release.yaml

# .github/workflows/release.yaml

on:
  release:
    types: [created]

jobs:
  build-matrix:
    name: Release Go Binary
    runs-on: ubuntu-latest
    strategy:
      matrix:
        # build and publish in parallel: linux/amd64, linux/arm64, windows/amd64, darwin/amd64, darwin/arm64
        os: [linux, windows, darwin]
        arch: [amd64, arm64]
        exclude:
          - arch: arm64
            os: windows
        # output with a .exe extension on Windows
        include:
          - os: windows
            exe-ext: ".exe"

    steps:
    - name: Checkout code
      uses: actions/checkout@v3
    
    - name: Set APP_VERSION env
      run: echo APP_VERSION=$(echo ${GITHUB_REF} | rev | cut -d'/' -f 1 | rev ) >> ${GITHUB_ENV} 

    - name: Set up Go
      uses: actions/setup-go@v3
      with:
        go-version: 1.22

    - name: Build project
      run: |
        export GOOS=${{ matrix.os }}
        export GOARCH=${{ matrix.arch }}
        CGO_ENABLED=0 go build -o fmeflow${{ matrix.exe-ext }} -ldflags="-X \"github.com/safesoftware/fmeflow-cli/cmd.appVersion=${{ env.APP_VERSION }}\""

    - name: Upload artifact for later steps
      uses: actions/upload-artifact@v4
      with:
        name: fmeflow-${{ matrix.os }}-${{ matrix.arch }}
        path: fmeflow${{ matrix.exe-ext }}
        if-no-files-found: error

  build-docker:
    runs-on: ubuntu-latest
    steps:
    - name: Checkout code
      uses: actions/checkout@v3
    - name: Login to Docker Hub
      uses: docker/login-action@v2
      with:
        username: ${{ secrets.DOCKER_USERNAME }}
        password: ${{ secrets.DOCKER_PASSWORD }}
    - name: Set APP_VERSION env
      run: echo APP_VERSION=$(echo ${GITHUB_REF} | rev | cut -d'/' -f 1 | rev ) >> ${GITHUB_ENV}
    - name: Set up QEMU
      uses: docker/setup-qemu-action@v2
    - name: Set up Docker Buildx
      uses: docker/setup-buildx-action@v2
    - name: Build and Push Docker Image
      uses: docker/build-push-action@v4
      with:
        context: .
        push: true
        tags: safesoftware/fmeflow-cli:${{ env.APP_VERSION }}, safesoftware/fmeflow-cli:latest
        platforms: linux/amd64,linux/arm64
        build-args: |
          APP_VERSION=${{ env.APP_VERSION }}

  sign-windows:
    name: Sign Windows Binary
    needs: build-matrix
    runs-on: windows-latest
    steps:
    - name: Download
      uses: actions/download-artifact@v4
      with:
        name: fmeflow-windows-amd64
    
    - uses: azure/login@v2
      with:
        creds: ${{ secrets.AZURE_CREDENTIALS }}

    - name: Whitelist GitHub Runner IP
      run: |
          $agentIP = (Invoke-WebRequest -Uri https://api.ipify.org/).Content
          az keyvault network-rule add -g "${{ secrets.AZURE_RESOURCE_GROUP }}" -n "${{ secrets.KEY_VAULT_NAME }}" --ip-address $agentIP --output none
          az keyvault network-rule wait -n "${{ secrets.KEY_VAULT_NAME }}" --updated --output none

    - name: Install AzureSignTool
      run: |
        dotnet tool install --global AzureSignTool --version 6.0.1

    - name: Sign
      run: |
        azuresigntool sign -coe `
          --azure-key-vault-url https://${{ secrets.KEY_VAULT_NAME }}.vault.azure.net/ `
          --azure-key-vault-managed-identity `
          --azure-key-vault-tenant-id ${{ secrets.AZURE_TENANT_ID }} `
          --azure-key-vault-certificate '${{ secrets.AZURE_CERTIFICATE_NAME }}' `
          --file-digest SHA256 `
          --timestamp-rfc3161 http://timestamp.digicert.com `
          --timestamp-digest SHA256 `
          fmeflow.exe

    - name: Remove IP from Key Vault firewall
      run: |
          $agentIP = (Invoke-WebRequest -Uri https://api.ipify.org/).Content
          az keyvault network-rule remove -g "${{ secrets.AZURE_RESOURCE_GROUP }}" -n "${{ secrets.KEY_VAULT_NAME }}" --ip-address $agentIP --output none
    
    - name: Reupload artifact
      uses: actions/upload-artifact@v4
      with:
        name: fmeflow-windows-amd64
        path: fmeflow.exe
        overwrite: true

  sign-macosx:
    name: Sign Mac Binaries
    needs: build-matrix
    runs-on: macos-14
    strategy:
      matrix:
        # sign both darwin/amd64, darwin/arm64
        os: [darwin]
        arch: [amd64, arm64]
    steps:
    - name: Download
      uses: actions/download-artifact@v4
      with:
        name: fmeflow-${{ matrix.os }}-${{ matrix.arch }}

