ci: retire the superseded GitHub release workflows

scripts/configure_github_release_secrets.sh

@@ -1,34 +0,0 @@
-#!/usr/bin/env bash
-
-set -euo pipefail
-
-REPOSITORY="${REPOSITORY:-superdooper86/meetingnotes}"
-
-if ! command -v gh >/dev/null 2>&1; then
-  echo "Install GitHub CLI first: brew install gh" >&2
-  exit 1
-fi
-
-gh auth status >/dev/null
-
-read -r -p "Developer ID certificate (.p12) path: " certificate_path
-if [[ ! -f "$certificate_path" ]]; then
-  echo "Certificate not found: $certificate_path" >&2
-  exit 1
-fi
-
-read -r -s -p "Certificate export password: " certificate_password
-printf '\n'
-read -r -p "Apple ID email: " apple_id
-read -r -p "Apple Developer Team ID: " team_id
-read -r -s -p "Apple app-specific password: " app_password
-printf '\n'
-
-base64 < "$certificate_path" | gh secret set APPLE_CERTIFICATE_P12 -R "$REPOSITORY"
-printf '%s' "$certificate_password" | gh secret set APPLE_CERTIFICATE_PASSWORD -R "$REPOSITORY"
-printf '%s' "$apple_id" | gh secret set APPLE_ID -R "$REPOSITORY"
-printf '%s' "$team_id" | gh secret set APPLE_TEAM_ID -R "$REPOSITORY"
-printf '%s' "$app_password" | gh secret set APPLE_APP_PASSWORD -R "$REPOSITORY"
-
-unset certificate_password app_password
-echo "Apple release secrets configured for $REPOSITORY."

