release-please.yml

name: release-please

on:
  workflow_dispatch:
  push:
    branches:
      - master

# When pushing new commits, cancel any running builds on that branch
concurrency:
  group: ${{ github.ref }}
  cancel-in-progress: true

jobs:
  release-please:
    runs-on: ubuntu-latest
    outputs:
      release_created: ${{ steps.release.outputs.release_created }}
      release_tag_name: ${{ steps.release.outputs.tag_name }}
      release_upload_url: ${{ steps.release.outputs.upload_url }}
    env:
      GITHUB_REF: ${{ github.ref }}
      GITHUB_TOKEN: ${{ secrets.PAT }}
      DIST_FILE_NAME: butler-cw
    steps:
      - name: Show github.ref
        run: echo "$GITHUB_REF"

      - uses: GoogleCloudPlatform/release-please-action@v3
        id: release
        if: |
          github.repository_owner == 'ptarmiganlabs'
        with:
          command: manifest

      - name: Show output from Release-Please
        if: always()
        env:
          RELEASE_PLEASE_OUTPUT: ${{ toJSON(steps.release.outputs) }}
        run: echo "$RELEASE_PLEASE_OUTPUT"

      - name: Show output from Release-Please
        if: ${{ steps.release.outputs.release_created }}
        run: |
          echo "releases_created: ${{ steps.release.outputs.releases_created }}"
          echo "release_created : ${{ steps.release.outputs.release_created }}"
          echo "draft           : ${{ steps.release.outputs.draft }}"
          echo "path            : ${{ steps.release.outputs.path }}"
          echo "upload_url      : ${{ steps.release.outputs.upload_url }}"
          echo "html_url        : ${{ steps.release.outputs.html_url }}"
          echo "tag_name        : ${{ steps.release.outputs.tag_name }}"
          echo "version         : ${{ steps.release.outputs.version }}"
          echo "major           : ${{ steps.release.outputs.major }}"
          echo "minor           : ${{ steps.release.outputs.minor }}"
          echo "patch           : ${{ steps.release.outputs.patch }}"
          echo "sha             : ${{ steps.release.outputs.sha }}"

      - name: Checkout repository
        uses: actions/checkout@v3

      - name: Install dependencies
        run: |
          pwd
          ls -la
          npm install

      - name: Run Snyk to check for vulnerabilities
        if: github.repository_owner == 'ptarmiganlabs'
        uses: snyk/actions/node@master
        continue-on-error: true
        env:
          SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
        with:
          args: --file=./package.json --sarif-file-output=./snyk.sarif
          # command: test
          
      - name: Upload Snyk result to GitHub Code Scanning
        uses: github/codeql-action/upload-sarif@v2
        with:
          sarif_file: ./snyk.sarif

      - name: Install tool for creating stand-alone executables
        if: ${{ steps.release.outputs.release_created }}
        run: |
          npm install -g pkg
          npm i -g @vercel/ncc

      - name: Package stand-alone binaries
        if: ${{ steps.release.outputs.release_created }}
          # mkdir release/alpine
        run: |
          pwd
          ls -la
          mkdir build
          mkdir build/linux
          mkdir build/macos
          mkdir build/win
          ncc build -o build/lib -e enigma.js ./index.js
          pkg --config ./package.json --output build/linux/${DIST_FILE_NAME} -t node16-linux-x64 ./build/lib/index.js --compress GZip
          pkg --config ./package.json --output build/macos/${DIST_FILE_NAME} -t node16-macos-x64 ./build/lib/index.js --compress GZip
          pkg --config ./package.json --output build/win/${DIST_FILE_NAME}.exe -t node16-win-x64 ./build/lib/index.js --compress GZip

      - name: Debug
        if: ${{ steps.release.outputs.release_created }}
        run: |
          pwd
          ls -la
          ls -la build
          ls -la build/linux
          ls -la build/macos
          ls -la build/win
          mkdir ghaction-virustotal

      - name: VirusTotal Scan
        if: ${{ steps.release.outputs.release_created }}
        uses: crazy-max/ghaction-virustotal@v3
        with:
          vt_api_key: ${{ secrets.VIRUSTOTAL_API_KEY }}
          request_rate: 4
          files: |
            ./build/macos/*
            ./build/win/*
            ./build/linux/*

