ci.yml

name: CI build

on:
  push: # Runs whenever a commit is pushed to the repository, including for a PR
  workflow_call: # Runs when this workflow is called from another workflow
  workflow_dispatch: # Allows you to run this workflow manually from the Actions tab

concurrency:
  group: '${{ github.workflow }} @ ${{ github.event.pull_request.head.label || github.head_ref || github.ref }}'
  cancel-in-progress: true

permissions:
  contents: write # publish a GitHub release
  issues: write # comment on released issues
  pull-requests: write # comment on released pull requests

jobs:
  # Keep in mind:
  # 60 seconds on Ubuntu = 1 minute charged to account
  # 60 seconds on Windows = 2 minutes charged to account
  # 60 seconds on macOS = 10 minutes charged to account
  semver:
    runs-on: ubuntu-latest
    outputs:
      version: ${{ steps.semver.outputs.SCRATCH_VERSION }}
      hash: ${{ steps.semver.outputs.SCRATCH_HASH }}
    steps:
      - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3
      - uses: actions/setup-node@1a4442cacd436585916779262731d5b162bc6ec7 # v3
        with:
          cache: 'npm'
          node-version-file: '.nvmrc'
      - run: npm ci
      - name: Make local 'remote' for semantic-release
        run: |
          # semantic-release tracks channels with notes, so we need to grab those from the real remote
          # semantic-release also wants to inspect every branch listed in its "branches" setting
          git fetch -uf origin main:main develop:develop 'refs/notes/*:refs/notes/*'
          git clone . --bare --mirror semantic-release-remote # mirror copies notes
          git remote set-url origin "file://$(realpath semantic-release-remote)" # semantic-release needs a proper URL
      - name: Stage semantic-release version commit
        # In release branches, this will calculate the version and save that to package.json so the build can use it.
        # In other branches, it'll just check the semantic-release config.
        # Note that if semantic-release makes changes it will automatically push them.
        # That's the whole reason for the weird "local remote" stuff.
        # See also: https://github.com/semantic-release/semantic-release/issues/964
        run: npx --no -- semantic-release
      - name: Output semantic-release version
        id: semver
        run: |
          cat <<EOF > "$GITHUB_OUTPUT"
          SCRATCH_VERSION=$(node -p "require('./package.json').version")
          SCRATCH_HASH=$(git rev-parse --short HEAD)
          EOF
      - name: Create artifact for semantic-release 'remote'
        run: tar czvf semantic-release-remote.tgz semantic-release-remote
      - uses: actions/upload-artifact@5d5d22a31266ced268874388b861e4b58bb5c2f3 # v4
        with:
          name: semantic-release-remote
          path: semantic-release-remote.tgz
          retention-days: 1 # relevant if a failure prevents the delete step below
  build:
    needs: semver
    defaults:
      run:
        shell: bash # even on Windows, unless otherwise specified
    env:
      SCRATCH_SHOULD_SIGN: "NO" # TODO
      MATCH_STORAGE_MODE: git
      MATCH_GIT_URL: ${{ secrets.FL_GIT_URL }}
      MATCH_PASSWORD: ${{ secrets.MATCH_PASSWORD }}
      FASTLANE_ACCESS_KEY: ${{ secrets.FASTLANE_ACCESS_KEY }}
    strategy:
      fail-fast: false
      matrix:
        image: [windows-latest, macos-latest]
    runs-on: ${{ matrix.image }}
    steps:
      ### Shared prologue

      #- name: Setup upterm session
      #  uses: lhotari/action-upterm@v1
      #  with:
      #    limit-access-to-users: cwillisf
      - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3
      - uses: actions/download-artifact@eaceaf801fd36c7dee90939fad912460b18a1ffe # v4
        with:
          name: semantic-release-remote
          path: .
      - name: Restore semantic-release 'remote'
        run: |
          # this `tar` command replaces the usual "checkout" step
          tar xzvf semantic-release-remote.tgz
          rm semantic-release-remote.tgz
      - name: Pull semantic-release changes from local 'remote'
        run: |
          git remote add semantic-release semantic-release-remote
          git pull --tags semantic-release ${{ github.ref_name }}
          git fetch semantic-release 'refs/notes/*:refs/notes/*' # semantic-release tracks channels with notes

