name: Release

on:
  push:
    tags:
      - "v*.*.*"
      - "v*.*.*-*"
  workflow_dispatch:
    inputs:
      tag:
        description: "Tag to release, for example v0.9.2 or v0.9.2-beta.1"
        required: true
        type: string

permissions:
  contents: write

concurrency:
  group: release-${{ github.event.inputs.tag || github.ref_name }}
  cancel-in-progress: false

env:
  PROJECT_NAME: MacTools
  SCHEME: MacTools
  DERIVED_DATA: build/DerivedData
  ARTIFACT_DIR: build/release

jobs:
  release:
    name: Build, sign, notarize, and release
    runs-on: macos-26
    timeout-minutes: 60

    steps:
      - name: Checkout
        uses: actions/checkout@v5
        with:
          ref: ${{ github.event.inputs.tag || github.ref }}
          fetch-depth: 0

      - name: Set release metadata
        run: |
          TAG="${{ github.event.inputs.tag || github.ref_name }}"
          if [[ ! "$TAG" =~ ^v[0-9]+\.[0-9]+\.[0-9]+([.-][0-9A-Za-z.-]+)?$ ]]; then
            echo "Release tag must look like v1.2.3 or v1.2.3-beta.1" >&2
            exit 1
          fi

          VERSION="$(awk '$1 == "MARKETING_VERSION" && $2 == "=" { print $3; exit }' Configs/AppVersion.xcconfig)"
          BUILD_NUMBER="$(awk '$1 == "CURRENT_PROJECT_VERSION" && $2 == "=" { print $3; exit }' Configs/AppVersion.xcconfig)"
          TAG_VERSION="${TAG#v}"

          if [[ -z "$VERSION" || -z "$BUILD_NUMBER" ]]; then
            echo "MARKETING_VERSION and CURRENT_PROJECT_VERSION must be set in Configs/AppVersion.xcconfig" >&2
            exit 1
          fi
          if [[ "$TAG_VERSION" != "$VERSION" ]]; then
            echo "Release tag $TAG does not match Configs/AppVersion.xcconfig MARKETING_VERSION $VERSION" >&2
            exit 1
          fi
          if [[ ! "$BUILD_NUMBER" =~ ^[0-9]+$ ]]; then
            echo "Configs/AppVersion.xcconfig CURRENT_PROJECT_VERSION must be numeric" >&2
            exit 1
          fi

          PRERELEASE="false"
          if [[ "$VERSION" == *"-"* || "$VERSION" == *"beta"* || "$VERSION" == *"alpha"* || "$VERSION" == *"rc"* ]]; then
            PRERELEASE="true"
          fi

          {
            echo "TAG=$TAG"
            echo "VERSION=$VERSION"
            echo "BUILD_NUMBER=$BUILD_NUMBER"
            echo "PRERELEASE=$PRERELEASE"
            echo "DMG_PATH=${ARTIFACT_DIR}/${TAG}/${PROJECT_NAME}.dmg"
            echo "SHA256_PATH=${ARTIFACT_DIR}/${TAG}/${PROJECT_NAME}.sha256"
          } >> "$GITHUB_ENV"

      - name: Validate required secrets
        env:
          APPLE_DEVELOPMENT_TEAM: ${{ secrets.APPLE_DEVELOPMENT_TEAM }}
          BUNDLE_IDENTIFIER_PREFIX: ${{ secrets.BUNDLE_IDENTIFIER_PREFIX }}
          DEVELOPER_ID_CERT_P12: ${{ secrets.DEVELOPER_ID_CERT_P12 }}
          DEVELOPER_ID_CERT_PASSWORD: ${{ secrets.DEVELOPER_ID_CERT_PASSWORD }}
          ASC_API_KEY_P8_BASE64: ${{ secrets.ASC_API_KEY_P8_BASE64 }}
          ASC_API_KEY_ID: ${{ secrets.ASC_API_KEY_ID }}
          ASC_API_ISSUER_ID: ${{ secrets.ASC_API_ISSUER_ID }}
          SPARKLE_PRIVATE_KEY: ${{ secrets.SPARKLE_PRIVATE_KEY }}
        run: |
          missing=0
          for name in \
            APPLE_DEVELOPMENT_TEAM \
            BUNDLE_IDENTIFIER_PREFIX \
            DEVELOPER_ID_CERT_P12 \
            DEVELOPER_ID_CERT_PASSWORD \
            ASC_API_KEY_P8_BASE64 \
            ASC_API_KEY_ID \
            ASC_API_ISSUER_ID \
            SPARKLE_PRIVATE_KEY; do
            if [[ -z "${!name}" ]]; then
              echo "Missing required secret: $name" >&2
              missing=1
            fi
          done
          exit "$missing"

