release.yml

name: Build and release

on:
  push:
    tags:
      - "v*.*.*"
  workflow_dispatch:
    inputs:
      version:
        description: "Release version without the v prefix"
        required: true
        default: "0.1.0"
        type: string
      publish_release:
        description: "Create or update a GitHub Release after both builds pass"
        required: true
        default: false
        type: boolean

permissions:
  contents: read

concurrency:
  group: release-${{ github.ref }}
  cancel-in-progress: false

jobs:
  windows:
    name: Windows portable x64
    runs-on: windows-2022

    steps:
      - name: Check out source
        uses: actions/checkout@v4

      - name: Set up .NET
        uses: actions/setup-dotnet@v4
        with:
          dotnet-version: "10.0.x"

      - name: Resolve version
        id: version
        shell: pwsh
        env:
          DISPATCH_VERSION: ${{ inputs.version }}
        run: |
          if ($env:GITHUB_REF -like "refs/tags/v*") {
            $version = $env:GITHUB_REF_NAME.Substring(1)
          } else {
            $version = $env:DISPATCH_VERSION
          }
          if ($version -notmatch '^[0-9]+\.[0-9]+\.[0-9]+([-.][0-9A-Za-z.-]+)?$') {
            throw "Invalid release version: $version"
          }
          "version=$version" >> $env:GITHUB_OUTPUT
          "VERSION=$version" >> $env:GITHUB_ENV

      - name: Build both Windows solutions
        shell: pwsh
        run: |
          dotnet build .\windows\VpnRouter.slnx --configuration Release -nr:false
          if ($LASTEXITCODE -ne 0) { throw "VpnRouter.slnx build failed." }
          dotnet build .\windows\VpnRouterVs.sln --configuration Release -nr:false
          if ($LASTEXITCODE -ne 0) { throw "VpnRouterVs.sln build failed." }

      - name: Run focused Windows tests
        shell: pwsh
        run: |
          $passed = $false
          for ($attempt = 1; $attempt -le 3; $attempt++) {
            Write-Host "Running focused Windows tests (attempt $attempt/3)..."
            dotnet run --project .\windows\VpnRouter.Tests\VpnRouter.Tests.csproj --configuration Release --no-build
            $exitCode = $LASTEXITCODE
            if ($exitCode -eq 0) {
              $passed = $true
              break
            }
            if ($attempt -lt 3) {
              Write-Warning "Focused Windows tests failed with exit code $exitCode; retrying after 5 seconds."
              Start-Sleep -Seconds 5
            }
          }
          if (-not $passed) { throw "Windows focused tests failed after 3 attempts." }

      - name: Build and verify portable executable
        shell: pwsh
        run: |
          & .\scripts\windows\verify-release.ps1 -Version $env:VERSION
          if ($LASTEXITCODE -ne 0) { throw "Windows release verification failed." }

      - name: Upload Windows release assets
        uses: actions/upload-artifact@v4
        with:
          name: windows-release
          if-no-files-found: error
          path: |
            artifacts/portable/VpnRouter-${{ steps.version.outputs.version }}-x64.exe
            artifacts/portable/VpnRouter-${{ steps.version.outputs.version }}-x64.exe.sha256
          retention-days: 14

  macos:
    name: macOS arm64 package
    # The project uses Xcode 16 project format (objectVersion 77).
    runs-on: macos-15

    steps:
      - name: Check out source
        uses: actions/checkout@v4

      - name: Set up Go
        uses: actions/setup-go@v5
        with:
          go-version: "1.22.x"

