release.yaml

name: Release
permissions:
  id-token: write
  contents: write

on:
  release:
    types:
      - published

jobs:
  release:
    runs-on: macos-15
    steps:
      - uses: actions/checkout@v6.0.2
      - name: Install dependencies
        run: |
          brew install gnu-sed

          sudo xcode-select -s /Applications/Xcode.app


      - name: Decode and install certificate
        run: |
          echo "$CERTIFICATE_P12" | base64 --decode > certificate.p12
          security create-keychain -p password build.keychain
          security default-keychain -s build.keychain
          security unlock-keychain -p password build.keychain
          security import certificate.p12 -k build.keychain -P "$CERTIFICATE_PASSWORD" -T /usr/bin/codesign -T /usr/bin/productbuild -T /usr/bin/xcodebuild
          security set-key-partition-list -S apple-tool:,apple: -s -k password build.keychain
        env:
          CERTIFICATE_P12: ${{ secrets.APPLE_CERTIFICATE_P12 }}
          CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}

      - name: Build
        env:
          SIGN: 1
          VERSION: ${{ github.event.release.tag_name }}
        run: |
          make

      - name: Upload to GitHub release assets
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          UPLOAD_URL: ${{ github.event.release.upload_url }}
          VERSION: ${{ github.event.release.tag_name }}
        run: |
          set +e
          for name in mergify-firefox-${VERSION}.zip mergify-chrome-${VERSION}.zip mergify-safari-${VERSION}.pkg; do
            curl -L \
              --fail \
              -X POST \
              -H "Accept: application/vnd.github+json" \
              -H "Authorization: Bearer $GITHUB_TOKEN" \
              -H "Content-Type: application/octet-stream" \
              --data-binary "@${name}" \
              "${UPLOAD_URL%%/assets*}/assets?name=${name}"

            if [ $? = 22 ]; then
               echo "Upload of $name failed"
               exit 22
            fi

          done
          set -e