      - name: Show Xcode version
        run: xcodebuild -version

      - name: Install XcodeGen
        run: |
          if ! command -v xcodegen >/dev/null 2>&1; then
            brew install xcodegen
          fi

      - name: Write release local config
        env:
          APPLE_DEVELOPMENT_TEAM: ${{ secrets.APPLE_DEVELOPMENT_TEAM }}
          BUNDLE_IDENTIFIER_PREFIX: ${{ secrets.BUNDLE_IDENTIFIER_PREFIX }}
        run: |
          umask 077
          cat > LocalConfig.xcconfig <<EOF
          DEVELOPMENT_TEAM = ${APPLE_DEVELOPMENT_TEAM}
          BUNDLE_IDENTIFIER_PREFIX = ${BUNDLE_IDENTIFIER_PREFIX}
          EOF

      - name: Import Developer ID certificate
        env:
          DEVELOPER_ID_CERT_P12: ${{ secrets.DEVELOPER_ID_CERT_P12 }}
          DEVELOPER_ID_CERT_PASSWORD: ${{ secrets.DEVELOPER_ID_CERT_PASSWORD }}
        run: |
          CERT_PATH="$RUNNER_TEMP/developer-id.p12"
          KEYCHAIN_PATH="$RUNNER_TEMP/build.keychain-db"
          KEYCHAIN_PASSWORD="$(openssl rand -hex 24)"

          echo "$DEVELOPER_ID_CERT_P12" | base64 --decode > "$CERT_PATH"

          security create-keychain -p "$KEYCHAIN_PASSWORD" "$KEYCHAIN_PATH"
          security set-keychain-settings -lut 21600 "$KEYCHAIN_PATH"
          security unlock-keychain -p "$KEYCHAIN_PASSWORD" "$KEYCHAIN_PATH"
          security import "$CERT_PATH" \
            -k "$KEYCHAIN_PATH" \
            -P "$DEVELOPER_ID_CERT_PASSWORD" \
            -T /usr/bin/codesign \
            -T /usr/bin/security
          security set-key-partition-list \
            -S apple-tool:,apple:,codesign: \
            -s \
            -k "$KEYCHAIN_PASSWORD" \
            "$KEYCHAIN_PATH"
          security list-keychains -d user -s "$KEYCHAIN_PATH"

          SIGNING_IDENTITY="$(security find-identity -v -p codesigning "$KEYCHAIN_PATH" | awk -F'"' '/Developer ID Application/ { print $2; exit }')"
          if [[ -z "$SIGNING_IDENTITY" ]]; then
            echo "Developer ID Application identity was not found in imported certificate." >&2
            exit 1
          fi

          rm -f "$CERT_PATH"
          echo "KEYCHAIN_PATH=$KEYCHAIN_PATH" >> "$GITHUB_ENV"
          echo "SIGNING_IDENTITY=$SIGNING_IDENTITY" >> "$GITHUB_ENV"

