release.yaml

name: Release

on:
  push:
    tags:
      - 'v*.*.*'

  workflow_dispatch:

jobs:
  release:
    runs-on: macos-latest
    steps:
    - uses: actions/setup-node@v3
      with:
        node-version: 16
    - uses: actions/checkout@v3
      with:
        fetch-depth: 0

    - name: Install dependencies
      run: npm install
    - name: Run bootstrap
      run: npm run start
    - name: Build binaries
      run: npm run pkg

    # - name: Sign and notarize the nexrender-cli-macos
    #   uses: toitlang/action-macos-sign-notarize@v1.1.1
    #   with:
    #     certificate: ${{ secrets.MACOS_CERTIFICATE }}
    #     certificate-password: ${{ secrets.MACOS_CERTIFICATE_PWD }}
    #     username: ${{ secrets.APPLE_ID_USERNAME }}
    #     password: ${{ secrets.APPLE_ID_PASSWORD }}
    #     apple-team-id: 89QX7NXPQM
    #     app-path: bin/nexrender-cli-macos

    # # - name: Sign and notarize the nexrender-worker-macos
    # - name: Code sign (nexrender-worker-macos)
    #   shell: bash
    #   run: |
    #     security find-identity -v signing_temp.keychain | grep "89QX7NXPQM" | grep "Developer ID Application"
    #     codesign --keychain signing_temp.keychain --force --deep --sign "89QX7NXPQM" "bin/nexrender-worker-macos" --options=runtime

    # - name: Create a tmp directory
    #   id: tmp2
    #   shell: bash
    #   run: |
    #     echo "path=$(mktemp -d -t sign_notarize.XXXXXXXXXX)" >> $GITHUB_OUTPUT

    # - name: Create a ZIP (nexrender-worker-macos)
    #   id: zip2
    #   shell: bash
    #   run: |
    #     TMP=${{ steps.tmp2.outputs.path }}
    #     ZIP_PATH="$TMP/app2.zip"
    #     zip -j "$ZIP_PATH" "bin/nexrender-worker-macos"
    #     echo "zip_path=$ZIP_PATH" >> $GITHUB_OUTPUT

    # - name: Notarize (nexrender-worker-macos)
    #   shell: bash
    #   run: |
    #     TMP=${{ steps.tmp2.outputs.path }}
    #     xcrun notarytool submit \
    #         "${{ steps.zip2.outputs.zip_path }}" \
    #         --wait \
    #         --apple-id "${{ secrets.APPLE_ID_USERNAME }}" \
    #         --password "${{ secrets.APPLE_ID_PASSWORD }}" \
    #         --team-id "89QX7NXPQM" \
    #         --output-format json \
    #       | tee "$TMP/out.json"
    #     grep -q "Accepted" "$TMP/out.json"

    # - name: Check notarization (nexrender-worker-macos)
    #   shell: bash
    #   run: |
    #     # See https://developer.apple.com/forums/thread/130560
    #     codesign -vvvv -R="notarized" --check-notarization "bin/nexrender-worker-macos"

    - name: Publish release
      uses: softprops/action-gh-release@v1
      if: success()
      with:
        # body: ${{ steps.release_notes.outputs.release_body }}
        files: bin/*