      - name: Debug
        if: ${{ steps.release.outputs.release_created }}
        run: |
          ls -la ghaction-virustotal

      - name: Upload macOS build artifacts
        if: ${{ steps.release.outputs.release_created }}
        uses: actions/upload-artifact@v3
        with:
          name: binaries-macos
          path: build/macos/*

      - name: Upload Linux build artifacts
        if: ${{ steps.release.outputs.release_created }}
        uses: actions/upload-artifact@v3
        with:
          name: binaries-linux
          path: build/linux/*

      - name: Upload Windows build artifacts
        if: ${{ steps.release.outputs.release_created }}
        uses: actions/upload-artifact@v3
        with:
          name: binaries-win
          path: build/win/*

  release-macos:
    needs: release-please
    runs-on:
      - self-hosted
      - x64
      - macos
      - sp53
    # timeout-minutes: 15

    if: ${{ needs.release-please.outputs.release_created }} 
    env:
      DIST_FILE_NAME: butler-cw     
      GITHUB_TOKEN: ${{ secrets.PAT }}
      DIST_DIR: release-macos
    steps:
      - name: Release tag and upload url from previous job
        run: |
          echo "tag_name   : ${{ needs.release-please.outputs.release_tag_name }}"
          echo "upload_url : ${{ needs.release-please.outputs.release_upload_url }}"

      - name: Checkout
        uses: actions/checkout@v3

      - name: Setup node
        uses: actions/setup-node@v3
        with:
          node-version: lts/*

      - name: Download-Binaries
        uses: actions/download-artifact@v3
        with:
          name: binaries-macos
          path: ${{ env.DIST_DIR }}/

      - name: Make binary executable
        run: |
          chmod +x ${{ env.DIST_DIR }}/${DIST_FILE_NAME}

      - name: Debug
        run: |
          ls -la
          ls -la ./${{ env.DIST_DIR }}

      # Remove build keychains if it exists. 
      - name: Remove build keychain
        continue-on-error: true
        run: |
          security delete-keychain build.keychain || true

      # Inspiration from 
      # - https://federicoterzi.com/blog/automatic-code-signing-and-notarization-for-macos-apps-using-github-actions/
      # - https://melatonin.dev/blog/how-to-code-sign-and-notarize-macos-audio-plugins-in-ci/
      - name: Sign the macOS binary
        env:
          MACOS_CERTIFICATE: ${{ secrets.PROD_MACOS_CERTIFICATE_BASE64_CODESIGN }}
          MACOS_CERTIFICATE_PWD: ${{ secrets.PROD_MACOS_CERTIFICATE_CODESIGN_PWD }}
          MACOS_CERTIFICATE_NAME: ${{ secrets.PROD_MACOS_CERTIFICATE_CODESIGN_NAME }}
          MACOS_CI_KEYCHAIN_PWD: ${{ secrets.PROD_MACOS_CI_KEYCHAIN_PWD }}

        # https://developer.apple.com/documentation/security/notarizing_macos_software_before_distribution/customizing_the_notarization_workflow#3087720
        # Not possible to staple ticket to the created binary: "Although tickets are created for standalone binaries, it’s not currently possible to staple tickets to them."
        # This means that Internet connection is required first time a user runs the binary. Gatekeeper will then cache the ticket and allow the binary to run offline in the future.
        working-directory: ${{ env.DIST_DIR }}
        run: |
          pwd
          ls -la