      - name: Generate Xcode project
        run: make generate

      - name: Build unsigned Release app
        run: |
          ./scripts/xcodebuild-filtered.sh \
            -project "${PROJECT_NAME}.xcodeproj" \
            -scheme "${SCHEME}" \
            -configuration Release \
            -destination "generic/platform=macOS" \
            -derivedDataPath "${DERIVED_DATA}" \
            MARKETING_VERSION="${VERSION}" \
            CURRENT_PROJECT_VERSION="${BUILD_NUMBER}" \
            CODE_SIGNING_ALLOWED=NO \
            CODE_SIGNING_REQUIRED=NO \
            CODE_SIGN_IDENTITY= \
            build \
            -quiet

      - name: Sign app bundle
        run: |
          APP_PATH="${DERIVED_DATA}/Build/Products/Release/${PROJECT_NAME}.app"
          ENTITLEMENTS="Configs/MacTools.entitlements"
          FINDER_SYNC_ENTITLEMENTS="Sources/Extensions/RightClickFinderSync/RightClickFinderSync.entitlements"
          SPARKLE_FRAMEWORK="$APP_PATH/Contents/Frameworks/Sparkle.framework"
          SPARKLE_CURRENT="$SPARKLE_FRAMEWORK/Versions/Current"

          sign_path() {
            /usr/bin/codesign \
              --force \
              --sign "$SIGNING_IDENTITY" \
              --keychain "$KEYCHAIN_PATH" \
              --options runtime \
              --timestamp \
              "$1"
          }

          sign_path_with_entitlements() {
            /usr/bin/codesign \
              --force \
              --sign "$SIGNING_IDENTITY" \
              --keychain "$KEYCHAIN_PATH" \
              --options runtime \
              --timestamp \
              --entitlements "$2" \
              "$1"
          }

          sign_path_preserving_entitlements() {
            /usr/bin/codesign \
              --force \
              --sign "$SIGNING_IDENTITY" \
              --keychain "$KEYCHAIN_PATH" \
              --options runtime \
              --timestamp \
              --preserve-metadata=entitlements \
              "$1"
          }

          if [[ -d "$SPARKLE_FRAMEWORK" ]]; then
            if [[ -d "$SPARKLE_CURRENT/XPCServices/Installer.xpc" ]]; then
              sign_path "$SPARKLE_CURRENT/XPCServices/Installer.xpc"
            fi
            if [[ -d "$SPARKLE_CURRENT/XPCServices/Downloader.xpc" ]]; then
              sign_path_preserving_entitlements "$SPARKLE_CURRENT/XPCServices/Downloader.xpc"
            fi
            if [[ -f "$SPARKLE_CURRENT/Autoupdate" ]]; then
              sign_path "$SPARKLE_CURRENT/Autoupdate"
            fi
            if [[ -d "$SPARKLE_CURRENT/Updater.app" ]]; then
              sign_path "$SPARKLE_CURRENT/Updater.app"
            fi
          fi

          while IFS= read -r binary; do
            [[ -n "$binary" ]] || continue
            sign_path "$binary"
          done < <(find "$APP_PATH/Contents" -type f \( -name "*.dylib" -o -name "*.so" \) -print)

          while IFS= read -r bundle; do
            [[ -n "$bundle" ]] || continue
            if [[ "$bundle" == *"/Sparkle.framework" || "$bundle" == *"/Sparkle.framework/"* ]]; then
              continue
            fi
            if [[ "$(basename "$bundle")" == "RightClickFinderSync.appex" ]]; then
              sign_path_with_entitlements "$bundle" "$FINDER_SYNC_ENTITLEMENTS"
            else
              sign_path "$bundle"
            fi
          done < <(find "$APP_PATH/Contents" -depth -type d \( -name "*.framework" -o -name "*.app" -o -name "*.xpc" -o -name "*.appex" \) -print)

          if [[ -d "$SPARKLE_FRAMEWORK" ]]; then
            sign_path "$SPARKLE_FRAMEWORK"
          fi

          /usr/bin/codesign \
            --force \
            --sign "$SIGNING_IDENTITY" \
            --keychain "$KEYCHAIN_PATH" \
            --options runtime \
            --timestamp \
            --entitlements "$ENTITLEMENTS" \
            "$APP_PATH"

