release.yml

name: release

on:
  push:
    tags:
      - "v*.*.*"

permissions:
  contents: write

jobs:
  release:
    runs-on: ubuntu-latest
    environment: release
    steps:
      - uses: actions/checkout@v3
      - uses: cachix/install-nix-action@v23
        with:
          nix_path: nixpkgs=channel:nixos-22.11
          extra_nix_config: |
            access-tokens = github.com=${{ secrets.GITHUB_TOKEN }}
      - uses: cachix/cachix-action@v12
        with:
          name: cronos
          signingKey: "${{ secrets.CACHIX_SIGNING_KEY }}"

      - name: build binaries
        run: |
          # install sha256sum
          nix-env -i coreutils -f '<nixpkgs>'

          # build binaries
          ./scripts/release.sh

          # update checksum and upload
          sha256sum *.tar.gz > "checksums.txt"
          echo 'FILES<<EOF' >> $GITHUB_ENV
          ls -1 *.tar.gz >> $GITHUB_ENV
          echo "checksums.txt" >> $GITHUB_ENV
          echo 'EOF' >> $GITHUB_ENV
          cat $GITHUB_ENV
      - name: upload binaries
        uses: softprops/action-gh-release@v1
        with:
          draft: true
          files: "${{ env.FILES }}"

  release-macos:
    # runs sequentially to avoid creating duplicated release
    needs: ["release"]
    strategy:
      matrix:
        runner: [macos-13, macos-14]
    runs-on: ${{ matrix.runner }}
    environment: release
    steps:
      - uses: actions/checkout@v3
      - uses: cachix/install-nix-action@v23
        with:
          nix_path: nixpkgs=channel:nixos-22.11
          extra_nix_config: |
            access-tokens = github.com=${{ secrets.GITHUB_TOKEN }}
      - uses: apple-actions/import-codesign-certs@v1
        with:
          p12-file-base64: ${{ secrets.MAC_CODE_SIGN_CERT }}
          p12-password: ${{ secrets.MAC_CODE_SIGN_CERT_PASS }}
      - uses: cachix/cachix-action@v12
        with:
          name: cronos
          signingKey: "${{ secrets.CACHIX_SIGNING_KEY }}"
      - name: build binaries
        env:
          MAC_CODE_API_KEY: ${{ secrets.MAC_CODE_API_KEY }}
          MAC_CODE_API_KEY_ID: ${{ secrets.MAC_CODE_API_KEY_ID }}
          MAC_CODE_API_ISSUER_ID: ${{ secrets.MAC_CODE_API_ISSUER_ID }}
          MAC_CODE_API_DEVELOPER_ID: ${{ secrets.MAC_CODE_API_DEVELOPER_ID }}
        run: |
          # install sha256sum
          nix-env -i coreutils -f '<nixpkgs>'

          # build binaries
          ./scripts/release.sh

          # codesign
          for tarball in *.tar.gz;
          do
            ./scripts/codesign_macos.sh $tarball
            mv signed.tar.gz $tarball
          done

          # update checksum and upload
          CHKFILE="checksums-darwin-$(uname -p).txt"
          sha256sum *.tar.gz > "$CHKFILE"
          echo 'FILES<<EOF' >> $GITHUB_ENV
          ls -1 *.tar.gz >> $GITHUB_ENV
          echo "$CHKFILE" >> $GITHUB_ENV
          echo 'EOF' >> $GITHUB_ENV
          cat $GITHUB_ENV
      - name: upload binaries
        uses: softprops/action-gh-release@v1
        with:
          draft: true
          files: "${{ env.FILES }}"