podman/.github/workflows/mac-pkg.yml

name: Sign and Upload Mac Installer

on:
  release:
    types: [created, published]
  workflow_dispatch:
    inputs:
      version:
        description: 'Release version to build and upload (e.g. "v4.2.1")'
        required: true
permissions:
  contents: write
jobs:
  build:
    runs-on: macos-latest
    env:
      APPLICATION_CERTIFICATE: ${{ secrets.MACOS_APPLICATION_CERT }}
      CODESIGN_IDENTITY: ${{ secrets.MACOS_APPLICATION_IDENTITY }}
      INSTALLER_CERTIFICATE: ${{ secrets.MACOS_INSTALLER_CERT }}
      PRODUCTSIGN_IDENTITY: ${{ secrets.MACOS_INSTALLER_IDENTITY }}
      CERTIFICATE_PWD: ${{ secrets.MACOS_CERTIFICATE_PWD }}

      NOTARIZE_TEAM: ${{ secrets.MACOS_NOTARIZATION_TEAM_ID }}
      NOTARIZE_USERNAME: ${{ secrets.MACOS_NOTARIZATION_APPLE_ID }}
      NOTARIZE_PASSWORD: ${{ secrets.MACOS_NOTARIZATION_PWD }}

      KEYCHAIN_PWD: ${{ secrets.MACOS_CI_KEYCHAIN_PWD }}
    steps:
    - name: Determine Version
      id: getversion
      run: |
        if [ -z "${{ inputs.version }}" ]
        then
              VERSION=${{ github.event.release.tag_name }}
        else
              VERSION=${{ inputs.version }}
        fi
        echo
        echo "version=$VERSION" >> $GITHUB_OUTPUT
    - name: Check uploads
      id: check
      run: |
        URI="https://github.com/containers/podman/releases/download/${{steps.getversion.outputs.version}}"
        ARM_FILE="podman-installer-macos-arm64.pkg"
        AMD_FILE="podman-installer-macos-amd64.pkg"

        status=$(curl -s -o /dev/null -w "%{http_code}" "${URI}/${ARM_FILE}")
        if [[ "$status" == "404" ]] ; then
          echo "buildarm=true" >> $GITHUB_OUTPUT
        else
          echo "ARM installer already exists, skipping"
          echo "buildarm=false" >> $GITHUB_OUTPUT
        fi

        status=$(curl -s -o /dev/null -w "%{http_code}" "${URI}/${AMD_FILE}")
        if [[ "$status" == "404" ]] ; then
          echo "buildamd=true" >> $GITHUB_OUTPUT
        else
          echo "AMD installer already exists, skipping"
          echo "buildamd=false" >> $GITHUB_OUTPUT
        fi
    - name: Checkout Version
      # If no binaries need to be built, then there's no reason to Checkout
      if: steps.check.outputs.buildamd == 'true' || steps.check.outputs.buildarm == 'true'
      uses: actions/checkout@v3
      with:
        ref: ${{steps.getversion.outputs.version}}
    - name: Set up Go
      # If no binaries need to be built, then there's no reason to set up Go
      if: steps.check.outputs.buildamd == 'true' || steps.check.outputs.buildarm == 'true'
      uses: actions/setup-go@v4
      with:
        go-version: stable
    - name: Create Keychain
      if: steps.check.outputs.buildamd == 'true' || steps.check.outputs.buildarm == 'true'
      run: |
        echo $APPLICATION_CERTIFICATE | base64 --decode -o appcert.p12
        echo $INSTALLER_CERTIFICATE | base64 --decode -o instcert.p12

        security create-keychain -p "$KEYCHAIN_PWD" build.keychain
        security default-keychain -s build.keychain
        security unlock-keychain -p "$KEYCHAIN_PWD" build.keychain
        security import appcert.p12 -k build.keychain -P "$CERTIFICATE_PWD" -T /usr/bin/codesign
        security import instcert.p12 -k build.keychain -P "$CERTIFICATE_PWD" -T /usr/bin/productsign
        security set-key-partition-list -S apple-tool:,apple:,codesign: -s -k "$KEYCHAIN_PWD" build.keychain &> /dev/null

        xcrun notarytool store-credentials "notarytool-profile" --apple-id "$NOTARIZE_USERNAME" --team-id "$NOTARIZE_TEAM" --password "$NOTARIZE_PASSWORD" &> /dev/null
    - name: Build and Sign ARM
      if: steps.check.outputs.buildarm == 'true'
      working-directory: contrib/pkginstaller
      run: |
        make ARCH=aarch64 notarize &> /dev/null
        cd out && shasum -a 256 podman-installer-macos-arm64.pkg >> shasums
    - name: Build and Sign AMD
      if: steps.check.outputs.buildamd == 'true'
      working-directory: contrib/pkginstaller
      run: |
        make ARCH=amd64 notarize &> /dev/null
        cd out && shasum -a 256 podman-installer-macos-amd64.pkg >> shasums
    - name: Artifact
      if: steps.check.outputs.buildamd == 'true' || steps.check.outputs.buildarm == 'true'
      uses: actions/upload-artifact@v3
      with:
        name: installers
        path: |
          contrib/pkginstaller/out/podman-installer-macos-*.pkg
    - name: Upload to Release
      if: steps.check.outputs.buildamd == 'true' || steps.check.outputs.buildarm == 'true'
      env:
        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
      run: |
        (gh release download ${{steps.getversion.outputs.version}} -p "shasums" || exit 0)
        cat contrib/pkginstaller/out/shasums >> shasums
        gh release upload ${{steps.getversion.outputs.version}} contrib/pkginstaller/out/podman-installer-macos-*.pkg
        gh release upload ${{steps.getversion.outputs.version}} --clobber shasums