          FINDER_SYNC_APPEX="$APP_PATH/Contents/PlugIns/RightClickFinderSync.appex"
          FINDER_SYNC_EXTENSION_POINT="$(/usr/libexec/PlistBuddy -c "Print :NSExtension:NSExtensionPointIdentifier" "$FINDER_SYNC_APPEX/Contents/Info.plist")"
          if [[ "$FINDER_SYNC_EXTENSION_POINT" != "com.apple.FinderSync" ]]; then
            echo "Finder Sync extension point is invalid: $FINDER_SYNC_EXTENSION_POINT" >&2
            exit 1
          fi
          FINDER_SYNC_SIGNED_ENTITLEMENTS="$(/usr/bin/codesign -d --entitlements :- "$FINDER_SYNC_APPEX" 2>/dev/null || true)"
          if [[ "$FINDER_SYNC_SIGNED_ENTITLEMENTS" != *"com.apple.security.app-sandbox"* ]]; then
            echo "Finder Sync extension is missing app sandbox entitlement" >&2
            exit 1
          fi
          if [[ "$FINDER_SYNC_SIGNED_ENTITLEMENTS" != *"com.apple.security.temporary-exception.files.home-relative-path.read-only"* ]]; then
            echo "Finder Sync extension is missing right-click config read entitlement" >&2
            exit 1
          fi

          /usr/bin/codesign --verify --deep --strict --verbose=2 "$APP_PATH"

      - name: Create and sign DMG
        env:
          BUNDLE_IDENTIFIER_PREFIX: ${{ secrets.BUNDLE_IDENTIFIER_PREFIX }}
        run: |
          APP_PATH="${DERIVED_DATA}/Build/Products/Release/${PROJECT_NAME}.app"
          STAGE_DIR="$(mktemp -d "${RUNNER_TEMP}/mactools-dmg.XXXXXX")"
          mkdir -p "$(dirname "$DMG_PATH")"

          ditto "$APP_PATH" "$STAGE_DIR/${PROJECT_NAME}.app"
          ln -s /Applications "$STAGE_DIR/Applications"

          hdiutil create \
            -volname "$PROJECT_NAME" \
            -srcfolder "$STAGE_DIR" \
            -ov \
            -format UDZO \
            "$DMG_PATH" >/dev/null

          /bin/rm -rf "$STAGE_DIR"

          /usr/bin/codesign \
            --force \
            --sign "$SIGNING_IDENTITY" \
            --keychain "$KEYCHAIN_PATH" \
            --timestamp \
            --identifier "${BUNDLE_IDENTIFIER_PREFIX}.mactools.disk-image" \
            "$DMG_PATH"

          /usr/bin/codesign --verify --verbose=2 "$DMG_PATH"

      - name: Notarize and staple DMG
        env:
          ASC_API_KEY_P8_BASE64: ${{ secrets.ASC_API_KEY_P8_BASE64 }}
          ASC_API_KEY_ID: ${{ secrets.ASC_API_KEY_ID }}
          ASC_API_ISSUER_ID: ${{ secrets.ASC_API_ISSUER_ID }}
        run: |
          API_KEY_PATH="$RUNNER_TEMP/AuthKey_${ASC_API_KEY_ID}.p8"
          echo "$ASC_API_KEY_P8_BASE64" | base64 --decode > "$API_KEY_PATH"

          xcrun notarytool submit "$DMG_PATH" \
            --key "$API_KEY_PATH" \
            --key-id "$ASC_API_KEY_ID" \
            --issuer "$ASC_API_ISSUER_ID" \
            --wait \
            --timeout 30m

          xcrun stapler staple "$DMG_PATH"
          spctl -a -t open --context context:primary-signature -v "$DMG_PATH"
          rm -f "$API_KEY_PATH"

      - name: Compute SHA256
        run: |
          shasum -a 256 "$DMG_PATH" | tee "$SHA256_PATH"

