ci.yml

name: CI

on:
  push:
    branches: [main]
    tags: ["v*"]
  pull_request:
    branches: [main]
  workflow_dispatch:

permissions:
  contents: read

concurrency:
  group: sidekick-ci-${{ github.ref }}
  cancel-in-progress: true

env:
  CUA_DRIVER_VERSION: "0.5.3"
  APPLE_CODESIGN_IDENTITY: "Developer ID Application: Companion, Inc. (5LYD7HDS6X)"

jobs:
  test:
    name: Test
    runs-on: macos-26
    steps:
      - uses: actions/checkout@v6

      - name: Show Swift version
        run: swift --version

      - name: Run tests
        run: swift test

  package-macos:
    name: Package macOS app
    runs-on: macos-26
    needs: test
    steps:
      - uses: actions/checkout@v6

      - name: Download Cua driver
        run: |
          cua_driver_path="$(Scripts/download-cua-driver.sh .build/cua-driver-release | tail -n 1)"
          echo "SIDEKICK_CUA_DRIVER=$PWD/$cua_driver_path" >> "$GITHUB_ENV"

      - name: Configure signing
        env:
          CERTIFICATE_BASE64: ${{ secrets.DEVELOPER_ID_APPLICATION_CERTIFICATE_BASE64 }}
          CERTIFICATE_PASSWORD: ${{ secrets.DEVELOPER_ID_APPLICATION_CERTIFICATE_PASSWORD }}
          KEYCHAIN_PASSWORD: ${{ secrets.BUILD_KEYCHAIN_PASSWORD }}
        run: |
          if [ -n "$CERTIFICATE_BASE64" ] && [ -n "$CERTIFICATE_PASSWORD" ] && [ -n "$KEYCHAIN_PASSWORD" ]; then
            certificate_path="$RUNNER_TEMP/developer-id-application.p12"
            keychain_path="$RUNNER_TEMP/sidekick-signing.keychain-db"

            printf '%s' "$CERTIFICATE_BASE64" | base64 --decode > "$certificate_path"
            security create-keychain -p "$KEYCHAIN_PASSWORD" "$keychain_path"
            security set-keychain-settings -lut 21600 "$keychain_path"
            security unlock-keychain -p "$KEYCHAIN_PASSWORD" "$keychain_path"
            security import "$certificate_path" -P "$CERTIFICATE_PASSWORD" -A -t cert -f pkcs12 -k "$keychain_path"
            security list-keychains -d user -s "$keychain_path" $(security list-keychains -d user | tr -d '"')
            security set-key-partition-list -S apple-tool:,apple: -s -k "$KEYCHAIN_PASSWORD" "$keychain_path"
            echo "CODESIGN_IDENTITY=$APPLE_CODESIGN_IDENTITY" >> "$GITHUB_ENV"
          else
            echo "CODESIGN_IDENTITY=-" >> "$GITHUB_ENV"
            echo "Using ad-hoc signing because Developer ID signing secrets are not configured."
          fi

      - name: Package app
        run: Scripts/package-sidekick-app.sh release

      - name: Verify package
        run: |
          test -x .build/release/Sidekick.app/Contents/MacOS/Sidekick
          test -x .build/release/Sidekick.app/Contents/MacOS/SidekickMCP
          test -x .build/release/Sidekick.app/Contents/Helpers/SidekickComputerUseRuntime
          codesign --verify --strict .build/release/Sidekick.app
          .build/release/Sidekick.app/Contents/Helpers/SidekickComputerUseRuntime --version
          /usr/libexec/PlistBuddy -c 'Print :CFBundleIdentifier' .build/release/Sidekick.app/Contents/Info.plist

      - name: Archive app
        run: |
          ditto -c -k --keepParent .build/release/Sidekick.app Sidekick-macOS.zip

