Release 0.197.9-next #372
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: 🌍 Release | |
| run-name: Release ${{github.ref_name}} | |
| on: | |
| workflow_dispatch: | |
| release: | |
| types: [published] | |
| permissions: | |
| contents: write | |
| pull-requests: write | |
| jobs: | |
| release-nuget: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Setup .NET Core | |
| uses: actions/setup-dotnet@v4 | |
| with: | |
| dotnet-version: 10.0.302 | |
| - name: Download Github Release artifacts | |
| uses: robinraju/release-downloader@v1.11 | |
| with: | |
| tag: ${{github.ref_name}} | |
| fileName: '*.nupkg' | |
| - name: NuGet Release | |
| run: dotnet nuget push Terrabuild.${{github.ref_name}}.nupkg --skip-duplicate --api-key ${{secrets.NUGET_KEY}} --source https://api.nuget.org/v3/index.json | |
| sign-and-notarize: | |
| runs-on: macos-latest | |
| steps: | |
| - name: Download Github Release artifacts | |
| uses: robinraju/release-downloader@v1.11 | |
| with: | |
| tag: ${{github.ref_name}} | |
| fileName: 'terrabuild-*-darwin-unsigned.zip' | |
| - name: Extract Binaries | |
| run: | | |
| mkdir -p .out/darwin | |
| unzip -d .out/darwin terrabuild-${{ github.ref_name }}-darwin-unsigned.zip | |
| test -f .out/darwin/entitlements.plist | |
| - name: Add Cert to Keychain | |
| uses: apple-actions/import-codesign-certs@v3 | |
| with: | |
| p12-file-base64: ${{ secrets.MAC_CERT_BASE64 }} | |
| p12-password: ${{ secrets.MAC_CERT_PASSWORD }} | |
| - name: Sign Binaries | |
| run: | | |
| expected_identifier="io.magnusopera.terrabuild.arm64" | |
| codesign \ | |
| --force \ | |
| --timestamp \ | |
| --options=runtime \ | |
| --no-strict \ | |
| --entitlements .out/darwin/entitlements.plist \ | |
| --identifier "$expected_identifier" \ | |
| --sign "Developer ID Application: Magnus Opera (${{ secrets.MAC_DEV_TEAM_ID }})" \ | |
| .out/darwin/arm64/terrabuild | |
| codesign --verify --verbose=4 .out/darwin/arm64/terrabuild | |
| actual_identifier="$(codesign -dv --verbose=4 .out/darwin/arm64/terrabuild 2>&1 | sed -n 's/^Identifier=//p')" | |
| if [ "$actual_identifier" != "$expected_identifier" ]; then | |
| echo "Expected codesign identifier '$expected_identifier' but found '$actual_identifier'" >&2 | |
| exit 1 | |
| fi | |
| (cd .out/darwin/arm64; zip ../terrabuild-${{ github.ref_name }}-darwin-arm64.zip ./*) | |
| - name: Notarize arm64 | |
| timeout-minutes: 5 | |
| shell: bash | |
| env: | |
| MAC_DEV_LOGIN: ${{ secrets.MAC_DEV_LOGIN }} | |
| MAC_DEV_PASSWORD: ${{ secrets.MAC_DEV_PASSWORD }} | |
| MAC_DEV_TEAM_ID: ${{ secrets.MAC_DEV_TEAM_ID }} | |
| run: | | |
| set -euo pipefail | |
| if [[ -z "${MAC_DEV_LOGIN:-}" || -z "${MAC_DEV_PASSWORD:-}" || -z "${MAC_DEV_TEAM_ID:-}" ]]; then | |
| echo "::error::MAC_DEV_LOGIN, MAC_DEV_PASSWORD, and MAC_DEV_TEAM_ID secrets are required for notarization." | |
| exit 1 | |
| fi | |
| artifact_path=".out/darwin/terrabuild-${{ github.ref_name }}-darwin-arm64.zip" | |
| set +e | |
| submit_output="$(xcrun notarytool submit "${artifact_path}" \ | |
| --apple-id "${MAC_DEV_LOGIN}" \ | |
| --password "${MAC_DEV_PASSWORD}" \ | |
| --team-id "${MAC_DEV_TEAM_ID}" \ | |
| --wait \ | |
| --output-format json 2>&1)" | |
| submit_status=$? | |
| set -e | |
| printf '%s\n' "${submit_output}" | |
| submission_id="$(printf '%s\n' "${submit_output}" | node -e 'const fs = require("node:fs"); const input = fs.readFileSync(0, "utf8"); try { const data = JSON.parse(input); process.stdout.write(data.id || ""); } catch { process.exit(0); }')" | |
| notarization_status="$(printf '%s\n' "${submit_output}" | node -e 'const fs = require("node:fs"); const input = fs.readFileSync(0, "utf8"); try { const data = JSON.parse(input); process.stdout.write(data.status || ""); } catch { process.exit(0); }')" | |
| if [[ -n "${submission_id}" && "${notarization_status}" != "Accepted" ]]; then | |
| echo "::group::Apple notarization log" | |
| xcrun notarytool log \ | |
| --apple-id "${MAC_DEV_LOGIN}" \ | |
| --password "${MAC_DEV_PASSWORD}" \ | |
| --team-id "${MAC_DEV_TEAM_ID}" \ | |
| "${submission_id}" \ | |
| notary-log.json || true | |
| if [[ -f notary-log.json ]]; then | |
| cat notary-log.json | |
| fi | |
| echo "::endgroup::" | |
| fi | |
| if [[ "${submit_status}" -ne 0 || "${notarization_status}" != "Accepted" ]]; then | |
| echo "::error::Notarization failed with status '${notarization_status:-unknown}'." | |
| exit 1 | |
| fi | |
| - name: Upload signed macOS artifacts | |
| uses: softprops/action-gh-release@v2.0.6 | |
| with: | |
| tag_name: ${{ github.ref_name }} | |
| files: | | |
| .out/darwin/terrabuild-${{github.ref_name}}-darwin-arm64.zip | |
| - name: Remove unsigned macOS artifact | |
| uses: actions/github-script@v7 | |
| with: | |
| script: | | |
| const tag = context.ref.replace('refs/tags/', ''); | |
| const unsignedName = `terrabuild-${tag}-darwin-unsigned.zip`; | |
| const { data: release } = await github.rest.repos.getReleaseByTag({ | |
| owner: context.repo.owner, | |
| repo: context.repo.repo, | |
| tag, | |
| }); | |
| const asset = release.assets.find(a => a.name === unsignedName); | |
| if (!asset) { | |
| core.info(`Unsigned artifact not found: ${unsignedName}`); | |
| return; | |
| } | |
| await github.rest.repos.deleteReleaseAsset({ | |
| owner: context.repo.owner, | |
| repo: context.repo.repo, | |
| asset_id: asset.id, | |
| }); | |
| core.info(`Deleted unsigned artifact: ${unsignedName}`); | |
| update-homebrew-tap: | |
| uses: ./.github/workflows/release-homebrew-tap.yml | |
| needs: sign-and-notarize | |
| permissions: | |
| contents: read | |
| with: | |
| ref: ${{ github.ref }} | |
| version: ${{ github.ref_name }} | |
| dry-run: false | |
| secrets: inherit |