      - name: Resolve version
        id: version
        shell: bash
        env:
          DISPATCH_VERSION: ${{ inputs.version }}
        run: |
          if [[ "${GITHUB_REF}" == refs/tags/v* ]]; then
            version="${GITHUB_REF_NAME#v}"
          else
            version="${DISPATCH_VERSION}"
          fi
          if [[ ! "${version}" =~ ^[0-9]+\.[0-9]+\.[0-9]+([-.][0-9A-Za-z.-]+)?$ ]]; then
            echo "Invalid release version: ${version}" >&2
            exit 1
          fi
          echo "version=${version}" >> "${GITHUB_OUTPUT}"
          echo "VERSION=${version}" >> "${GITHUB_ENV}"

      - name: Build and verify unsigned macOS app
        shell: bash
        env:
          VPNROUTER_DERIVED_DATA_PATH: ${{ runner.temp }}/vpnrouter-derived
          VPNROUTER_PRODUCT_VERSION: ${{ steps.version.outputs.version }}
          VPNROUTER_BUILD_NUMBER: ${{ github.run_number }}
        run: |
          chmod +x scripts/macos/verify-release.sh scripts/macos/verify-signed-app.sh
          ./scripts/macos/verify-release.sh

      - name: Determine macOS signing mode
        id: signing
        shell: bash
        env:
          APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }}
          APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
          APPLE_API_KEY: ${{ secrets.APPLE_API_KEY }}
          APPLE_API_KEY_ID: ${{ secrets.APPLE_API_KEY_ID }}
          APPLE_ISSUER_ID: ${{ secrets.APPLE_ISSUER_ID }}
          APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
        run: |
          set -euo pipefail
          if [[ -n "${APPLE_CERTIFICATE}" &&
                -n "${APPLE_CERTIFICATE_PASSWORD}" &&
                -n "${APPLE_API_KEY}" &&
                -n "${APPLE_API_KEY_ID}" &&
                -n "${APPLE_ISSUER_ID}" &&
                -n "${APPLE_TEAM_ID}" ]]; then
            echo "mode=signed" >> "${GITHUB_OUTPUT}"
            echo "PACKAGE_SUFFIX=signed" >> "${GITHUB_ENV}"
          else
            echo "mode=unsigned" >> "${GITHUB_OUTPUT}"
            echo "PACKAGE_SUFFIX=unsigned" >> "${GITHUB_ENV}"
            echo "Apple signing/notarization secrets are incomplete; keeping unsigned package mode."
          fi

      - name: Import Developer ID certificate
        if: steps.signing.outputs.mode == 'signed'
        shell: bash
        env:
          APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }}
          APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
        run: |
          set -euo pipefail
          keychain_path="${RUNNER_TEMP}/vpnrouter-signing.keychain-db"
          keychain_password="$(openssl rand -hex 24)"
          certificate_path="${RUNNER_TEMP}/vpnrouter-certificate.p12"
          printf '%s' "${APPLE_CERTIFICATE}" | base64 -D > "${certificate_path}"
          security create-keychain -p "${keychain_password}" "${keychain_path}"
          security set-keychain-settings -lut 21600 "${keychain_path}"
          security unlock-keychain -p "${keychain_password}" "${keychain_path}"
          security import "${certificate_path}" \
            -P "${APPLE_CERTIFICATE_PASSWORD}" \
            -k "${keychain_path}" \
            -T /usr/bin/codesign \
            -T /usr/bin/security
          security list-keychains -d user -s "${keychain_path}"
          security default-keychain -s "${keychain_path}"
          signing_identity="$(security find-identity -v -p codesigning "${keychain_path}" |
            sed -n 's/.*"\(Developer ID Application:.*\)"/\1/p' | head -n 1)"
          if [[ -z "${signing_identity}" ]]; then
            echo "Developer ID Application identity was not found in the imported certificate." >&2
            exit 1
          fi
          {
            echo "SIGNING_KEYCHAIN=${keychain_path}"
            echo "SIGNING_IDENTITY=${signing_identity}"
          } >> "${GITHUB_ENV}"

