Statically link crt (#1149) #378
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Build macOS app | |
| on: | |
| push: | |
| branches: | |
| - main | |
| - dev | |
| - "release/**" | |
| - "stable/**" | |
| paths-ignore: | |
| - "*.md" | |
| - "LICENSE" | |
| tags: | |
| - v*.*.* | |
| env: | |
| CARGO_TERM_COLOR: always | |
| # sccache | |
| SCCACHE_GHA_ENABLED: "true" | |
| RUSTC_WRAPPER: "sccache" | |
| SQLX_OFFLINE: "1" | |
| jobs: | |
| build-macos: | |
| runs-on: | |
| - self-hosted | |
| - macOS | |
| - native | |
| env: | |
| APPLE_SIGNING_IDENTITY: "Apple Distribution: defguard sp. z o.o. (82GZ7KN29J)" | |
| APPLE_SIGNING_IDENTITY_INSTALLER: "3rd Party Mac Developer Installer: defguard sp. z o.o. (82GZ7KN29J)" | |
| steps: | |
| - uses: actions/checkout@v7 | |
| with: | |
| submodules: recursive | |
| - name: Write release version | |
| run: | | |
| VERSION=$(echo ${GITHUB_REF_NAME#v} | cut -d '-' -f1) | |
| echo Version: $VERSION | |
| echo "VERSION=$VERSION" >> ${GITHUB_ENV} | |
| if [ "${GITHUB_REF_TYPE}" = "tag" ]; then | |
| echo "DEFGUARD_CLIENT_BUILD_VERSION=${GITHUB_REF_NAME#v}" >> ${GITHUB_ENV} | |
| fi | |
| - name: Install NodeJS | |
| uses: actions/setup-node@v6 | |
| with: | |
| node-version-file: new-ui/.nvmrc | |
| - uses: pnpm/action-setup@v6 | |
| with: | |
| run_install: false | |
| version: 11 | |
| - name: Get pnpm store directory | |
| run: | | |
| STORE_PATH=$(pnpm store path --silent) | |
| mkdir -p "$STORE_PATH" | |
| echo "STORE_PATH=$STORE_PATH" >> ${GITHUB_ENV} | |
| - name: Restore pnpm store cache | |
| uses: actions/cache@v5 | |
| with: | |
| path: ${{ env.STORE_PATH }} | |
| key: pnpm-store-${{ runner.os }}-${{ hashFiles('new-ui/pnpm-lock.yaml') }} | |
| restore-keys: | | |
| pnpm-store-${{ runner.os }}- | |
| - name: Install Node dependencies for New UI | |
| run: | | |
| cd new-ui | |
| pnpm install --no-frozen-lockfile | |
| - name: Install Rust stable | |
| uses: dtolnay/rust-toolchain@stable | |
| with: | |
| targets: aarch64-apple-darwin,x86_64-apple-darwin | |
| - name: Run sccache-cache | |
| uses: mozilla-actions/sccache-action@v0.0.10 | |
| - name: Install tauri-cli | |
| run: cargo install tauri-cli --locked | |
| - name: Set build number | |
| run: | | |
| sed -i '' "s,@BUILD_NUMBER@,${{ github.run_number }}," swift/extension/VPNExtension.xcodeproj/project.pbxproj | |
| sed -i '' "s,@BUILD_NUMBER@,${{ github.run_number }}," src-tauri/tauri.macos.conf.json | |
| - name: Build new UI | |
| run: | | |
| cd new-ui | |
| pnpm build | |
| - name: Unlock keychain | |
| run: | | |
| security unlock-keychain -p "${{ secrets.BUILD_KEYCHAIN_PASSWORD }}" build.keychain | |
| - name: Build app | |
| uses: tauri-apps/tauri-action@v1 | |
| env: | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| with: | |
| tauriScript: cargo tauri | |
| args: --ignore-version-mismatches --config src-tauri/tauri.app.conf.json --target universal-apple-darwin | |
| - name: Build installation package | |
| run: | | |
| xcrun productbuild --keychain build.keychain \ | |
| --sign "${{ env.APPLE_SIGNING_IDENTITY_INSTALLER }}" \ | |
| --component "src-tauri/target/universal-apple-darwin/release/bundle/macos/Defguard.app" \ | |
| /Applications defguard-client.pkg | |
| xcrun altool --api-key ${{ secrets.APPLE_API_KEY }} \ | |
| --api-issuer ${{ secrets.APPLE_API_ISSUER }} \ | |
| --upload-app --platform macos --file defguard-client.pkg --wait | |
| - name: Upload What's New | |
| env: | |
| APP_ID: "6754601166" | |
| run: | | |
| UPLOAD_DIR=$(mktemp -d) | |
| mkdir -p "${UPLOAD_DIR}/beta-${APP_ID}/upload/MACOS" | |
| git log -1 --pretty='"whatsNew" = "%B";' > "${UPLOAD_DIR}/beta-${APP_ID}/upload/MACOS/en-US.txt" | |
| RETRIES=0 | |
| until [ ${RETRIES} -gt 6 ] | |
| do | |
| xcrun altool --api-key ${{ secrets.APPLE_API_KEY }} --api-issuer ${{ secrets.APPLE_API_ISSUER }} \ | |
| --apple-id ${APP_ID} --bundle-version ${{ github.run_number }} \--bundle-short-version-string ${VERSION} \ | |
| --platform macos --beta-app-store-text "${UPLOAD_DIR}" --upload && break | |
| echo "Waiting for app ${APP_ID} build ${{ github.run_number }} version ${VERSION}" | |
| sleep 10 | |
| ((RETRIES++)) | |
| done | |
| rm -f -r "${UPLOAD_DIR}" |