Repository navigation
Release v0.8.0 #12
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Release | |
| run-name: Release ${{ github.event.release.tag_name || inputs.tag }} | |
| on: | |
| release: | |
| types: [published] | |
| workflow_dispatch: | |
| inputs: | |
| tag: | |
| description: Global release tag, for example v0.6.0 | |
| required: true | |
| type: string | |
| permissions: | |
| contents: write | |
| jobs: | |
| identify: | |
| runs-on: ubuntu-latest | |
| outputs: | |
| tag: ${{ steps.release.outputs.tag }} | |
| version: ${{ steps.release.outputs.version }} | |
| artifacts: ${{ steps.release.outputs.artifacts }} | |
| has-artifacts: ${{ steps.release.outputs.has-artifacts }} | |
| steps: | |
| - uses: actions/checkout@v4 | |
| with: | |
| ref: ${{ github.event.release.tag_name || inputs.tag }} | |
| - id: release | |
| env: | |
| RELEASE_TAG: ${{ github.event.release.tag_name || inputs.tag }} | |
| run: | | |
| version="$(./.github/scripts/parse-release-tag.sh "$RELEASE_TAG")" | |
| test "$(jq -r .version .starpac/release.json)" = "$version" | |
| test "$(jq -r .starpacVersion .starpac/release-index.json)" = "$version" | |
| artifacts="$(jq -c .artifacts .starpac/release.json)" | |
| count="$(jq '.artifacts | length' .starpac/release.json)" | |
| echo "tag=$RELEASE_TAG" >> "$GITHUB_OUTPUT" | |
| echo "version=$version" >> "$GITHUB_OUTPUT" | |
| echo "artifacts=$artifacts" >> "$GITHUB_OUTPUT" | |
| if [[ "$count" -gt 0 ]]; then echo "has-artifacts=true" >> "$GITHUB_OUTPUT"; else echo "has-artifacts=false" >> "$GITHUB_OUTPUT"; fi | |
| sign-and-notarize: | |
| needs: identify | |
| if: needs.identify.outputs.has-artifacts == 'true' | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| tool: ${{ fromJSON(needs.identify.outputs.artifacts) }} | |
| runs-on: macos-15 | |
| steps: | |
| - uses: robinraju/release-downloader@v1.11 | |
| with: | |
| tag: ${{ needs.identify.outputs.tag }} | |
| fileName: '${{ matrix.tool }}-*-darwin-arm64-unsigned.zip' | |
| - name: Extract binary | |
| env: | |
| TOOL: ${{ matrix.tool }} | |
| VERSION: ${{ needs.identify.outputs.version }} | |
| run: | | |
| mkdir -p .out/darwin/arm64 | |
| unzip -o -d .out/darwin/arm64 "${TOOL}-${VERSION}-darwin-arm64-unsigned.zip" | |
| - uses: apple-actions/import-codesign-certs@v3 | |
| with: | |
| p12-file-base64: ${{ secrets.MAC_CERT_BASE64 }} | |
| p12-password: ${{ secrets.MAC_CERT_PASSWORD }} | |
| - name: Sign binary | |
| env: | |
| TOOL: ${{ matrix.tool }} | |
| VERSION: ${{ needs.identify.outputs.version }} | |
| TEAM_ID: ${{ secrets.MAC_DEV_TEAM_ID }} | |
| run: | | |
| expected_identifier="io.magnusopera.${TOOL}.arm64" | |
| codesign --force --timestamp --options=runtime \ | |
| --identifier "$expected_identifier" \ | |
| --sign "Developer ID Application: Magnus Opera (${TEAM_ID})" \ | |
| ".out/darwin/arm64/${TOOL}" | |
| codesign --verify --verbose=4 ".out/darwin/arm64/${TOOL}" | |
| actual_identifier="$(codesign -dv --verbose=4 ".out/darwin/arm64/${TOOL}" 2>&1 | sed -n 's/^Identifier=//p')" | |
| test "$actual_identifier" = "$expected_identifier" | |
| (cd .out/darwin/arm64 && zip -q -r "../${TOOL}-${VERSION}-darwin-arm64.zip" "./${TOOL}") | |
| - uses: GuillaumeFalourd/notary-tools@v1 | |
| timeout-minutes: 10 | |
| with: | |
| product_path: '.out/darwin/${{ matrix.tool }}-${{ needs.identify.outputs.version }}-darwin-arm64.zip' | |
| apple_id: ${{ secrets.MAC_DEV_LOGIN }} | |
| password: ${{ secrets.MAC_DEV_PASSWORD }} | |
| team_id: ${{ secrets.MAC_DEV_TEAM_ID }} | |
| xcode_path: '/Applications/Xcode_16.4.app' | |
| staple: false | |
| - uses: softprops/action-gh-release@v2 | |
| env: | |
| NODE_OPTIONS: --use-system-ca | |
| with: | |
| tag_name: ${{ needs.identify.outputs.tag }} | |
| files: '.out/darwin/${{ matrix.tool }}-${{ needs.identify.outputs.version }}-darwin-arm64.zip' | |
| - name: Remove unsigned macOS artifact | |
| continue-on-error: true | |
| uses: actions/github-script@v7 | |
| env: | |
| RELEASE_TAG: ${{ needs.identify.outputs.tag }} | |
| TOOL: ${{ matrix.tool }} | |
| VERSION: ${{ needs.identify.outputs.version }} | |
| with: | |
| script: | | |
| const {data: release} = await github.rest.repos.getReleaseByTag({ | |
| owner: context.repo.owner, | |
| repo: context.repo.repo, | |
| tag: process.env.RELEASE_TAG, | |
| }); | |
| const expected = `${process.env.TOOL}-${process.env.VERSION}-darwin-arm64-unsigned.zip`; | |
| const asset = release.assets.find((item) => item.name === expected); | |
| if (asset) { | |
| await github.rest.repos.deleteReleaseAsset({ | |
| owner: context.repo.owner, | |
| repo: context.repo.repo, | |
| asset_id: asset.id, | |
| }); | |
| } | |
| update-homebrew-tap: | |
| needs: [identify, sign-and-notarize] | |
| if: always() && needs.identify.result == 'success' && needs.sign-and-notarize.result == 'success' | |
| strategy: | |
| fail-fast: false | |
| max-parallel: 1 | |
| matrix: | |
| tool: ${{ fromJSON(needs.identify.outputs.artifacts) }} | |
| uses: ./.github/workflows/release-homebrew-tap.yml | |
| with: | |
| ref: ${{ needs.identify.outputs.tag }} | |
| tool: ${{ matrix.tool }} | |
| version: ${{ needs.identify.outputs.version }} | |
| dry-run: false | |
| secrets: inherit |