          # Turn our base64-encoded certificate back to a regular .p12 file
          
          echo $MACOS_CERTIFICATE | base64 --decode > certificate.p12

          # We need to create a new keychain, otherwise using the certificate will prompt
          # with a UI dialog asking for the certificate password, which we can't
          # use in a headless CI environment
          
          security create-keychain -p "$MACOS_CI_KEYCHAIN_PWD" build.keychain
          security list-keychains -d user -s build.keychain
          security default-keychain -d user -s build.keychain
          security unlock-keychain -p "$MACOS_CI_KEYCHAIN_PWD" build.keychain
          security import certificate.p12 -k build.keychain -P "$MACOS_CERTIFICATE_PWD" -T /usr/bin/codesign
          security set-key-partition-list -S apple-tool:,apple:,codesign: -s -k "$MACOS_CI_KEYCHAIN_PWD" build.keychain
      
          codesign --force -s "$MACOS_CERTIFICATE_NAME" -v ./${{ env.DIST_FILE_NAME }} --deep --strict --options=runtime --timestamp --entitlements ../release-config/butler-cw.entitlements
      # codesign --force -s "${{ secrets.APPLE_DEVELOPER_ID_APPLICATION}}" -v ./${{ env.DIST_FILE_NAME }}.zip --deep --strict --options=runtime --timestamp --entitlements ./release-config/butler-cw.entitlements
      #     xcrun notarytool submit ./${{ env.DIST_FILE_NAME }}.zip --apple-id ${{ secrets.AC_USERNAME }} --password ${{ secrets.AC_PASSWORD }} --team-id ${{ secrets.APPLE_TEAM_ID }} --wait

      - name: "Notarize app bundle"
        # Extract the secrets we defined earlier as environment variables
        env:
          PROD_MACOS_NOTARIZATION_APPLE_ID: ${{ secrets.PROD_MACOS_NOTARIZATION_APPLE_ID }}
          PROD_MACOS_NOTARIZATION_TEAM_ID: ${{ secrets.PROD_MACOS_NOTARIZATION_TEAM_ID }}
          PROD_MACOS_NOTARIZATION_PWD: ${{ secrets.PROD_MACOS_NOTARIZATION_PWD }}
        working-directory: ${{ env.DIST_DIR }}
        run: |
          # Store the notarization credentials so that we can prevent a UI password dialog from blocking the CI

          echo "Create keychain profile"
          xcrun notarytool store-credentials "notarytool-profile" --apple-id "$PROD_MACOS_NOTARIZATION_APPLE_ID" --team-id "$PROD_MACOS_NOTARIZATION_TEAM_ID" --password "$PROD_MACOS_NOTARIZATION_PWD"

          # We can't notarize an app bundle directly, but we need to compress it as an archive.
          # Therefore, we create a zip file containing our app bundle, so that we can send it to the
          # notarization service

          echo "Creating temp notarization archive"
          ditto -c -k --keepParent "./${DIST_FILE_NAME}" "./${{ needs.release-please.outputs.release_tag_name }}-macos.zip"

          # Here we send the notarization request to the Apple's Notarization service, waiting for the result.
          # This typically takes a few seconds inside a CI environment, but it might take more depending on the App
          # characteristics. Visit the Notarization docs for more information and strategies on how to optimize it if
          # you're curious

          echo "Notarize app"
          xcrun notarytool submit "./${{ needs.release-please.outputs.release_tag_name }}-macos.zip" --keychain-profile "notarytool-profile" --wait

      - name: Upload to existing release
        uses: ncipollo/release-action@v1
        with:
          allowUpdates: true
          omitBodyDuringUpdate: true
          omitNameDuringUpdate: true
          artifactContentType: raw
          # artifactContentType: application/zip
          draft: true
          tag: ${{ needs.release-please.outputs.release_tag_name }}
          artifacts: ./${{ env.DIST_DIR }}/${{ needs.release-please.outputs.release_tag_name }}-macos.zip
          token: ${{ github.token }}

      - name: Tidy up before existing
        continue-on-error: true
        run: |
          rm -r ${{ env.DIST_DIR }}

          # Remove build keychains if it exists. 
          security delete-keychain build.keychain || true

  release-linux:
    needs: release-please
    runs-on: ubuntu-latest
    # timeout-minutes: 15

    if: ${{ needs.release-please.outputs.release_created }} 
    env:
      DIST_FILE_NAME: butler-cw
    steps:
      - name: Release tag and upload url from previous job
        run: |
          echo "tag_name   : ${{ needs.release-please.outputs.release_tag_name }}"
          echo "upload_url : ${{ needs.release-please.outputs.release_upload_url }}"

