MacMonitor/.gitea/workflows/build.yml

name: MacMonitor CI/CD Pipeline

on:
  push:
    tags:
      - 'v*'

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  build-and-test:
    name: Build & Test (Intel x86_64)
    runs-on: macos-14

    steps:
      - name: Check out repository
        uses: actions/checkout@v4

      - name: Inspect Toolchain & Environment
        run: |
          echo "=== Host Architecture ==="
          uname -m
          echo "=== macOS Version ==="
          sw_vers
          echo "=== Active Xcode Version ==="
          xcodebuild -version
          echo "=== Available macOS SDKs ==="
          xcrun --show-sdk-path

      - name: Generate Xcode Project
        run: |
          if command -v xcodegen &> /dev/null; then
            xcodegen generate
          else
            echo "xcodegen not preinstalled, using tracked MacMonitor.xcodeproj"
          fi

      - name: Run SwiftLint Linting
        run: |
          if command -v swiftlint &> /dev/null; then
            swiftlint lint --reporter emoji
          else
            echo "swiftlint not found, skipping lint step"
          fi

      - name: Build MacMonitor Scheme
        run: |
          set -o pipefail
          if command -v xcbeautify &> /dev/null; then
            xcodebuild clean build \
              -scheme MacMonitor \
              -destination 'platform=macOS,arch=x86_64' \
              CODE_SIGNING_ALLOWED=NO | xcbeautify
          else
            xcodebuild clean build \
              -scheme MacMonitor \
              -destination 'platform=macOS,arch=x86_64' \
              CODE_SIGNING_ALLOWED=NO
          fi

      - name: Run Unit Tests
        run: |
          set -o pipefail
          if command -v xcbeautify &> /dev/null; then
            xcodebuild test \
              -scheme MacMonitor \
              -destination 'platform=macOS,arch=x86_64' \
              CODE_SIGNING_ALLOWED=NO | xcbeautify
          else
            xcodebuild test \
              -scheme MacMonitor \
              -destination 'platform=macOS,arch=x86_64' \
              CODE_SIGNING_ALLOWED=NO
          fi

  release-package:
    name: Package Release Artifact
    needs: build-and-test
    runs-on: macos-14
    if: startsWith(github.ref, 'refs/tags/v')

    steps:
      - name: Check out repository
        uses: actions/checkout@v4

      - name: Generate Xcode Project
        run: |
          if command -v xcodegen &> /dev/null; then
            xcodegen generate
          else
            echo "xcodegen not preinstalled, using tracked MacMonitor.xcodeproj"
          fi

      - name: Build Release (Intel x86_64)
        run: |
          set -o pipefail
          xcodebuild clean build \
            -scheme MacMonitor \
            -configuration Release \
            -destination 'generic/platform=macOS,arch=x86_64' \
            -derivedDataPath "$PWD/DerivedData" \
            CODE_SIGNING_ALLOWED=NO

      - name: Ad-hoc Sign Application Bundle
        run: |
          APP="$PWD/DerivedData/Build/Products/Release/MacMonitor.app"
          # Ad-hoc signing is required for UNUserNotificationCenter authorization
          # and banner delivery in distributed unsigned builds.
          codesign --force --deep --sign - "$APP"
          codesign --verify --verbose "$APP"

      - name: Create Distribution Archive
        run: |
          APP="$PWD/DerivedData/Build/Products/Release/MacMonitor.app"
          cd "$(dirname "$APP")"
          ditto -c -k --sequesterRsrc --keepParent "MacMonitor.app" "$GITHUB_WORKSPACE/MacMonitor-intel-x86_64.zip"
          ls -lh "$GITHUB_WORKSPACE/MacMonitor-intel-x86_64.zip"

      - name: Upload Workflow Artifact
        uses: actions/upload-artifact@v4
        continue-on-error: true
        with:
          name: MacMonitor-intel-x86_64
          path: MacMonitor-intel-x86_64.zip

      - name: Create Gitea Release & Attach Artifact
        run: |
          set -e
          TAG="${{ github.ref_name }}"
          API="${{ github.server_url }}/api/v1/repos/${{ github.repository }}"
          AUTH="Authorization: token ${{ secrets.GITEA_TOKEN }}"

          # Create the release (ignore conflict if it already exists)
          curl -sS -X POST "$API/releases" \
            -H "$AUTH" -H "Content-Type: application/json" \
            -d "{\"tag_name\":\"$TAG\",\"name\":\"MacMonitor $TAG\",\"draft\":false,\"prerelease\":false}" \
            -o /tmp/release.json -w "create_release_http=%{http_code}\n"

          # Resolve release ID (created above or pre-existing)
          RELEASE_ID=$(grep -o '"id":[0-9]*' /tmp/release.json | head -1 | cut -d: -f2)
          if [ -z "$RELEASE_ID" ]; then
            RELEASE_ID=$(curl -sS "$API/releases/tags/$TAG" -H "$AUTH" | grep -o '"id":[0-9]*' | head -1 | cut -d: -f2)
          fi
          if [ -z "$RELEASE_ID" ]; then
            echo "ERROR: could not resolve release ID for $TAG"; exit 1
          fi

          curl -sS -X POST "$API/releases/$RELEASE_ID/assets?name=MacMonitor-intel-x86_64.zip" \
            -H "$AUTH" -H "Content-Type: application/zip" \
            --data-binary @"$GITHUB_WORKSPACE/MacMonitor-intel-x86_64.zip" \
            -o /tmp/asset.json -w "attach_asset_http=%{http_code}\n"