      - name: Notarize and staple when secrets are present
        env:
          APPLE_NOTARY_KEY_BASE64: ${{ secrets.APPLE_NOTARY_KEY_BASE64 }}
          APPLE_NOTARY_KEY_ID: ${{ secrets.APPLE_NOTARY_KEY_ID }}
          APPLE_NOTARY_ISSUER_ID: ${{ secrets.APPLE_NOTARY_ISSUER_ID }}
          APPLE_ID: ${{ secrets.APPLE_NOTARY_APPLE_ID }}
          APPLE_TEAM_ID: ${{ secrets.APPLE_NOTARY_TEAM_ID }}
          APPLE_APP_SPECIFIC_PASSWORD: ${{ secrets.APPLE_NOTARY_APP_SPECIFIC_PASSWORD }}
        run: |
          if [ "$CODESIGN_IDENTITY" != "-" ] && [ -n "$APPLE_NOTARY_KEY_BASE64" ] && [ -n "$APPLE_NOTARY_KEY_ID" ] && [ -n "$APPLE_NOTARY_ISSUER_ID" ]; then
            notary_key_path="$RUNNER_TEMP/AuthKey_$APPLE_NOTARY_KEY_ID.p8"
            printf '%s' "$APPLE_NOTARY_KEY_BASE64" | base64 --decode > "$notary_key_path"
            xcrun notarytool submit Sidekick-macOS.zip \
              --key "$notary_key_path" \
              --key-id "$APPLE_NOTARY_KEY_ID" \
              --issuer "$APPLE_NOTARY_ISSUER_ID" \
              --wait
            xcrun stapler staple .build/release/Sidekick.app
            rm -f Sidekick-macOS.zip
            ditto -c -k --keepParent .build/release/Sidekick.app Sidekick-macOS.zip
            printf 'notarized: yes\n' > Sidekick-macOS.notarization.txt
          elif [ "$CODESIGN_IDENTITY" != "-" ] && [ -n "$APPLE_ID" ] && [ -n "$APPLE_TEAM_ID" ] && [ -n "$APPLE_APP_SPECIFIC_PASSWORD" ]; then
            xcrun notarytool submit Sidekick-macOS.zip \
              --apple-id "$APPLE_ID" \
              --team-id "$APPLE_TEAM_ID" \
              --password "$APPLE_APP_SPECIFIC_PASSWORD" \
              --wait
            xcrun stapler staple .build/release/Sidekick.app
            rm -f Sidekick-macOS.zip
            ditto -c -k --keepParent .build/release/Sidekick.app Sidekick-macOS.zip
            printf 'notarized: yes\n' > Sidekick-macOS.notarization.txt
          else
            printf 'notarized: no; configure Developer ID and Apple notary secrets for Gatekeeper-clean downloads\n' > Sidekick-macOS.notarization.txt
          fi

      - name: Create disk image
        run: |
          hdiutil create \
            -volname Sidekick \
            -srcfolder .build/release/Sidekick.app \
            -ov \
            -format UDZO \
            Sidekick.dmg

      - name: Write checksum
        run: |
          shasum -a 256 Sidekick-macOS.zip > Sidekick-macOS.zip.sha256
          shasum -a 256 Sidekick.dmg > Sidekick.dmg.sha256
          shasum -a 256 Sidekick.dmg Sidekick-macOS.zip > SHA256SUMS.txt

      - name: Generate Sparkle appcast
        if: startsWith(github.ref, 'refs/tags/v')
        env:
          SPARKLE_ED_PRIVATE_KEY: ${{ secrets.SPARKLE_ED_PRIVATE_KEY }}
        run: |
          test -n "$SPARKLE_ED_PRIVATE_KEY"
          Scripts/generate-sparkle-appcast.sh Sidekick-macOS.zip appcast.xml

      - name: Upload app artifact
        uses: actions/upload-artifact@v7
        with:
          name: Sidekick-macOS-${{ github.sha }}
          path: |
            Sidekick.dmg
            Sidekick.dmg.sha256
            Sidekick-macOS.zip
            Sidekick-macOS.zip.sha256
            SHA256SUMS.txt
            Sidekick-macOS.notarization.txt
            appcast.xml
          retention-days: 30

  release:
    name: Publish tagged release
    runs-on: ubuntu-latest
    needs: package-macos
    if: startsWith(github.ref, 'refs/tags/v')
    permissions:
      contents: write
    steps:
      - name: Download packaged app artifact
        uses: actions/download-artifact@v8
        with:
          name: Sidekick-macOS-${{ github.sha }}
          path: dist

      - name: Publish GitHub release
        if: startsWith(github.ref, 'refs/tags/v')
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          cd dist
          gh release view "$GITHUB_REF_NAME" --repo "$GITHUB_REPOSITORY" >/dev/null 2>&1 || \
            gh release create "$GITHUB_REF_NAME" --repo "$GITHUB_REPOSITORY" --title "$GITHUB_REF_NAME" --notes "Sidekick macOS build."
          gh release upload "$GITHUB_REF_NAME" \
            Sidekick.dmg \
            Sidekick.dmg.sha256 \
            Sidekick-macOS.zip \
            Sidekick-macOS.zip.sha256 \
            SHA256SUMS.txt \
            Sidekick-macOS.notarization.txt \
            appcast.xml \
            --repo "$GITHUB_REPOSITORY" \
            --clobber