macos.yml

name: MacOS Build
on:
  workflow_dispatch:
  push:
    tags:
      - "v*.*.*"
jobs:
  build:
    runs-on: macos-latest
    steps:
      - uses: actions/checkout@v4
      
      - name: Install Rust
        uses: dtolnay/rust-toolchain@stable
        
      - name: Install dependencies
        run: brew install ffmpeg libopenmpt dylibbundler create-dmg
        
      - name: Build executable
        env:
          LIBRARY_PATH: /opt/homebrew/lib
          CPATH: /opt/homebrew/include
          PKG_CONFIG_PATH: /opt/homebrew/lib/pkgconfig:/opt/homebrew/share/pkgconfig
          BINDGEN_EXTRA_CLANG_ARGS: "-I/opt/homebrew/include"
          CARGO_PROFILE_RELEASE_LTO: "true"
          CARGO_PROFILE_RELEASE_CODEGEN_UNITS: "1"
          CARGO_PROFILE_RELEASE_STRIP: "true"
        run: cargo build --release

      - name: Import Apple Certificate
        env:
          BUILD_CERTIFICATE_BASE64: ${{ secrets.MACOS_CERTIFICATE }}
          P12_PASSWORD: ${{ secrets.MACOS_CERTIFICATE_PWD }}
        if: ${{ env.BUILD_CERTIFICATE_BASE64 != '' }}
        run: |
          CERTIFICATE_PATH=$RUNNER_TEMP/build_certificate.p12
          KEYCHAIN_PATH=$RUNNER_TEMP/app-signing.keychain-db
          KEYCHAIN_PASSWORD=$(openssl rand -base64 12)

          echo -n "$BUILD_CERTIFICATE_BASE64" | base64 --decode -o $CERTIFICATE_PATH

          security create-keychain -p "$KEYCHAIN_PASSWORD" $KEYCHAIN_PATH
          security default-keychain -s $KEYCHAIN_PATH
          security unlock-keychain -p "$KEYCHAIN_PASSWORD" $KEYCHAIN_PATH

          security import $CERTIFICATE_PATH -k $KEYCHAIN_PATH -P "$P12_PASSWORD" -T /usr/bin/codesign -T /usr/bin/productsign
          security set-key-partition-list -S apple-tool:,apple:,codesign: -s -k "$KEYCHAIN_PASSWORD" $KEYCHAIN_PATH

      - name: Package Application
        run: |
          VERSION=$(grep -m1 '^version =' Cargo.toml | cut -d '"' -f2)
          
          mkdir -p RustTracker.app/Contents/MacOS
          mkdir -p RustTracker.app/Contents/Resources
          mkdir -p RustTracker.app/Contents/Frameworks
          
          # Create ICNS icon
          mkdir -p RustTracker.iconset
          sips -z 16 16     icon.png --out RustTracker.iconset/icon_16x16.png
          sips -z 32 32     icon.png --out RustTracker.iconset/icon_16x16@2x.png
          sips -z 32 32     icon.png --out RustTracker.iconset/icon_32x32.png
          sips -z 64 64     icon.png --out RustTracker.iconset/icon_32x32@2x.png
          sips -z 128 128   icon.png --out RustTracker.iconset/icon_128x128.png
          sips -z 256 256   icon.png --out RustTracker.iconset/icon_128x128@2x.png
          sips -z 256 256   icon.png --out RustTracker.iconset/icon_256x256.png
          sips -z 512 512   icon.png --out RustTracker.iconset/icon_256x256@2x.png
          sips -z 512 512   icon.png --out RustTracker.iconset/icon_512x512.png
          sips -z 1024 1024 icon.png --out RustTracker.iconset/icon_512x512@2x.png
          iconutil -c icns RustTracker.iconset -o RustTracker.app/Contents/Resources/AppIcon.icns
          rm -rf RustTracker.iconset
          
