release.yml

name: release

on:
  push:
    branches:
      - main
  release:
    types: [published]

permissions: {}

# Cancel in-progress runs for when multiple PRs get merged
# in quick succession. Ignore this for tag releases though.
concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: ${{ !contains(github.ref, 'tags/')}}

jobs:
  build:
    name: Build Coder Desktop
    runs-on: ${{ github.repository_owner == 'coder' && 'depot-macos-latest' || 'macos-latest'}}
    if: ${{ github.repository_owner == 'coder' }}
    permissions:
      # To upload assets to the release
      contents: write
    steps:
      - name: Checkout
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
          fetch-depth: 0
          fetch-tags: true
          persist-credentials: false

      - name: Switch XCode Version
        uses: maxim-lobanov/setup-xcode@60606e260d2fc5762a71e64e74b2174e8ea3c8bd # v1.6.0
        with:
          xcode-version: "16.0.0"

      - name: Setup Nix
        uses: ./.github/actions/nix-devshell

      - name: Build
        env:
          APPLE_DEVELOPER_ID_PKCS12_B64: ${{ secrets.APPLE_DEVELOPER_ID_PKCS12_B64 }}
          APPLE_DEVELOPER_ID_PKCS12_PASSWORD: ${{ secrets.APPLE_DEVELOPER_ID_PKCS12_PASSWORD }}
          APPLE_INSTALLER_PKCS12_B64: ${{ secrets.APPLE_INSTALLER_PKCS12_B64 }}
          APPLE_INSTALLER_PKCS12_PASSWORD: ${{ secrets.APPLE_INSTALLER_PKCS12_PASSWORD }}
          APPLE_ID: ${{ secrets.APPLE_NOTARYTOOL_USERNAME  }}
          APPLE_ID_PASSWORD: ${{ secrets.APPLE_NOTARYTOOL_PASSWORD }}
          APP_PROF: ${{ secrets.CODER_DESKTOP_APP_PROVISIONPROFILE_B64 }}
          EXT_PROF: ${{ secrets.CODER_DESKTOP_EXTENSION_PROVISIONPROFILE_B64 }}
        run: make release

      - name: Upload Release Assets
        run: gh release upload "$RELEASE_TAG" "$out"/* --clobber
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          RELEASE_TAG: ${{ github.event_name == 'release' && github.event.release.tag_name || 'preview' }}

  update-cask:
    name: Update homebrew-coder cask
    runs-on: ${{ github.repository_owner == 'coder' && 'depot-macos-latest' || 'macos-latest'}}
    if: ${{ github.repository_owner == 'coder' }}
    needs: build
    steps:
      - name: Checkout
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
          fetch-depth: 0
          fetch-tags: true
          persist-credentials: false

      - name: Setup Nix
        uses: ./.github/actions/nix-devshell

      - name: Update homebrew-coder
        env:
          GH_TOKEN: ${{ secrets.CODERCI_GITHUB_TOKEN }}
          RELEASE_TAG: ${{ github.event_name == 'release' && github.event.release.tag_name || 'preview' }}
          ASSIGNEE: ${{ github.actor }}
        run: |
          git config --global user.email "ci@coder.com"
          git config --global user.name "Coder CI"
          gh auth setup-git

          ./scripts/update-cask.sh --version "$RELEASE_TAG" --assignee "$ASSIGNEE"