python-app.yml

name: Build Application

on:
  schedule:
    # * is a special character in YAML so you have to quote this string
    - cron: "21 1 * * 1"
  workflow_dispatch: # allow manual trigger
  push:
    tags:
      - "*.*.*"

jobs:
  build-application:
    runs-on: ${{ matrix.os }}

    strategy:
      matrix:
        include:
          - os: macos-latest
            NAME: MacOS

          - os: windows-latest
            NAME: Windows

          - os: ubuntu-22.04
            NAME: Ubuntu

    permissions:
      contents: read

    steps:
      - name: macOS Notarize -- Install Certificates
        if: ${{ matrix.NAME == 'MacOS' }}
        run: |
          echo ${{ secrets.CERTIFICATE_P12 }} | base64 --decode > certificate.p12
          security import certificate.p12 -P ${{ secrets.CERTIFICATE_PASSWORD }}
          security create-keychain -p fgKeychain fg.keychain
          security default-keychain -s fg.keychain
          security set-keychain-settings -l -u -t 8000
          security unlock-keychain -p fgKeychain fg.keychain
          security import certificate.p12 -k fg.keychain -P ${{ secrets.CERTIFICATE_PASSWORD }} -T /usr/bin/codesign
          security set-key-partition-list -S apple-tool:,apple:,codesign: -s -k fgKeychain fg.keychain
          rm -fr *.p12
          # security find-identity -v -p codesigning

      - name: Git checkout
        uses: actions/checkout@v6

      - name: Set up Node.js
        uses: actions/setup-node@v6
        with:
          node-version: 20.x
          cache: "npm"

      - name: Set up Python 3.13
        uses: actions/setup-python@v6
        with:
          python-version: "3.13"

      - name: Patch requirements.txt
        if: github.ref_type == 'tag'
        run: |
          python scripts/patch_requirements.py ${{ github.ref_name }}

      - name: Install dependencies
        run: |
          python -m pip install --upgrade pip
          pip install -r requirements.txt | tee pip_log.txt
          pip install -r requirements-dev.txt

      - name: Make and install universal wheels
        if: ${{ matrix.NAME == 'MacOS' }}
        run: |
          python macos/ensure_universal_wheels.py pip_log.txt
          pip install --force build/universal_wheels/*.whl

      - name: Build app with PyInstaller
        run: |
          pyinstaller FontraPak.spec -y

      - name: Run tests
        run: |
          pytest

      - name: macOS Notarize -- Codesign and Notarize
        if: ${{ matrix.NAME == 'MacOS' }}
        run: |
          APP_PATH="dist/Fontra Pak.app"
          DMG_PATH="dist/FontraPak-${{ matrix.NAME }}.dmg"

          macos/codesign_app.sh "${{ secrets.CODESIGN_NAME }}" "$APP_PATH" macos/entitlements.plist
          python macos/build_dmg.py "$APP_PATH" "$DMG_PATH"

          codesign --sign "${{ secrets.CODESIGN_NAME }}" "$DMG_PATH"

          echo "Run notarytool..."

          xcrun notarytool submit \
            --apple-id "${{ secrets.NOTARIZE_DEVELOPER }}" \
            --team-id "${{ secrets.NOTARIZE_TEAM_ID }}" \
            --password "${{ secrets.NOTARIZE_PASSWORD }}" \
            --output-format json \
            --wait \
            $DMG_PATH \
            | python macos/print_notarize_log.py \
              "${{ secrets.NOTARIZE_DEVELOPER }}" \
              "${{ secrets.NOTARIZE_TEAM_ID }}" \
              "${{ secrets.NOTARIZE_PASSWORD }}"

          xcrun stapler staple "$DMG_PATH"

      - name: Archive executable with tar
        if: ${{ matrix.NAME != 'MacOS' && matrix.NAME != 'Windows' }}
        run: |
          cd ./dist
          tar -czvf FontraPak-${{ matrix.NAME }}.tgz fontrapak

      - name: Storing Artifacts
        uses: actions/upload-artifact@v7
        with:
          name: FontraPak-${{ matrix.NAME }}
          path: |
            ./dist/*.dmg
            ./dist/*.exe
            ./dist/*.tgz

  windows-installer:
    needs: build-application
    runs-on: windows-latest

    steps:
      - name: Git checkout
        uses: actions/checkout@v6

      - name: Extract version from tag
        if: github.ref_type == 'tag'
        run: echo "VERSION=${{ github.ref_name }}" >> $env:GITHUB_ENV

      - name: Set dev version
        if: github.ref_type != 'tag'
        run: echo "VERSION=0.0.0" >> $env:GITHUB_ENV

      - name: Download Windows exe
        uses: actions/download-artifact@v8
        with:
          name: FontraPak-Windows
          path: dist

      - name: Install WiX v6
        run: dotnet tool install --global wix --version 6.0.2

      - name: Add WiX UI extension
        run: wix extension add --global WixToolset.UI.wixext/6.0.2

      - name: Compile MSI
        run: |
          Set-Location windows
          wix build Product.wxs -arch x64 -d "Version=${{ env.VERSION }}" -ext WixToolset.UI.wixext -o "$env:GITHUB_WORKSPACE\dist\FontraPak-Windows-Installer.msi"

      - name: Storing Windows MSI artifact
        uses: actions/upload-artifact@v7
        with:
          name: FontraPak-Windows-Installer
          path: dist/*.msi

  create-github-release:
    runs-on: ubuntu-latest

    permissions:
      contents: write

    needs: [build-application, windows-installer]
    if: github.ref_type == 'tag'

    steps:

      - name: Git checkout
        uses: actions/checkout@v6

      - name: Set up Python
        uses: actions/setup-python@v6
        with:
          python-version: '3.x'

      - name: Retrieve Artifact
        uses: actions/download-artifact@v8
        with:
          path: ./downloaded-artifact

      - name: Zip Windows .exe
        run: |
          cd ./downloaded-artifact/FontraPak-Windows
          zip -r FontraPak-Windows.zip "Fontra Pak.exe"

      - name: Display structure of downloaded files
        run: ls -R
        working-directory: ./downloaded-artifact

      - name: Extract Latest Changes
        run: |
          python scripts/extract_latest_changes.py > tmp_latest_changes.txt

      - name: Create GitHub Release
        uses: softprops/action-gh-release@v3
        with:
          draft: false
          body_path: 'tmp_latest_changes.txt'
          token: ${{ secrets.GITHUB_TOKEN }}
          files: |
            ./downloaded-artifact/FontraPak-MacOS/*.dmg
            ./downloaded-artifact/FontraPak-Windows-Installer/*.msi
            ./downloaded-artifact/FontraPak-Windows/*.zip
            ./downloaded-artifact/FontraPak-Ubuntu/*.tgz

      - name: Update website / Repository Dispatch
        uses: peter-evans/repository-dispatch@v4
        with:
          token: ${{ secrets.WEBSITE_PAT }}
          repository: fontra/fontra-website
          event-type: release-event

      - name: Update flatpak / Repository Dispatch
        uses: peter-evans/repository-dispatch@v4
        with:
          token: ${{ secrets.FLATPAK_PAT }}
          repository: fontra/fontra-flatpak
          event-type: release-event