      - name: Extract release notes from CHANGELOG
        run: |
          RELEASE_NOTES="$RUNNER_TEMP/release-notes.md"
          HIGHLIGHTS_PATH=".github/release-highlights/${TAG}.md"
          GENERATED_NOTES="$RUNNER_TEMP/release-notes.generated.md"

          python3 scripts/changelog.py extract \
            --tag "$TAG" \
            --output "$GENERATED_NOTES"

          if [[ -f "$HIGHLIGHTS_PATH" ]]; then
            cat "$HIGHLIGHTS_PATH" > "$RELEASE_NOTES"
            printf '\n\n' >> "$RELEASE_NOTES"
            cat "$GENERATED_NOTES" >> "$RELEASE_NOTES"
          else
            cat "$GENERATED_NOTES" > "$RELEASE_NOTES"
          fi

          SPARKLE_RELEASE_NOTES="$RUNNER_TEMP/sparkle-release-notes.md"
          python3 scripts/changelog.py compose-sparkle \
            --tag "$TAG" \
            --app-notes "$RELEASE_NOTES" \
            --output "$SPARKLE_RELEASE_NOTES"

          {
            echo "RELEASE_NOTES_PATH=$RELEASE_NOTES"
            echo "SPARKLE_RELEASE_NOTES_PATH=$SPARKLE_RELEASE_NOTES"
          } >> "$GITHUB_ENV"

      - name: Generate Sparkle appcast
        env:
          SPARKLE_PRIVATE_KEY: ${{ secrets.SPARKLE_PRIVATE_KEY }}
        run: |
          SIGN_UPDATE="${DERIVED_DATA}/SourcePackages/artifacts/sparkle/Sparkle/bin/sign_update"
          if [[ ! -x "$SIGN_UPDATE" ]]; then
            SIGN_UPDATE="$(find "${DERIVED_DATA}/SourcePackages" -path "*/Sparkle/bin/sign_update" -type f -perm -111 | head -n 1)"
          fi
          if [[ -z "$SIGN_UPDATE" || ! -x "$SIGN_UPDATE" ]]; then
            echo "Sparkle sign_update tool was not found." >&2
            exit 1
          fi

          SPARKLE_KEY_PATH="$RUNNER_TEMP/sparkle_ed25519_key"
          printf '%s' "$SPARKLE_PRIVATE_KEY" > "$SPARKLE_KEY_PATH"
          SIGN_OUTPUT="$("$SIGN_UPDATE" "$DMG_PATH" --ed-key-file "$SPARKLE_KEY_PATH")"
          rm -f "$SPARKLE_KEY_PATH"

          ED_SIGNATURE="$(printf '%s' "$SIGN_OUTPUT" | sed -n 's/.*sparkle:edSignature="\([^"]*\)".*/\1/p')"
          if [[ -z "$ED_SIGNATURE" ]]; then
            echo "Failed to extract Sparkle EdDSA signature." >&2
            exit 1
          fi

          FILE_SIZE="$(stat -f '%z' "$DMG_PATH")"
          DOWNLOAD_URL="https://github.com/${GITHUB_REPOSITORY}/releases/download/${TAG}/${PROJECT_NAME}.dmg"
          RELEASE_NOTES_URL="https://github.com/${GITHUB_REPOSITORY}/releases/tag/${TAG}"
          FULL_RELEASE_NOTES_URL="https://github.com/${GITHUB_REPOSITORY}/releases"
          PUB_DATE="$(LC_ALL=C date -u '+%a, %d %b %Y %H:%M:%S +0000')"
          MINIMUM_SYSTEM_VERSION="14.0"
          export ED_SIGNATURE FILE_SIZE DOWNLOAD_URL RELEASE_NOTES_URL FULL_RELEASE_NOTES_URL PUB_DATE MINIMUM_SYSTEM_VERSION

          python3 <<'PY_APPCAST'
          import os
          import xml.sax.saxutils as xml
          from pathlib import Path

