron/package.json > /tmp/package.json
          mv /tmp/package.json electron/package.json
          jq --arg version "${VERSION_TAG#v}" '.version = $version' web/package.json > /tmp/package.json
          mv /tmp/package.json web/package.json
          jq --arg teamid "${{ secrets.APPLE_TEAM_ID }}" '.build.mac.notarize.teamId = $teamid' electron/package.json > /tmp/package.json
          mv /tmp/package.json electron/package.json
          cat electron/package.json
        env:
          VERSION_TAG: ${{ inputs.new_version }}

      - name: Get Cer for code signing
        run: base64 -d <<< "$CODE_SIGN_P12_BASE64" > /tmp/codesign.p12
        shell: bash
        env:
          CODE_SIGN_P12_BASE64: ${{ secrets.CODE_SIGN_P12_BASE64 }}

      - uses: apple-actions/import-codesign-certs@v2
        continue-on-error: true
        with:
          p12-file-base64: ${{ secrets.CODE_SIGN_P12_BASE64 }}
          p12-password: ${{ secrets.CODE_SIGN_P12_PASSWORD }}

      - name: Build and publish app to aws s3 r2 or github artifactory
        if: inputs.public_provider != 'github'
        run: |
          # check public_provider is true or not
          echo "public_provider is ${{ inputs.public_provider }}"
          if [ "${{ inputs.public_provider }}" == "none" ]; then
            make build    
          else
            make build-and-publish
          fi
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          CSC_LINK: "/tmp/codesign.p12"
          CSC_KEY_PASSWORD: ${{ secrets.CODE_SIGN_P12_PASSWORD }}
          CSC_IDENTITY_AUTO_DISCOVERY: "true"
          APPLE_ID: ${{ secrets.APPLE_ID }}
          APPLE_APP_SPECIFIC_PASSWORD: ${{ secrets.APPLE_APP_SPECIFIC_PASSWORD }}
          APP_PATH: "."
          DEVELOPER_ID: ${{ secrets.DEVELOPER_ID }}
          AWS_ACCESS_KEY_ID: ${{ secrets.DELTA_AWS_ACCESS_KEY_ID }}
          AWS_SECRET_ACCESS_KEY: ${{ secrets.DELTA_AWS_SECRET_ACCESS_KEY }}
          AWS_DEFAULT_REGION: auto
          AWS_EC2_METADATA_DISABLED: "true"
          AWS_MAX_ATTEMPTS: "5"

      - name: Build and publish app to github
        if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags/') && inputs.public_provider == 'github'
        run: |
          make build-and-publish
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          CSC_LINK: "/tmp/codesign.p12"
          CSC_KEY_PASSWORD: ${{ secrets.CODE_SIGN_P12_PASSWORD }}
          CSC_IDENTITY_AUTO_DISCOVERY: "true"
          APPLE_ID: ${{ secrets.APPLE_ID }}
          APPLE_APP_SPECIFIC_PASSWORD: ${{ secrets.APPLE_APP_SPECIFIC_PASSWORD }}
          APP_PATH: "."
          DEVELOPER_ID: ${{ secrets.DEVELOPER_ID }}
          ANALYTICS_ID: ${{ secrets.JAN_APP_UMAMI_PROJECT_API_KEY }}
          ANALYTICS_HOST: ${{ secrets.JAN_APP_UMAMI_URL }}

      - name: Upload Artifact
        if: inputs.public_provider != 'github'
        uses: actions/upload-artifact@v4
        with:
          name: jan-mac-x64-${{ inputs.new_version }}
          path: ./electron/dist/jan-mac-x64-${{ inputs.new_version }}.dmg

      - name: Upload Artifact
        uses: actions/upload-artifact@v4
        with:
          name: latest-mac-x64
          path: ./electron/dist/latest-mac.yml