name: Release

on:
  push:
    tags:
      - "*"
  workflow_dispatch:

permissions:
  contents: read

jobs:
  release:
    if: github.event_name == 'push' && github.repository == 'openai/tart'
    name: Release
    runs-on: macos-26
    environment: publish
    timeout-minutes: 90
    permissions:
      contents: read
    env:
      VERSION: ${{ github.ref_name }}
    steps:
      - name: Checkout
        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
        with:
          fetch-depth: 0
          persist-credentials: false
      - name: Import signing certificate
        env:
          AC_PASSWORD: ${{ secrets.AC_PASSWORD }}
          KEYCHAIN_PASSWORD: temporary-password
          MACOS_CERTIFICATE: ${{ secrets.MACOS_CERTIFICATE }}
          P12_PASSWORD: password101
        run: |
          echo "$MACOS_CERTIFICATE" | base64 --decode > "$RUNNER_TEMP/certificate.p12"
          security create-keychain -p "$KEYCHAIN_PASSWORD" "$RUNNER_TEMP/build.keychain"
          security set-keychain-settings -lut 21600 "$RUNNER_TEMP/build.keychain"
          security default-keychain -s "$RUNNER_TEMP/build.keychain"
          security unlock-keychain -p "$KEYCHAIN_PASSWORD" "$RUNNER_TEMP/build.keychain"
          security import "$RUNNER_TEMP/certificate.p12" \
            -k "$RUNNER_TEMP/build.keychain" \
            -P "$P12_PASSWORD" \
            -T /usr/bin/codesign \
            -T /usr/bin/pkgbuild
          security set-key-partition-list \
            -S apple-tool:,apple:,codesign: \
            -s \
            -k "$KEYCHAIN_PASSWORD" \
            "$RUNNER_TEMP/build.keychain"
          security list-keychain -d user -s "$RUNNER_TEMP/build.keychain"
          xcrun notarytool store-credentials "notarytool" \
            --apple-id "hello@cirruslabs.org" \
            --team-id "9M2P8L4D89" \
            --password "$AC_PASSWORD" \
            --keychain "$RUNNER_TEMP/build.keychain"
      - name: Create release app token for this repo
        id: app-token
        uses: actions/create-github-app-token@1b10c78c7865c340bc4f6099eb2f838309f1e8c3 # v3.1.1
        with:
          app-id: ${{ secrets.RELEASE_APP_ID }}
          private-key: ${{ secrets.RELEASE_APP_PRIVATE_KEY }}
          permission-contents: write
      - name: Create release app token for homebrew-tools
        id: tap-token
        uses: actions/create-github-app-token@1b10c78c7865c340bc4f6099eb2f838309f1e8c3 # v3.1.1
        with:
          app-id: ${{ secrets.RELEASE_APP_ID }}
          private-key: ${{ secrets.RELEASE_APP_PRIVATE_KEY }}
          owner: openai
          repositories: homebrew-tools
          permission-contents: write
          permission-pull-requests: write
      - name: Release
        uses: goreleaser/goreleaser-action@f06c13b6b1a9625abc9e6e439d9c05a8f2190e94 # v7
        with:
          distribution: goreleaser-pro
          version: "~> v2"
          args: release --clean
        env:
          GORELEASER_KEY: ${{ secrets.GORELEASER_KEY }}
          GITHUB_TOKEN: ${{ steps.app-token.outputs.token }}
          HOMEBREW_TAP_GITHUB_TOKEN: ${{ steps.tap-token.outputs.token }}

  snapshot:
    if: github.event_name == 'workflow_dispatch'
    name: Release (Dry Run)
    runs-on: macos-26
    timeout-minutes: 90
    permissions:
      contents: read
    env:
      TART_RELEASE_SNAPSHOT: "true"
      VERSION: snapshot
    steps:
      - name: Checkout
        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
        with:
          fetch-depth: 0
          persist-credentials: false
      - name: Build snapshot
        uses: goreleaser/goreleaser-action@f06c13b6b1a9625abc9e6e439d9c05a8f2190e94 # v7
        with:
          distribution: goreleaser-pro
          version: "~> v2"
          args: release --skip=publish --snapshot --clean
      - name: Upload snapshot artifacts
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        with:
          name: tart-snapshot
          path: dist/*