      - name: Sign macOS app and embedded extensions
        if: steps.signing.outputs.mode == 'signed'
        shell: bash
        env:
          DERIVED_DATA_PATH: ${{ runner.temp }}/vpnrouter-derived
        run: |
          set -euo pipefail
          app_path="${DERIVED_DATA_PATH}/Build/Products/Release/VPNRouter.app"
          packet_path="${app_path}/Contents/PlugIns/PacketTunnel.appex"
          dns_path="${app_path}/Contents/Library/SystemExtensions/com.simple.VPNRouter.DNSProxyExtension.systemextension"
          codesign_args=(--force --options runtime --timestamp --keychain "${SIGNING_KEYCHAIN}" --sign "${SIGNING_IDENTITY}")
          codesign "${codesign_args[@]}" \
            --entitlements macos/VPNRouter/PacketTunnel/PacketTunnel.entitlements \
            "${packet_path}"
          codesign "${codesign_args[@]}" \
            --entitlements macos/VPNRouter/DNSProxyExtension/DNSProxyExtension.entitlements \
            "${dns_path}"
          codesign "${codesign_args[@]}" \
            --entitlements macos/VPNRouter/VPNRouter/VPNRouter.entitlements \
            "${app_path}"
          VPNROUTER_PRODUCT_VERSION="${VERSION}" \
            VPNROUTER_BUILD_NUMBER="${GITHUB_RUN_NUMBER}" \
            VPNROUTER_MINIMUM_MACOS_VERSION="15.0" \
            scripts/macos/verify-signed-app.sh --mode distribution "${app_path}"

      - name: Notarize and staple macOS app
        if: steps.signing.outputs.mode == 'signed'
        shell: bash
        env:
          DERIVED_DATA_PATH: ${{ runner.temp }}/vpnrouter-derived
          APPLE_API_KEY: ${{ secrets.APPLE_API_KEY }}
          APPLE_API_KEY_ID: ${{ secrets.APPLE_API_KEY_ID }}
          APPLE_ISSUER_ID: ${{ secrets.APPLE_ISSUER_ID }}
        run: |
          set -euo pipefail
          app_path="${DERIVED_DATA_PATH}/Build/Products/Release/VPNRouter.app"
          submit_zip="${RUNNER_TEMP}/VPNRouter-${VERSION}-notarization.zip"
          api_key_path="${RUNNER_TEMP}/AuthKey_${APPLE_API_KEY_ID}.p8"
          printf '%s' "${APPLE_API_KEY}" | base64 -D > "${api_key_path}"
          ditto -c -k --sequesterRsrc --keepParent "${app_path}" "${submit_zip}"
          xcrun notarytool submit "${submit_zip}" \
            --key "${api_key_path}" \
            --key-id "${APPLE_API_KEY_ID}" \
            --issuer "${APPLE_ISSUER_ID}" \
            --wait
          xcrun stapler staple "${app_path}"
          xcrun stapler validate "${app_path}"
          spctl --assess --type execute "${app_path}"

      - name: Package macOS app as ZIP and DMG
        shell: bash
        env:
          DERIVED_DATA_PATH: ${{ runner.temp }}/vpnrouter-derived
        run: |
          set -euo pipefail
          app_path="${DERIVED_DATA_PATH}/Build/Products/Release/VPNRouter.app"
          output_dir="artifacts/macos"
          mkdir -p "${output_dir}"
          test -d "${app_path}"

          zip_path="${output_dir}/VPNRouter-${VERSION}-macos-arm64-${PACKAGE_SUFFIX}.zip"
          dmg_path="${output_dir}/VPNRouter-${VERSION}-macos-arm64-${PACKAGE_SUFFIX}.dmg"
          ditto -c -k --sequesterRsrc --keepParent "${app_path}" "${zip_path}"
          hdiutil create \
            -volname "VPN Router ${VERSION}" \
            -srcfolder "${app_path}" \
            -ov \
            -format UDZO \
            "${dmg_path}"

