Add advanced monitoring and release infrastructure

2026-08-15 18:23:35 -04:00
parent a67bb5fdf3
commit 0da94715be
38 changed files with 4219 additions and 406 deletions
@@ -0,0 +1,24 @@
+name: Build and test
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+
+jobs:
+  macos:
+    runs-on: macos-14
+    steps:
+      - uses: actions/checkout@v4
+      - name: Swift version
+        run: swift --version
+      - name: Build
+        run: swift build
+      - name: Test
+        run: swift test
+      - name: Package unsigned validation build
+        run: ./scripts/build-app.sh
+      - name: Build validation DMG
+        run: ./scripts/build-dmg.sh
+      - name: Verify packaged app and DMG
+        run: ./scripts/validate-package.sh
@@ -0,0 +1,87 @@
+name: Signed release
+
+on:
+  push:
+    tags: ['v*']
+
+jobs:
+  release:
+    runs-on: macos-14
+    steps:
+      - uses: actions/checkout@v4
+      - name: Import Developer ID certificate
+        env:
+          SIGNING_P12: ${{ secrets.DEVELOPER_ID_P12_BASE64 }}
+          SIGNING_PASSWORD: ${{ secrets.DEVELOPER_ID_P12_PASSWORD }}
+        run: |
+          KEYCHAIN="$RUNNER_TEMP/puter-signing.keychain-db"
+          security create-keychain -p runner "$KEYCHAIN"
+          security set-keychain-settings -lut 21600 "$KEYCHAIN"
+          security unlock-keychain -p runner "$KEYCHAIN"
+          printf '%s' "$SIGNING_P12" | base64 --decode > "$RUNNER_TEMP/puter-signing.p12"
+          security import "$RUNNER_TEMP/puter-signing.p12" -k "$KEYCHAIN" -P "$SIGNING_PASSWORD" -T /usr/bin/codesign
+          security set-key-partition-list -S apple-tool:,apple: -s -k runner "$KEYCHAIN"
+          security list-keychains -d user -s "$KEYCHAIN" login.keychain-db
+      - name: Prepare notarization key
+        env:
+          NOTARY_KEY: ${{ secrets.APPLE_NOTARY_KEY_BASE64 }}
+        run: printf '%s' "$NOTARY_KEY" | base64 --decode > "$RUNNER_TEMP/AuthKey.p8"
+      - name: Build signed app and DMG
+        env:
+          PUTER_RELEASE_BUILD: '1'
+          PUTER_SIGN_IDENTITY: ${{ secrets.DEVELOPER_ID_IDENTITY }}
+          PUTER_UPDATE_FEED_URL: ${{ secrets.SPARKLE_FEED_URL }}
+          PUTER_UPDATE_PUBLIC_KEY: ${{ secrets.SPARKLE_PUBLIC_KEY }}
+        run: |
+          export PUTER_VERSION="${GITHUB_REF_NAME#v}"
+          export PUTER_BUILD_NUMBER="$GITHUB_RUN_NUMBER"
+          ./scripts/build-app.sh
+          ./scripts/build-dmg.sh
+          ./scripts/validate-package.sh
+      - name: Notarize and staple
+        env:
+          PUTER_NOTARY_KEY_PATH: ${{ runner.temp }}/AuthKey.p8
+          PUTER_NOTARY_KEY_ID: ${{ secrets.APPLE_NOTARY_KEY_ID }}
+          PUTER_NOTARY_ISSUER: ${{ secrets.APPLE_NOTARY_ISSUER_ID }}
+        run: ./scripts/notarize-release.sh
+      - name: Validate notarized release
+        env:
+          PUTER_RELEASE_BUILD: '1'
+        run: |
+          ./scripts/validate-package.sh
+          xcrun stapler validate dist/puter.app
+          xcrun stapler validate dist/puter-macOS.dmg
+      - name: Generate signed appcast
+        env:
+          PUTER_UPDATE_DOWNLOAD_PREFIX: ${{ secrets.SPARKLE_DOWNLOAD_PREFIX }}
+          PUTER_SPARKLE_PRIVATE_KEY: ${{ secrets.SPARKLE_PRIVATE_KEY }}
+        run: |
+          mkdir -p dist/updates
+          ditto dist/puter-macOS.dmg "dist/updates/puter-${GITHUB_REF_NAME#v}.dmg"
+          ./scripts/generate-appcast.sh dist/updates
+      - name: Prepare release assets
+        run: |
+          ditto -c -k --sequesterRsrc --keepParent dist/puter.app "dist/puter-${GITHUB_REF_NAME#v}-macOS.zip"
+          shasum -a 256 \
+            dist/puter-macOS.dmg \
+            "dist/puter-${GITHUB_REF_NAME#v}-macOS.zip" \
+            dist/updates/appcast.xml > dist/SHA256SUMS
+      - name: Publish Gitea release
+        env:
+          RELEASE_TOKEN: ${{ secrets.RELEASE_TOKEN }}
+        run: |
+          API_ROOT="${GITHUB_API_URL:-${GITEA_SERVER_URL}/api/v1}"
+          RELEASE_JSON="$(curl --fail-with-body -sS -X POST \
+            -H "Authorization: token $RELEASE_TOKEN" -H 'Content-Type: application/json' \
+            "$API_ROOT/repos/$GITHUB_REPOSITORY/releases" \
+            -d "{\"tag_name\":\"$GITHUB_REF_NAME\",\"name\":\"puter $GITHUB_REF_NAME\",\"draft\":false,\"prerelease\":false}")"
+          RELEASE_ID="$(printf '%s' "$RELEASE_JSON" | jq -r .id)"
+          for ASSET in \
+            dist/puter-macOS.dmg \
+            "dist/puter-${GITHUB_REF_NAME#v}-macOS.zip" \
+            dist/updates/appcast.xml \
+            dist/SHA256SUMS; do
+            curl --fail-with-body -sS -X POST -H "Authorization: token $RELEASE_TOKEN" \
+              -H 'Content-Type: application/octet-stream' --data-binary "@$ASSET" \
+              "$API_ROOT/repos/$GITHUB_REPOSITORY/releases/$RELEASE_ID/assets?name=$(basename "$ASSET")"
+          done