          # Generate Info.plist
          cat <<EOF > RustTracker.app/Contents/Info.plist
          <?xml version="1.0" encoding="UTF-8"?>
          <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
          <plist version="1.0">
          <dict>
              <key>CFBundleExecutable</key>
              <string>rusttracker</string>
              <key>CFBundleIdentifier</key>
              <string>com.soddentrough.rusttracker</string>
              <key>CFBundleName</key>
              <string>RustTracker</string>
              <key>CFBundleIconFile</key>
              <string>AppIcon</string>
              <key>CFBundleShortVersionString</key>
              <string>${VERSION}</string>
              <key>CFBundleVersion</key>
              <string>${VERSION}</string>
              <key>CFBundlePackageType</key>
              <string>APPL</string>
              <key>LSMinimumSystemVersion</key>
              <string>10.15</string>
              <key>NSHighResolutionCapable</key>
              <true/>
              <key>LSApplicationCategoryType</key>
              <string>public.app-category.music</string>
              <key>NSMicrophoneUsageDescription</key>
              <string>RustTracker needs microphone access to visualize live audio input.</string>
          </dict>
          </plist>
          EOF
          
          # Copy binary, soundfont asset, and bundle libraries
          cp target/release/rusttracker RustTracker.app/Contents/MacOS/
          cp assets/soundfont.sf2 RustTracker.app/Contents/Resources/
          dylibbundler -od -b -x RustTracker.app/Contents/MacOS/rusttracker -d RustTracker.app/Contents/Frameworks/ -p @executable_path/../Frameworks/
          
          # Codesign the application
          if [ -n "${{ secrets.MACOS_CERTIFICATE }}" ]; then
            echo "Signing with Developer ID Certificate..."
            find RustTracker.app/Contents/Frameworks -type f \( -name "*.dylib" -or -name "*.so" \) -exec codesign --force --options runtime --sign "Developer ID Application" {} \;
            codesign --force --options runtime --entitlements entitlements.plist --sign "Developer ID Application" RustTracker.app/Contents/MacOS/rusttracker
            codesign --force --options runtime --entitlements entitlements.plist --sign "Developer ID Application" RustTracker.app
          else
            echo "No Developer ID Certificate found. Performing ad-hoc signing..."
            codesign --force --deep --sign - RustTracker.app
          fi
          
      - name: Create DMG
        run: |
          create-dmg \
            --volname "RustTracker Installer" \
            --window-pos 200 120 \
            --window-size 600 400 \
            --icon-size 100 \
            --icon "RustTracker.app" 200 190 \
            --app-drop-link 400 190 \
            "RustTracker-MacOS-Installer.dmg" \
            "RustTracker.app"

      - name: Codesign DMG
        env:
          MACOS_CERTIFICATE: ${{ secrets.MACOS_CERTIFICATE }}
        if: ${{ env.MACOS_CERTIFICATE != '' }}
        run: |
          echo "Signing the DMG container..."
          codesign --force --sign "Developer ID Application" RustTracker-MacOS-Installer.dmg

      - name: Notarize DMG
        env:
          APPLE_ID: ${{ secrets.APPLE_ID }}
          APPLE_ID_PASSWORD: ${{ secrets.APPLE_ID_PASSWORD }}
          APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
        if: ${{ env.APPLE_ID != '' }}
        run: |
          echo "Submitting DMG for notarization..."
          xcrun notarytool submit RustTracker-MacOS-Installer.dmg \
            --apple-id "$APPLE_ID" \
            --password "$APPLE_ID_PASSWORD" \
            --team-id "$APPLE_TEAM_ID" \
            --wait
            
          echo "Stapling notarization ticket to DMG..."
          xcrun stapler staple RustTracker-MacOS-Installer.dmg
            
      - name: Clean up Keychain
        env:
          MACOS_CERTIFICATE: ${{ secrets.MACOS_CERTIFICATE }}
        if: always() && env.MACOS_CERTIFICATE != ''
        run: |
          KEYCHAIN_PATH=$RUNNER_TEMP/app-signing.keychain-db
          if [ -f "$KEYCHAIN_PATH" ]; then
            security delete-keychain $KEYCHAIN_PATH
          fi
            
      - name: Upload Artifact
        uses: actions/upload-artifact@v5
        with:
          name: RustTracker-MacOS
          path: RustTracker-MacOS-Installer.dmg