      ### macOS setup

      - name: "macOS: Setup keys for Fastlane"
        if: runner.os == 'macOS' && env.FASTLANE_ACCESS_KEY != ''
        uses: webfactory/ssh-agent@d4b9b8ff72958532804b70bbe600ad43b36d5f2e # v0.8.0
        with:
            ssh-private-key: ${{ secrets.FASTLANE_ACCESS_KEY }}
      - name: "macOS: Fastlane Match"
        if: runner.os == 'macOS' && env.MATCH_PASSWORD != ''
        shell: bash
        run: fastlane circleci
      - name: "macOS: Setup Xamarin"
        if: runner.os == 'macOS'
        shell: bash
        run: |
          #cat "$VM_ASSETS/select-xamarin-sdk-v2.sh"
          #ls /Library/Frameworks/{Mono,Xamarin.Mac,Xamarin.iOS,Xamarin.Android}.framework/Versions/
          # For Xcode 13.2 / macOS 11: --mono=6.12 --mac=8.8 --ios=15.8
          # For Xcode 14.2 / macOS 12: --mono=6.12 --mac=9.1 --ios=16.2
          $VM_ASSETS/select-xamarin-sdk-v2.sh --mono=6.12 --mac=9.1 --ios=16.2

      ### Windows setup

      - name: "Windows: Add msbuild to PATH"
        if: runner.os == 'Windows'
        uses: microsoft/setup-msbuild@34cfbaee7f672c76950673338facd8a73f637506 # v1.1

      ### Shared setup

      - name: Setup dotnet
        uses: actions/setup-dotnet@3447fd6a9f9e57506b15f895c5b76d3b197dc7c2 # v3
        with:
          dotnet-version: '6.0.x'
      - uses: actions/cache@e12d46a63a90f2fae62d114769bbf2a179198b5c # v3
        with:
          path: ~/.nuget/packages
          # Look to see if there is a cache hit for the corresponding requirements file
          key: ${{ runner.os }}-nuget-${{ hashFiles('**/packages.lock.json') }}
          restore-keys: ${{ runner.os }}-nuget

      ### macOS build

      - name: Build for macOS debug
        if: runner.os == 'macOS' && env.SCRATCH_SHOULD_SIGN != 'YES'
        uses: ./.github/actions/macos-build
        with:
          configuration: Debug
          artifact_tag: Debug
          sign: ${{ env.SCRATCH_SHOULD_SIGN }}
          AC_USERNAME: ${{ secrets.AC_USERNAME }}
          AC_PASSWORD: ${{ secrets.AC_PASSWORD }}
      - name: Build for macOS direct download
        if: runner.os == 'macOS' && env.SCRATCH_SHOULD_SIGN == 'YES'
        uses: ./.github/actions/macos-build
        with:
          configuration: Release_DevID
          artifact_tag: ''
          sign: ${{ env.SCRATCH_SHOULD_SIGN }}
          AC_USERNAME: ${{ secrets.AC_USERNAME }}
          AC_PASSWORD: ${{ secrets.AC_PASSWORD }}
      - name: Build for Mac App Store
        if: runner.os == 'macOS' && env.SCRATCH_SHOULD_SIGN == 'YES'
        uses: ./.github/actions/macos-build
        with:
          configuration: Release_MAS
          artifact_tag: MAS
          sign: ${{ env.SCRATCH_SHOULD_SIGN }}
          AC_USERNAME: ${{ secrets.AC_USERNAME }}
          AC_PASSWORD: ${{ secrets.AC_PASSWORD }}

      ### Windows build

      - name: Build for Windows debug
        if: runner.os == 'Windows' && env.SCRATCH_SHOULD_SIGN != 'YES'
        uses: ./.github/actions/windows-build
        with:
          configuration: Debug
          artifact_tag: Debug
      - name: Build for Windows release
        if: runner.os == 'Windows' && env.SCRATCH_SHOULD_SIGN == 'YES'
        uses: ./.github/actions/windows-build
        with:
          configuration: Release
          artifact_tag: ''

      ### Shared epilogue

      - uses: actions/upload-artifact@5d5d22a31266ced268874388b861e4b58bb5c2f3 # v4
        with:
          name: "Scratch ${{ needs.semver.outputs.version }} (${{ needs.semver.outputs.hash }})"
          path: Artifacts/

  finish:
    if: always() # even if the build fails
    runs-on: ubuntu-latest
    needs: build
    steps:
      - uses: geekyeggo/delete-artifact@54ab544f12cdb7b71613a16a2b5a37a9ade990af # v2
        with:
          name: semantic-release-remote
          failOnError: false