      - name: Checkout
        uses: actions/checkout@v3

      - name: Setup node
        uses: actions/setup-node@v3
        with:
          node-version: lts/*

      - name: Download-Binaries
        uses: actions/download-artifact@v3
        with:
          name: binaries-linux
          path: release-linux/

      - name: Make binary executable
        run: |
          chmod +x release-linux/${DIST_FILE_NAME}

      - name: Compress into zip
        run: |
          ls -la
          ls -la ./release-linux
          zip -9 -r ./${{ needs.release-please.outputs.release_tag_name }}-linux.zip release-linux/

      - name: Upload to existing release
        uses: ncipollo/release-action@v1
        with:
          allowUpdates: true
          omitBodyDuringUpdate: true
          omitNameDuringUpdate: true
          artifactContentType: raw
          # artifactContentType: application/zip
          draft: true
          tag: ${{ needs.release-please.outputs.release_tag_name }}
          artifacts: ./${{ needs.release-please.outputs.release_tag_name }}-linux.zip
          token: ${{ github.token }}

      - name: Tidy up before existing
        run: |
          rm -r release-linux

  release-win64:
    needs: release-please
    runs-on:
      - self-hosted
      - x64
      - windows
      - sp53
    # timeout-minutes: 15
    if: ${{ needs.release-please.outputs.release_created }} 
    env:
      DIST_FILE_NAME: butler-cw
    steps:
      - name: Release tag and upload url from previous job
        run: |
          Write-Output 'tag_name        : ${{ needs.release-please.outputs.release_tag_name }}'
          Write-Output 'upload_url      : ${{ needs.release-please.outputs.release_upload_url }}'

      - name: Checkout
        uses: actions/checkout@v3

      - name: Setup node
        uses: actions/setup-node@v3
        with:
          node-version: lts/*

      - name: Download-Binaries
        uses: actions/download-artifact@v3
        with:
          name: binaries-win
          path: release-win/

      - name: Sign the executable
        env:
          CODESIGN_PWD: ${{ secrets.WIN_CODESIGN_PWD}}
          CODESIGN_INTERMEDIATE_BASE64: ${{ secrets.WIN_CODESIGN_INTERMEDIATE_BASE64 }}
          CODESIGN_BASE64: ${{ secrets.WIN_CODESIGN_BASE64}}
        run: |
          New-Item -ItemType directory -Path certificate
          Set-Content -Path certificate\certificate.txt -Value $env:CODESIGN_BASE64
          certutil -decode certificate\certificate.txt certificate\certificate.pfx
          Set-Content -Path certificate\intermediate.txt -Value $env:CODESIGN_INTERMEDIATE_BASE64
          certutil -decode certificate\intermediate.txt certificate\intermediate.crt

          & 'C:\Program Files (x86)/Windows Kits/10/bin/10.0.22621.0/x64/signtool.exe' sign /fd SHA256 /p $env:CODESIGN_PWD /ac certificate\intermediate.crt /f certificate\certificate.pfx /tr "http://timestamp.sectigo.com/rfc3161" /td sha256 release-win/butler-cw.exe
          
          Remove-Item -Recurse -Force certificate

      - name: Install dependencies and zip into release asset
        run: |
          cd release-win
          dir
          $compress = @{
            Path = "."
            CompressionLevel = "Fastest"
            DestinationPath = "${{ needs.release-please.outputs.release_tag_name }}-win.zip"
          }
          Compress-Archive @compress

      - name: Debug
        run: |
          dir
          dir ./release-win

      - name: Upload to existing release
        uses: ncipollo/release-action@v1
        with:
          allowUpdates: true
          omitBodyDuringUpdate: true
          omitNameDuringUpdate: true
          artifactContentType: raw
          # artifactContentType: application/zip
          draft: true
          tag: ${{ needs.release-please.outputs.release_tag_name }}
          artifacts: release-win/${{ needs.release-please.outputs.release_tag_name }}-win.zip
          token: ${{ github.token }}

      - name: Tidy up before existing
        run: |
          dir
          Remove-Item -path ./release-win -recurse