          values = {
              key: os.environ[key]
              for key in [
                  "PROJECT_NAME",
                  "VERSION",
                  "BUILD_NUMBER",
                  "DOWNLOAD_URL",
                  "RELEASE_NOTES_URL",
                  "FULL_RELEASE_NOTES_URL",
                  "PUB_DATE",
                  "FILE_SIZE",
                  "ED_SIGNATURE",
                  "MINIMUM_SYSTEM_VERSION",
              ]
          }
          release_notes = Path(os.environ["SPARKLE_RELEASE_NOTES_PATH"]).read_text(encoding="utf-8")
          cdata_release_notes = release_notes.replace("]]>", "]]]]><![CDATA[>")

          content = f'''<?xml version="1.0" encoding="utf-8"?>
          <rss version="2.0" xmlns:sparkle="http://www.andymatuschak.org/xml-namespaces/sparkle" xmlns:dc="http://purl.org/dc/elements/1.1/">
              <channel>
                  <title>{xml.escape(values["PROJECT_NAME"])} Releases</title>
                  <description>Latest release metadata for {xml.escape(values["PROJECT_NAME"])}.</description>
                  <language>en</language>
                  <item>
                      <title>Version {xml.escape(values["VERSION"])}</title>
                      <link>{xml.escape(values["RELEASE_NOTES_URL"])}</link>
                      <sparkle:version>{xml.escape(values["BUILD_NUMBER"])}</sparkle:version>
                      <sparkle:shortVersionString>{xml.escape(values["VERSION"])}</sparkle:shortVersionString>
                      <description sparkle:format="markdown"><![CDATA[{cdata_release_notes}]]></description>
                      <sparkle:fullReleaseNotesLink>{xml.escape(values["FULL_RELEASE_NOTES_URL"])}</sparkle:fullReleaseNotesLink>
                      <pubDate>{xml.escape(values["PUB_DATE"])}</pubDate>
                      <enclosure url="{xml.escape(values["DOWNLOAD_URL"])}" length="{xml.escape(values["FILE_SIZE"])}" type="application/octet-stream" sparkle:edSignature="{xml.escape(values["ED_SIGNATURE"])}" />
                      <sparkle:minimumSystemVersion>{xml.escape(values["MINIMUM_SYSTEM_VERSION"])}</sparkle:minimumSystemVersion>
                  </item>
              </channel>
          </rss>
          '''
          Path("docs/appcast.xml").write_text(content, encoding="utf-8")
          PY_APPCAST

          python3 -c 'import xml.etree.ElementTree as ET; ET.parse("docs/appcast.xml")'

      - name: Upload notarized DMG artifact
        uses: actions/upload-artifact@v4
        with:
          name: MacTools-${{ env.TAG }}
          path: |
            ${{ env.DMG_PATH }}
            ${{ env.SHA256_PATH }}
          if-no-files-found: error
          retention-days: 30

      - name: Create or update GitHub Release
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          RELEASE_ARGS=(--title "${PROJECT_NAME} ${VERSION}" --notes-file "$RELEASE_NOTES_PATH")
          if [[ "$PRERELEASE" == "true" ]]; then
            RELEASE_ARGS+=(--prerelease)
          fi

          if gh release view "$TAG" >/dev/null 2>&1; then
            gh release upload "$TAG" "$DMG_PATH#${PROJECT_NAME}.dmg" "$SHA256_PATH#${PROJECT_NAME}.sha256" --clobber
            gh release edit "$TAG" "${RELEASE_ARGS[@]}"
          else
            gh release create "$TAG" "$DMG_PATH#${PROJECT_NAME}.dmg" "$SHA256_PATH#${PROJECT_NAME}.sha256" "${RELEASE_ARGS[@]}"
          fi