          shasum -a 256 "${zip_path}" > "${zip_path}.sha256"
          shasum -a 256 "${dmg_path}" > "${dmg_path}.sha256"
          shasum -a 256 -c "${zip_path}.sha256"
          shasum -a 256 -c "${dmg_path}.sha256"
          if [[ "${PACKAGE_SUFFIX}" == "unsigned" ]]; then
            printf '%s\n' \
              "VPN Router ${VERSION} macOS arm64 package" \
              "This package is unsigned compile/package evidence." \
              "System Extension activation requires an owner-signed app installed in /Applications." \
              > "${output_dir}/VPNRouter-${VERSION}-macos-arm64-unsigned.txt"
          fi

      - name: Upload macOS release assets
        uses: actions/upload-artifact@v4
        with:
          name: macos-release
          if-no-files-found: error
          path: artifacts/macos/*
          retention-days: 14

  publish:
    name: Publish GitHub Release
    needs:
      - windows
      - macos
    if: >-
      startsWith(github.ref, 'refs/tags/') ||
      (github.event_name == 'workflow_dispatch' && inputs.publish_release == true)
    runs-on: ubuntu-latest
    permissions:
      contents: write

    steps:
      - name: Resolve version and release tag
        id: version
        shell: bash
        env:
          DISPATCH_VERSION: ${{ inputs.version }}
        run: |
          if [[ "${GITHUB_REF}" == refs/tags/v* ]]; then
            version="${GITHUB_REF_NAME#v}"
          else
            version="${DISPATCH_VERSION}"
          fi
          echo "version=${version}" >> "${GITHUB_OUTPUT}"
          echo "tag=v${version}" >> "${GITHUB_OUTPUT}"

      - name: Download Windows assets
        uses: actions/download-artifact@v4
        with:
          name: windows-release
          path: release-assets

      - name: Download macOS assets
        uses: actions/download-artifact@v4
        with:
          name: macos-release
          path: release-assets

      - name: Create or update GitHub Release
        env:
          GH_TOKEN: ${{ github.token }}
          GH_REPO: NetMD/VPN-Router
          RELEASE_TAG: ${{ steps.version.outputs.tag }}
        shell: bash
        run: |
          set -euo pipefail
          if compgen -G 'release-assets/*macos-arm64-signed.*' > /dev/null; then
            macos_status='Developer ID 서명·공증 완료'
          else
            macos_status='unsigned 패키지 (공증 Secret 미완비)'
          fi
          cat > release-notes.md <<EOF
          ## VPN Router ${RELEASE_TAG}

          선택한 사이트만 WireGuard VPN으로 보내는 Windows·macOS 데스크톱 앱의 공개 릴리스입니다.

          ### 포함 내용

          - Windows x64 portable EXE 및 SHA-256 체크섬
          - macOS arm64 ZIP·DMG 및 SHA-256 체크섬
          - macOS 상태: ${macos_status}

          ### 설치 안내

          - Windows: portable EXE를 원하는 폴더에 압축 해제한 뒤 실행합니다.
          - macOS: 앱을 Applications 폴더에 복사한 뒤 실행합니다. unsigned 빌드는 개발·검증용이며 System Extension 활성화와 Gatekeeper 경고가 발생할 수 있습니다.
          - 배포 전에는 제공된 SHA-256 체크섬을 확인하십시오.
          EOF
          if gh release view "${RELEASE_TAG}" -R "${GH_REPO}" >/dev/null 2>&1; then
            gh release edit "${RELEASE_TAG}" -R "${GH_REPO}" \
              --title "VPN Router ${RELEASE_TAG}" \
              --notes-file release-notes.md
          else
            gh release create "${RELEASE_TAG}" -R "${GH_REPO}" \
              --title "VPN Router ${RELEASE_TAG}" \
              --notes-file release-notes.md
          fi
          gh release upload "${RELEASE_TAG}" release-assets/* -R "${GH_REPO}" --clobber