100 lines
3.3 KiB
YAML
100 lines
3.3 KiB
YAML
name: Finalize Release
|
|
|
|
on:
|
|
workflow_run:
|
|
workflows:
|
|
- Release
|
|
types:
|
|
- completed
|
|
workflow_dispatch:
|
|
inputs:
|
|
release_run_id:
|
|
description: Release workflow run ID; leave blank to use the latest pending run
|
|
required: false
|
|
type: string
|
|
schedule:
|
|
- cron: "17,47 * * * *"
|
|
|
|
permissions:
|
|
actions: read
|
|
contents: write
|
|
|
|
concurrency:
|
|
group: meetingnotes-finalize-release
|
|
cancel-in-progress: false
|
|
|
|
jobs:
|
|
finalize:
|
|
if: github.event_name != 'workflow_run' || github.event.workflow_run.conclusion == 'success'
|
|
runs-on: macos-15
|
|
env:
|
|
APPLE_ID: ${{ secrets.APPLE_ID }}
|
|
APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
|
|
APPLE_APP_PASSWORD: ${{ secrets.APPLE_APP_PASSWORD }}
|
|
SPARKLE_PRIVATE_KEY: ${{ secrets.SPARKLE_PRIVATE_KEY }}
|
|
GH_TOKEN: ${{ github.token }}
|
|
steps:
|
|
- uses: actions/checkout@v7
|
|
|
|
- name: Validate release secrets
|
|
run: |
|
|
for variable in APPLE_ID APPLE_TEAM_ID APPLE_APP_PASSWORD SPARKLE_PRIVATE_KEY; do
|
|
if [[ -z "${!variable:-}" ]]; then
|
|
echo "Missing GitHub Actions secret: $variable" >&2
|
|
exit 1
|
|
fi
|
|
done
|
|
|
|
- name: Download pending signed build
|
|
id: submission
|
|
env:
|
|
MANUAL_RUN_ID: ${{ inputs.release_run_id }}
|
|
COMPLETED_RUN_ID: ${{ github.event.workflow_run.id }}
|
|
run: |
|
|
PENDING_DIR="$RUNNER_TEMP/meetingnotes-pending"
|
|
candidate_ids=()
|
|
if [[ -n "${MANUAL_RUN_ID:-}" ]]; then
|
|
candidate_ids+=("$MANUAL_RUN_ID")
|
|
elif [[ -n "${COMPLETED_RUN_ID:-}" ]]; then
|
|
candidate_ids+=("$COMPLETED_RUN_ID")
|
|
else
|
|
while IFS= read -r run_id; do
|
|
candidate_ids+=("$run_id")
|
|
done < <(gh run list --repo "$GITHUB_REPOSITORY" --workflow Release --status success --limit 20 --json databaseId --jq '.[].databaseId')
|
|
fi
|
|
|
|
for run_id in "${candidate_ids[@]}"; do
|
|
if [[ ! "$run_id" =~ ^[0-9]+$ ]]; then
|
|
echo "Invalid release run ID: $run_id" >&2
|
|
exit 1
|
|
fi
|
|
|
|
artifact_name="meetingnotes-notarization-$run_id"
|
|
artifact_count=$(gh api "repos/$GITHUB_REPOSITORY/actions/runs/$run_id/artifacts" \
|
|
--jq "[.artifacts[] | select(.name == \"$artifact_name\" and .expired == false)] | length")
|
|
if [[ "$artifact_count" == 0 ]]; then
|
|
continue
|
|
fi
|
|
|
|
rm -rf "$PENDING_DIR"
|
|
mkdir -p "$PENDING_DIR"
|
|
gh run download "$run_id" --repo "$GITHUB_REPOSITORY" --name "$artifact_name" --dir "$PENDING_DIR"
|
|
|
|
version=$(<"$PENDING_DIR/version")
|
|
if gh release view "v$version" --repo "$GITHUB_REPOSITORY" >/dev/null 2>&1; then
|
|
continue
|
|
fi
|
|
|
|
echo "found=true" >> "$GITHUB_OUTPUT"
|
|
echo "run_id=$run_id" >> "$GITHUB_OUTPUT"
|
|
echo "Using release submission from workflow run $run_id"
|
|
exit 0
|
|
done
|
|
|
|
echo "found=false" >> "$GITHUB_OUTPUT"
|
|
echo "No pending release submission was found"
|
|
|
|
- name: Check notarization and publish when accepted
|
|
if: steps.submission.outputs.found == 'true'
|
|
run: scripts/finalize_release.sh
|