93 lines
3.5 KiB
YAML
93 lines
3.5 KiB
YAML
name: Release
|
|
|
|
on:
|
|
workflow_dispatch:
|
|
inputs:
|
|
version:
|
|
description: Version from MARKETING_VERSION, without the v prefix
|
|
required: true
|
|
type: string
|
|
|
|
permissions:
|
|
contents: write
|
|
|
|
concurrency:
|
|
group: meetingnotes-release
|
|
cancel-in-progress: false
|
|
|
|
jobs:
|
|
release:
|
|
runs-on: macos-15
|
|
env:
|
|
VERSION: ${{ inputs.version }}
|
|
APPLE_ID: ${{ secrets.APPLE_ID }}
|
|
APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
|
|
APPLE_APP_PASSWORD: ${{ secrets.APPLE_APP_PASSWORD }}
|
|
SPARKLE_PRIVATE_KEY: ${{ secrets.SPARKLE_PRIVATE_KEY }}
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
with:
|
|
fetch-depth: 0
|
|
|
|
- name: Validate release secrets
|
|
env:
|
|
APPLE_CERTIFICATE_P12: ${{ secrets.APPLE_CERTIFICATE_P12 }}
|
|
APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
|
|
run: |
|
|
for variable in APPLE_CERTIFICATE_P12 APPLE_CERTIFICATE_PASSWORD APPLE_ID APPLE_TEAM_ID APPLE_APP_PASSWORD SPARKLE_PRIVATE_KEY; do
|
|
if [[ -z "${!variable:-}" ]]; then
|
|
echo "Missing GitHub Actions secret: $variable" >&2
|
|
exit 1
|
|
fi
|
|
done
|
|
|
|
- name: Import Developer ID certificate
|
|
env:
|
|
APPLE_CERTIFICATE_P12: ${{ secrets.APPLE_CERTIFICATE_P12 }}
|
|
APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
|
|
KEYCHAIN_PASSWORD: ${{ github.run_id }}-${{ github.run_attempt }}
|
|
run: |
|
|
certificate_path="$RUNNER_TEMP/developer-id.p12"
|
|
keychain_path="$RUNNER_TEMP/release-signing.keychain-db"
|
|
echo -n "$APPLE_CERTIFICATE_P12" | base64 --decode > "$certificate_path"
|
|
security create-keychain -p "$KEYCHAIN_PASSWORD" "$keychain_path"
|
|
security set-keychain-settings -lut 21600 "$keychain_path"
|
|
security unlock-keychain -p "$KEYCHAIN_PASSWORD" "$keychain_path"
|
|
security import "$certificate_path" -P "$APPLE_CERTIFICATE_PASSWORD" -A -t cert -f pkcs12 -k "$keychain_path"
|
|
security list-keychain -d user -s "$keychain_path"
|
|
security default-keychain -d user -s "$keychain_path"
|
|
security set-key-partition-list -S apple-tool:,apple: -s -k "$KEYCHAIN_PASSWORD" "$keychain_path"
|
|
signing_identity=$(security find-identity -v -p codesigning "$keychain_path" | awk -F '"' '/Developer ID Application/{print $2; exit}')
|
|
if [[ -z "$signing_identity" ]]; then
|
|
echo "The .p12 does not contain a Developer ID Application identity" >&2
|
|
exit 1
|
|
fi
|
|
echo "SIGNING_IDENTITY=$signing_identity" >> "$GITHUB_ENV"
|
|
echo "RELEASE_KEYCHAIN=$keychain_path" >> "$GITHUB_ENV"
|
|
|
|
- name: Build, sign, notarize, and create appcast
|
|
run: scripts/package_release.sh
|
|
|
|
- name: Create GitHub release
|
|
env:
|
|
GH_TOKEN: ${{ github.token }}
|
|
run: |
|
|
tag="v$VERSION"
|
|
if git rev-parse "$tag" >/dev/null 2>&1; then
|
|
echo "Tag already exists: $tag" >&2
|
|
exit 1
|
|
fi
|
|
gh release create "$tag" \
|
|
"$RUNNER_TEMP/meetingnotes-release/release/Meetingnotes-$VERSION.zip" \
|
|
"$RUNNER_TEMP/meetingnotes-release/release/appcast.xml" \
|
|
--target "$GITHUB_SHA" \
|
|
--title "Meetingnotes $VERSION" \
|
|
--generate-notes
|
|
|
|
- name: Remove signing keychain
|
|
if: always()
|
|
run: |
|
|
if [[ -n "${RELEASE_KEYCHAIN:-}" ]]; then
|
|
security delete-keychain "$RELEASE_KEYCHAIN" || true
|
|
fi
|