    - name: Codesign binaries
      # Extract the secrets
      env: 
        MACOS_CERTIFICATE: ${{ secrets.PROD_MACOS_CERTIFICATE }}
        MACOS_CERTIFICATE_PWD: ${{ secrets.PROD_MACOS_CERTIFICATE_PWD }}
        MACOS_CERTIFICATE_NAME: ${{ secrets.PROD_MACOS_CERTIFICATE_NAME }}
        MACOS_CI_KEYCHAIN_PWD: ${{ secrets.PROD_MACOS_CI_KEYCHAIN_PWD }}
      run: |
        # Turn our base64-encoded certificate back to a regular .p12 file
        
        echo $MACOS_CERTIFICATE | base64 --decode > certificate.p12

        # We need to create a new keychain, otherwise using the certificate will prompt
        # with a UI dialog asking for the certificate password, which we can't
        # use in a headless CI environment
        
        security create-keychain -p "$MACOS_CI_KEYCHAIN_PWD" build.keychain 
        security default-keychain -s build.keychain
        security unlock-keychain -p "$MACOS_CI_KEYCHAIN_PWD" build.keychain
        security import certificate.p12 -k build.keychain -P "$MACOS_CERTIFICATE_PWD" -T /usr/bin/codesign
        security set-key-partition-list -S apple-tool:,apple:,codesign: -s -k "$MACOS_CI_KEYCHAIN_PWD" build.keychain

        # We finally codesign our app bundle, specifying the Hardened runtime option
        
        /usr/bin/codesign --force -s "$MACOS_CERTIFICATE_NAME" --options runtime fmeflow -v
    
    - name: "Notarize executable"
      # Extract the secrets we defined earlier as environment variables
      env:
        PROD_MACOS_NOTARIZATION_APPLE_ID: ${{ secrets.PROD_MACOS_NOTARIZATION_APPLE_ID }}
        PROD_MACOS_NOTARIZATION_TEAM_ID: ${{ secrets.PROD_MACOS_NOTARIZATION_TEAM_ID }}
        PROD_MACOS_NOTARIZATION_PWD: ${{ secrets.PROD_MACOS_NOTARIZATION_PWD }}
      run: |
        # Store the notarization credentials so that we can prevent a UI password dialog
        # from blocking the CI

        echo "Create keychain profile"
        xcrun notarytool store-credentials "notarytool-profile" --apple-id "$PROD_MACOS_NOTARIZATION_APPLE_ID" --team-id "$PROD_MACOS_NOTARIZATION_TEAM_ID" --password "$PROD_MACOS_NOTARIZATION_PWD"

        # We can't notarize the executable directly, but we need to compress it as an archive.
        # Therefore, we create a zip file containing our app bundle, so that we can send it to the
        # notarization service

        echo "Creating temp notarization archive"
        ditto -c -k --keepParent "fmeflow" "notarization.zip"

        # Here we send the notarization request to the Apple's Notarization service, waiting for the result.
        # This typically takes a few seconds inside a CI environment, but it might take more depending on the App
        # characteristics. Visit the Notarization docs for more information and strategies on how to optimize it if
        # you're curious

        echo "Notarize app"
        xcrun notarytool submit "notarization.zip" --keychain-profile "notarytool-profile" --wait

    - name: Reupload artifact
      uses: actions/upload-artifact@v4
      with:
        name: fmeflow-${{ matrix.os }}-${{ matrix.arch }}
        path: fmeflow
        overwrite: true

  compress-files:
    name: Compress binaries and release
    runs-on: ubuntu-latest
    needs: [sign-windows, sign-macosx]
    strategy:
      matrix:
        # build and publish in parallel: linux/amd64, linux/arm64, windows/amd64, darwin/amd64, darwin/arm64
        os: [linux, windows, darwin]
        arch: [amd64, arm64]
        exclude:
          - arch: arm64
            os: windows
        # set up zip and executable extensions that differ on Windows
        include:
          - os: windows
            zip-ext: zip
            exe-ext: .exe
            type: zip
          - os: linux
            zip-ext: tar.gz
            type: tar
          - os: darwin
            zip-ext: tar.gz
            type: tar
    steps:
    - name: Checkout code
      uses: actions/checkout@v4
    - name: Download
      uses: actions/download-artifact@v4
      with:
        name: fmeflow-${{ matrix.os }}-${{ matrix.arch }}
        path: release

    - name: Copy license files for inclusion in zip package
      run: |
        cp LICENSE release
        cp THIRDPARTY release
    
    # zip or tar.gz the binary
    - name: Archive Release
      uses: thedoctor0/zip-release@0.7.1
      with:
        type: ${{ matrix.type }}
        directory: release
        filename: ../fmeflow-${{ matrix.os }}-${{ matrix.arch }}.${{ matrix.zip-ext }}

    - name: Calculate MD5 hash
      run: |
        MD5_SUM=$(md5sum fmeflow-${{ matrix.os }}-${{ matrix.arch }}.${{ matrix.zip-ext }} | cut -d ' ' -f 1)
        echo ${MD5_SUM} >fmeflow-${{ matrix.os }}-${{ matrix.arch }}.${{ matrix.zip-ext }}.md5
        cat fmeflow-${{ matrix.os }}-${{ matrix.arch }}.${{ matrix.zip-ext }}.md5

    # Add compressed files and md5 hashes to the release
    - uses: AButler/upload-release-assets@v3.0
      with:
        files: '*.md5;*.zip;*.tar.gz'
        repo-token: ${{ secrets.GITHUB_TOKEN }}