name: Release
on:
  workflow_dispatch:
    inputs:
      version:
        description: Version from MARKETING_VERSION, without the v prefix
        required: true
        type: string
permissions:
  contents: write
concurrency:
  group: meetingnotes-release
  cancel-in-progress: false
jobs:
  release:
    runs-on: macos-arm64
    env:
      VERSION: ${{ inputs.version }}
      RELEASE_BASE_URL: https://git.jamesbone.net/coder/meetingnotes
      APPLE_ID: ${{ secrets.APPLE_ID }}
      APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
      APPLE_APP_PASSWORD: ${{ secrets.APPLE_APP_PASSWORD }}
      SPARKLE_PRIVATE_KEY: ${{ secrets.SPARKLE_PRIVATE_KEY }}
    steps:
      - name: Require main
        run: test "$GITHUB_REF" = refs/heads/main
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - name: Build, sign, and notarize release
        timeout-minutes: 45
        env:
          APPLE_CERTIFICATE_P12: ${{ secrets.APPLE_CERTIFICATE_P12 }}
          APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
        run: python3 scripts/with_signing_identity.py scripts/package_release.sh
      - name: Preserve signed release artifacts
        uses: actions/upload-artifact@v4
        with:
          name: meetingnotes-signed-release-${{ github.run_id }}
          path: ${{ runner.temp }}/meetingnotes-release/release
          if-no-files-found: error
          retention-days: 30
      - name: Publish Gitea release
        env:
          GITEA_SERVER_URL: ${{ github.server_url }}
          GITEA_TOKEN: ${{ github.token }}
        run: python3 scripts/publish_gitea_release.py