88 lines
3.9 KiB
YAML
88 lines
3.9 KiB
YAML
name: Signed release
|
|
|
|
on:
|
|
push:
|
|
tags: ['v*']
|
|
|
|
jobs:
|
|
release:
|
|
runs-on: macos-14
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
- name: Import Developer ID certificate
|
|
env:
|
|
SIGNING_P12: ${{ secrets.DEVELOPER_ID_P12_BASE64 }}
|
|
SIGNING_PASSWORD: ${{ secrets.DEVELOPER_ID_P12_PASSWORD }}
|
|
run: |
|
|
KEYCHAIN="$RUNNER_TEMP/puter-signing.keychain-db"
|
|
security create-keychain -p runner "$KEYCHAIN"
|
|
security set-keychain-settings -lut 21600 "$KEYCHAIN"
|
|
security unlock-keychain -p runner "$KEYCHAIN"
|
|
printf '%s' "$SIGNING_P12" | base64 --decode > "$RUNNER_TEMP/puter-signing.p12"
|
|
security import "$RUNNER_TEMP/puter-signing.p12" -k "$KEYCHAIN" -P "$SIGNING_PASSWORD" -T /usr/bin/codesign
|
|
security set-key-partition-list -S apple-tool:,apple: -s -k runner "$KEYCHAIN"
|
|
security list-keychains -d user -s "$KEYCHAIN" login.keychain-db
|
|
- name: Prepare notarization key
|
|
env:
|
|
NOTARY_KEY: ${{ secrets.APPLE_NOTARY_KEY_BASE64 }}
|
|
run: printf '%s' "$NOTARY_KEY" | base64 --decode > "$RUNNER_TEMP/AuthKey.p8"
|
|
- name: Build signed app and DMG
|
|
env:
|
|
PUTER_RELEASE_BUILD: '1'
|
|
PUTER_SIGN_IDENTITY: ${{ secrets.DEVELOPER_ID_IDENTITY }}
|
|
PUTER_UPDATE_FEED_URL: ${{ secrets.SPARKLE_FEED_URL }}
|
|
PUTER_UPDATE_PUBLIC_KEY: ${{ secrets.SPARKLE_PUBLIC_KEY }}
|
|
run: |
|
|
export PUTER_VERSION="${GITHUB_REF_NAME#v}"
|
|
export PUTER_BUILD_NUMBER="$GITHUB_RUN_NUMBER"
|
|
./scripts/build-app.sh
|
|
./scripts/build-dmg.sh
|
|
./scripts/validate-package.sh
|
|
- name: Notarize and staple
|
|
env:
|
|
PUTER_NOTARY_KEY_PATH: ${{ runner.temp }}/AuthKey.p8
|
|
PUTER_NOTARY_KEY_ID: ${{ secrets.APPLE_NOTARY_KEY_ID }}
|
|
PUTER_NOTARY_ISSUER: ${{ secrets.APPLE_NOTARY_ISSUER_ID }}
|
|
run: ./scripts/notarize-release.sh
|
|
- name: Validate notarized release
|
|
env:
|
|
PUTER_RELEASE_BUILD: '1'
|
|
run: |
|
|
./scripts/validate-package.sh
|
|
xcrun stapler validate dist/puter.app
|
|
xcrun stapler validate dist/puter-macOS.dmg
|
|
- name: Generate signed appcast
|
|
env:
|
|
PUTER_UPDATE_DOWNLOAD_PREFIX: ${{ secrets.SPARKLE_DOWNLOAD_PREFIX }}
|
|
PUTER_SPARKLE_PRIVATE_KEY: ${{ secrets.SPARKLE_PRIVATE_KEY }}
|
|
run: |
|
|
mkdir -p dist/updates
|
|
ditto dist/puter-macOS.dmg "dist/updates/puter-${GITHUB_REF_NAME#v}.dmg"
|
|
./scripts/generate-appcast.sh dist/updates
|
|
- name: Prepare release assets
|
|
run: |
|
|
ditto -c -k --sequesterRsrc --keepParent dist/puter.app "dist/puter-${GITHUB_REF_NAME#v}-macOS.zip"
|
|
shasum -a 256 \
|
|
dist/puter-macOS.dmg \
|
|
"dist/puter-${GITHUB_REF_NAME#v}-macOS.zip" \
|
|
dist/updates/appcast.xml > dist/SHA256SUMS
|
|
- name: Publish Gitea release
|
|
env:
|
|
RELEASE_TOKEN: ${{ secrets.RELEASE_TOKEN }}
|
|
run: |
|
|
API_ROOT="${GITHUB_API_URL:-${GITEA_SERVER_URL}/api/v1}"
|
|
RELEASE_JSON="$(curl --fail-with-body -sS -X POST \
|
|
-H "Authorization: token $RELEASE_TOKEN" -H 'Content-Type: application/json' \
|
|
"$API_ROOT/repos/$GITHUB_REPOSITORY/releases" \
|
|
-d "{\"tag_name\":\"$GITHUB_REF_NAME\",\"name\":\"puter $GITHUB_REF_NAME\",\"draft\":false,\"prerelease\":false}")"
|
|
RELEASE_ID="$(printf '%s' "$RELEASE_JSON" | jq -r .id)"
|
|
for ASSET in \
|
|
dist/puter-macOS.dmg \
|
|
"dist/puter-${GITHUB_REF_NAME#v}-macOS.zip" \
|
|
dist/updates/appcast.xml \
|
|
dist/SHA256SUMS; do
|
|
curl --fail-with-body -sS -X POST -H "Authorization: token $RELEASE_TOKEN" \
|
|
-H 'Content-Type: application/octet-stream' --data-binary "@$ASSET" \
|
|
"$API_ROOT/repos/$GITHUB_REPOSITORY/releases/$RELEASE_ID/assets?name=$(basename "$ASSET")"
|
|
done
|