buzz/.github/workflows/bundle.yml

---
name: Bundle
on:
  push:
    branches:
      - main
    tags:
      - '*'
  pull_request:

concurrency:
  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
  cancel-in-progress: true

jobs:
  windows-latest:
    runs-on: windows-latest
    steps:
      - uses: actions/checkout@v3
        with:
          submodules: recursive
      - uses: actions/setup-python@v4
        with:
          python-version: '3.10.7'

      - name: Install Poetry Action
        uses: snok/install-poetry@v1.3.1
        with:
          virtualenvs-create: true
          virtualenvs-in-project: true

      - name: Load cached venv
        id: cached-poetry-dependencies
        uses: actions/cache@v3
        with:
          path: .venv
          key: venv-${{ runner.os }}-${{ hashFiles('**/poetry.lock') }}-2

      - uses: FedericoCarboni/setup-ffmpeg@v1
        id: setup-ffmpeg
        with:
          token: ${{ secrets.GITHUB_TOKEN }}

      - name: Install dependencies
        run: poetry config experimental.new-installer false && poetry install

      - name: Bundle
        run: poetry run make bundle_windows

      - uses: actions/upload-artifact@v3
        with:
          name: Buzz-Windows
          path: |
            dist/Buzz*-windows.tar.gz
            dist/Buzz*-windows.exe

  macos-latest:
    runs-on: macos-latest
    strategy:
      fail-fast: false
      matrix:
        cpu: [ intel, arm ]
    steps:
      - uses: actions/checkout@v3
        with:
          submodules: recursive
      - uses: actions/setup-python@v4
        with:
          python-version: '3.10.7'

      - name: Install Poetry Action
        uses: snok/install-poetry@v1.3.1
        with:
          virtualenvs-create: true
          virtualenvs-in-project: true

      - name: Load cached venv
        id: cached-poetry-dependencies
        uses: actions/cache@v3
        with:
          path: .venv
          key: venv-${{ runner.os }}-${{ hashFiles('**/poetry.lock') }}-2

      - uses: FedericoCarboni/setup-ffmpeg@v1
        id: setup-ffmpeg
        with:
          token: ${{ secrets.GITHUB_TOKEN }}

      - name: Install dependencies
        run: poetry config experimental.new-installer false && poetry install

      - name: Bundle
        run: |
          brew install create-dmg
          
          # create variables
          CERTIFICATE_PATH=$RUNNER_TEMP/build_certificate.p12
          KEYCHAIN_PATH=$RUNNER_TEMP/app-signing.keychain-db
          
          # import certificate and provisioning profile from secrets
          echo -n "$BUILD_CERTIFICATE_BASE64" | base64 --decode --output $CERTIFICATE_PATH
          
          # create temporary keychain
          security create-keychain -p "$KEYCHAIN_PASSWORD" $KEYCHAIN_PATH
          security set-keychain-settings -lut 21600 $KEYCHAIN_PATH
          security unlock-keychain -p "$KEYCHAIN_PASSWORD" $KEYCHAIN_PATH
          
          # import certificate to keychain
          security import $CERTIFICATE_PATH -P "$P12_PASSWORD" -A -t cert -f pkcs12 -k $KEYCHAIN_PATH
          security list-keychain -d user -s $KEYCHAIN_PATH
          
          # store notarytool credentials
          xcrun notarytool store-credentials --apple-id "$APPLE_ID" --password "$APPLE_APP_PASSWORD" --team-id "$APPLE_TEAM_ID" notarytool --validate
          
          if [[ ${{ matrix.cpu }} == "intel" ]]; then
            poetry run make test;
          else 
            poetry run make whisper_cpp CMAKE_FLAGS="-DWHISPER_NO_AVX=ON -DWHISPER_NO_AVX2=ON -DWHISPER_NO_FMA=ON";
          fi
          
          poetry run make bundle_mac
        env:
          BUZZ_CODESIGN_IDENTITY: ${{ secrets.BUZZ_CODESIGN_IDENTITY }}
          BUZZ_KEYCHAIN_NOTARY_PROFILE: ${{ secrets.BUZZ_KEYCHAIN_NOTARY_PROFILE }}
          BUILD_CERTIFICATE_BASE64: ${{ secrets.BUILD_CERTIFICATE_BASE64 }}
          KEYCHAIN_PASSWORD: ${{ secrets.KEYCHAIN_PASSWORD }}
          P12_PASSWORD: ${{ secrets.P12_PASSWORD }}
          APPLE_ID: ${{ secrets.APPLE_ID }}
          APPLE_APP_PASSWORD: ${{ secrets.APPLE_APP_PASSWORD }}
          APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}

      - uses: actions/upload-artifact@v3
        with:
          name: Buzz-${{ runner.os }}-${{ matrix.cpu }}
          path: |
            dist/Buzz*-mac.dmg

  release:
    runs-on: ${{ matrix.os }}
    strategy:
      fail-fast: false
      matrix:
        os: [ macos-latest, windows-latest ]
    needs: [ build, test ] # TODO
    if: startsWith(github.ref, 'refs/tags/')
    steps:
      - uses: actions/checkout@v3
        with:
          submodules: recursive
      - uses: actions/download-artifact@v3
        with:
          name: Buzz-${{ runner.os }}
      - name: Install Poetry Action
        uses: snok/install-poetry@v1.3.1
        with:
          virtualenvs-create: true
          virtualenvs-in-project: true
      - name: Release
        uses: softprops/action-gh-release@v1
        with:
          files: |
            Buzz*-windows.tar.gz
            Buzz*-windows.exe
            Buzz*-mac.dmg

  deploy_brew_cask:
    runs-on: macos-latest
    needs: [ release ]
    if: startsWith(github.ref, 'refs/tags/')
    steps:
      - uses: actions/checkout@v3
        with:
          submodules: recursive
      - name: Install Poetry Action
        uses: snok/install-poetry@v1.3.1
        with:
          virtualenvs-create: true
          virtualenvs-in-project: true
      - name: Upload to Brew
        run: make upload_brew
        env:
          HOMEBREW_GITHUB_API_TOKEN: ${{ secrets.HOMEBREW_GITHUB_API_TOKEN }}