      - name: Open Homebrew tap update PR
        env:
          HOMEBREW_GITHUB_API_TOKEN: ${{ secrets.HOMEBREW_GITHUB_API_TOKEN }}
        run: |
          TAP_REPOSITORY="ggbond268/homebrew-mactools"

          if [[ "$PRERELEASE" == "true" ]]; then
            echo "Skipping Homebrew tap update for prerelease ${TAG}."
            exit 0
          fi

          if [[ -z "$HOMEBREW_GITHUB_API_TOKEN" ]]; then
            echo "Skipping Homebrew tap update because HOMEBREW_GITHUB_API_TOKEN is not configured."
            exit 0
          fi

          export GH_TOKEN="$HOMEBREW_GITHUB_API_TOKEN"

          SHA256="$(awk '{ print $1; exit }' "$SHA256_PATH")"
          if [[ -z "$SHA256" ]]; then
            echo "Unable to read SHA256 from ${SHA256_PATH}." >&2
            exit 1
          fi
          DOWNLOAD_URL="https://github.com/${GITHUB_REPOSITORY}/releases/download/${TAG}/${PROJECT_NAME}.dmg"
          export SHA256 DOWNLOAD_URL
          TAP_DIR="$(mktemp -d)"
          BRANCH="update-mactools-${VERSION}"

          gh repo clone "$TAP_REPOSITORY" "$TAP_DIR"
          cd "$TAP_DIR"
          gh auth setup-git

          git config user.name "github-actions[bot]"
          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
          git checkout -B "$BRANCH"

          mkdir -p Casks
          ruby -e 'File.write("Casks/mactools.rb", <<~CASK)
            cask "mactools" do
              version "#{ENV.fetch("VERSION")}"
              sha256 "#{ENV.fetch("SHA256")}"

              url "#{ENV.fetch("DOWNLOAD_URL")}"
              name "MacTools"
              desc "Menu bar toolbox"
              homepage "https://github.com/#{ENV.fetch("GITHUB_REPOSITORY")}"

              livecheck do
                url :url
                strategy :github_latest
              end

              auto_updates true
              depends_on macos: :sonoma

              app "MacTools.app"
            end
          CASK'

          brew style Casks/mactools.rb

          if git diff --quiet -- Casks/mactools.rb; then
            echo "Homebrew tap cask is already up to date."
            exit 0
          fi

          git add Casks/mactools.rb
          git commit -m "Update mactools to ${VERSION}"
          git push --force-with-lease origin "$BRANCH"

          pr_number="$(gh pr list --repo "$TAP_REPOSITORY" --head "$BRANCH" --json number --jq '.[0].number // empty')"
          if [[ -n "$pr_number" ]]; then
            echo "Homebrew tap update PR already exists: #${pr_number}"
          else
            pr_url="$(gh pr create \
              --repo "$TAP_REPOSITORY" \
              --base main \
              --head "$BRANCH" \
              --title "Update mactools to ${VERSION}" \
              --body "Updates the MacTools cask for ${TAG}.")"
            pr_number="${pr_url##*/}"
            echo "Created Homebrew tap update PR: #${pr_number}"
          fi

          gh pr merge "$pr_number" \
            --repo "$TAP_REPOSITORY" \
            --squash \
            --delete-branch \
            --subject "Update mactools to ${VERSION}"

      - name: Commit appcast to main
        run: |
          cp docs/appcast.xml "$RUNNER_TEMP/appcast.xml"
          git config user.name "github-actions[bot]"
          git config user.email "github-actions[bot]@users.noreply.github.com"
          git fetch origin main
          git checkout -B main origin/main
          cp "$RUNNER_TEMP/appcast.xml" docs/appcast.xml
          git add docs/appcast.xml
          if git diff --cached --quiet; then
            echo "No appcast changes to commit."
          else
            git commit -m "ci: update appcast for ${TAG}"
            git push origin main
          fi

      - name: Cleanup keychain
        if: always()
        run: |
          if [[ -n "${KEYCHAIN_PATH:-}" ]]; then
            security delete-keychain "$KEYCHAIN_PATH" 2>/dev/null || true
          fi