scripts/finalize_release.sh

@@ -1,139 +0,0 @@
-#!/usr/bin/env bash
-
-set -euo pipefail
-
-APP_NAME="Meetingnotes"
-RUNNER_TEMP="${RUNNER_TEMP:-/tmp}"
-PENDING_DIR="${PENDING_DIR:-$RUNNER_TEMP/meetingnotes-pending}"
-WORK_ROOT="${WORK_ROOT:-$RUNNER_TEMP/meetingnotes-finalize}"
-APP_PATH="$WORK_ROOT/$APP_NAME.app"
-RELEASE_DIR="$WORK_ROOT/release"
-VERSION_PATH="$PENDING_DIR/version"
-COMMIT_SHA_PATH="$PENDING_DIR/commit-sha"
-SUBMISSION_PATH="$PENDING_DIR/notary-submission.json"
-PRE_NOTARY_ZIP="$PENDING_DIR/$APP_NAME-pre-notary.zip"
-
-required_variables=(
-  APPLE_ID
-  APPLE_TEAM_ID
-  APPLE_APP_PASSWORD
-  SPARKLE_PRIVATE_KEY
-  GH_TOKEN
-  GITHUB_REPOSITORY
-)
-
-for variable in "${required_variables[@]}"; do
-  if [[ -z "${!variable:-}" ]]; then
-    echo "Missing required environment variable: $variable" >&2
-    exit 1
-  fi
-done
-
-for path in "$VERSION_PATH" "$COMMIT_SHA_PATH" "$SUBMISSION_PATH" "$PRE_NOTARY_ZIP" "$PENDING_DIR/generate_appcast"; do
-  if [[ ! -e "$path" ]]; then
-    echo "Missing release submission artifact: $path" >&2
-    exit 1
-  fi
-done
-
-VERSION=$(<"$VERSION_PATH")
-COMMIT_SHA=$(<"$COMMIT_SHA_PATH")
-SUBMISSION_ID=$(plutil -extract id raw -o - "$SUBMISSION_PATH")
-TAG="v$VERSION"
-
-if gh release view "$TAG" --repo "$GITHUB_REPOSITORY" >/dev/null 2>&1; then
-  echo "Release already exists: $TAG"
-  exit 0
-fi
-
-STATUS_PATH="$WORK_ROOT/notary-status.json"
-rm -rf "$WORK_ROOT"
-mkdir -p "$RELEASE_DIR"
-
-notary_info_succeeded=false
-for attempt in 1 2 3; do
-  if xcrun notarytool info "$SUBMISSION_ID" \
-    --apple-id "$APPLE_ID" \
-    --team-id "$APPLE_TEAM_ID" \
-    --password "$APPLE_APP_PASSWORD" \
-    --output-format json > "$STATUS_PATH"; then
-    notary_info_succeeded=true
-    break
-  fi
-  echo "Notary status check failed ($attempt/3); retrying"
-  sleep 15
-done
-
-if [[ "$notary_info_succeeded" != true ]]; then
-  echo "Unable to query Apple notarization status after three attempts" >&2
-  exit 1
-fi
-
-NOTARY_STATUS=$(plutil -extract status raw -o - "$STATUS_PATH")
-echo "Notarization status for $SUBMISSION_ID: $NOTARY_STATUS"
-
-case "$NOTARY_STATUS" in
-  "In Progress")
-    if [[ -n "${GITHUB_STEP_SUMMARY:-}" ]]; then
-      printf 'Apple is still processing Meetingnotes %s. Submission: `%s`. The scheduled workflow will check again.\n' \
-        "$VERSION" "$SUBMISSION_ID" >> "$GITHUB_STEP_SUMMARY"
-    fi
-    exit 0
-    ;;
-  Accepted)
-    ;;
-  Invalid|Rejected)
-    xcrun notarytool log "$SUBMISSION_ID" \
-      --apple-id "$APPLE_ID" \
-      --team-id "$APPLE_TEAM_ID" \
-      --password "$APPLE_APP_PASSWORD" || true
-    exit 1
-    ;;
-  *)
-    echo "Unexpected notarization status: $NOTARY_STATUS" >&2
-    exit 1
-    ;;
-esac
-
-ditto -x -k "$PRE_NOTARY_ZIP" "$WORK_ROOT"
-if [[ ! -d "$APP_PATH" ]]; then
-  echo "Signed app was not found after extracting $PRE_NOTARY_ZIP" >&2
-  exit 1
-fi
-
-APP_VERSION=$(plutil -extract CFBundleShortVersionString raw -o - "$APP_PATH/Contents/Info.plist")
-if [[ "$APP_VERSION" != "$VERSION" ]]; then
-  echo "Signed app version $APP_VERSION does not match release version $VERSION" >&2
-  exit 1
-fi
-
-xcrun stapler staple "$APP_PATH"
-xcrun stapler validate "$APP_PATH"
-spctl --assess --type execute --verbose=2 "$APP_PATH"
-
-ARCHIVE_NAME="$APP_NAME-$VERSION.zip"
-ARCHIVE_PATH="$RELEASE_DIR/$ARCHIVE_NAME"
-ditto -c -k --sequesterRsrc --keepParent "$APP_PATH" "$ARCHIVE_PATH"
-
-GENERATE_APPCAST="$PENDING_DIR/generate_appcast"
-chmod +x "$GENERATE_APPCAST"
-DOWNLOAD_URL="https://github.com/$GITHUB_REPOSITORY/releases/download/$TAG/"
-printf '%s' "$SPARKLE_PRIVATE_KEY" | "$GENERATE_APPCAST" "$RELEASE_DIR" \
-  --ed-key-file - \
-  --download-url-prefix "$DOWNLOAD_URL" \
-  --maximum-deltas 0 \
-  -o "$RELEASE_DIR/appcast.xml"
-
-grep -q "$DOWNLOAD_URL$ARCHIVE_NAME" "$RELEASE_DIR/appcast.xml"
-grep -q 'sparkle:edSignature=' "$RELEASE_DIR/appcast.xml"
-
-gh release \
-  create "$TAG" \
-  "$ARCHIVE_PATH" \
-  "$RELEASE_DIR/appcast.xml" \
-  --repo "$GITHUB_REPOSITORY" \
-  --target "$COMMIT_SHA" \
-  --title "Meetingnotes $VERSION" \
-  --generate-notes
-
-echo "Published Meetingnotes $VERSION"