126 lines
5.2 KiB
YAML
126 lines
5.2 KiB
YAML
on:
|
|
workflow_run:
|
|
workflows: [Test]
|
|
types: [completed]
|
|
branches: [main]
|
|
|
|
workflow_dispatch: {}
|
|
|
|
name: Release Tip
|
|
|
|
jobs:
|
|
build-macos:
|
|
if: ${{ github.event_name == 'workflow_dispatch' || github.event.workflow_run.conclusion == 'success' }}
|
|
runs-on: macos-12
|
|
env:
|
|
# Needed for macos SDK
|
|
AGREE: "true"
|
|
steps:
|
|
- name: Checkout code
|
|
uses: actions/checkout@v3
|
|
with:
|
|
submodules: recursive
|
|
fetch-depth: 0
|
|
|
|
# Install Nix and use that to run our tests so our environment matches exactly.
|
|
- uses: cachix/install-nix-action@v19
|
|
with:
|
|
nix_path: nixpkgs=channel:nixos-unstable
|
|
|
|
# GhosttyKit is the framework that is built from Zig for our native
|
|
# Mac app to access. Build this in release mode.
|
|
- name: Build GhosttyKit
|
|
run: nix develop -c zig build -Dstatic=true -Doptimize=ReleaseFast
|
|
|
|
# The native app is built with native XCode tooling. This also does
|
|
# codesigning. IMPORTANT: this must NOT run in a Nix environment.
|
|
# Nix breaks xcodebuild so this has to be run outside.
|
|
- name: Build Ghostty.app
|
|
run: cd macos && xcodebuild -configuration Release
|
|
|
|
- name: Zip Unsigned App
|
|
run: nix develop -c sh -c 'cd macos/build/Release && zip -9 -r ../../../ghostty-macos-universal-unsigned.zip Ghostty.app'
|
|
|
|
# Update Release
|
|
- name: Release Unsigned
|
|
uses: softprops/action-gh-release@v1
|
|
with:
|
|
name: "Ghostty Tip (\"Nightly\")"
|
|
prerelease: true
|
|
tag_name: tip
|
|
target_commitish: ${{ github.sha }}
|
|
files: ghostty-macos-universal-unsigned.zip
|
|
|
|
# Update the Release Tag
|
|
- name: Tip Tag
|
|
uses: rickstaa/action-create-tag@v1
|
|
with:
|
|
tag: "tip"
|
|
message: "Latest Continuous Release"
|
|
force_push_tag: true
|
|
|
|
- name: Codesign app bundle
|
|
env:
|
|
MACOS_CERTIFICATE: ${{ secrets.PROD_MACOS_CERTIFICATE }}
|
|
MACOS_CERTIFICATE_PWD: ${{ secrets.PROD_MACOS_CERTIFICATE_PWD }}
|
|
MACOS_CERTIFICATE_NAME: ${{ secrets.PROD_MACOS_CERTIFICATE_NAME }}
|
|
MACOS_CI_KEYCHAIN_PWD: ${{ secrets.PROD_MACOS_CI_KEYCHAIN_PWD }}
|
|
run: |
|
|
# Turn our base64-encoded certificate back to a regular .p12 file
|
|
echo $MACOS_CERTIFICATE | base64 --decode > certificate.p12
|
|
|
|
# We need to create a new keychain, otherwise using the certificate will prompt
|
|
# with a UI dialog asking for the certificate password, which we can't
|
|
# use in a headless CI environment
|
|
security create-keychain -p "$MACOS_CI_KEYCHAIN_PWD" build.keychain
|
|
security default-keychain -s build.keychain
|
|
security unlock-keychain -p "$MACOS_CI_KEYCHAIN_PWD" build.keychain
|
|
security import certificate.p12 -k build.keychain -P "$MACOS_CERTIFICATE_PWD" -T /usr/bin/codesign
|
|
security set-key-partition-list -S apple-tool:,apple:,codesign: -s -k "$MACOS_CI_KEYCHAIN_PWD" build.keychain
|
|
|
|
# We finally codesign our app bundle, specifying the Hardened runtime option
|
|
/usr/bin/codesign --force -s "$MACOS_CERTIFICATE_NAME" --options runtime build/Release/Ghostty.app -v
|
|
|
|
- name: "Notarize app bundle"
|
|
env:
|
|
PROD_MACOS_NOTARIZATION_APPLE_ID: ${{ secrets.PROD_MACOS_NOTARIZATION_APPLE_ID }}
|
|
PROD_MACOS_NOTARIZATION_TEAM_ID: ${{ secrets.PROD_MACOS_NOTARIZATION_TEAM_ID }}
|
|
PROD_MACOS_NOTARIZATION_PWD: ${{ secrets.PROD_MACOS_NOTARIZATION_PWD }}
|
|
run: |
|
|
# Store the notarization credentials so that we can prevent a UI password dialog
|
|
# from blocking the CI
|
|
echo "Create keychain profile"
|
|
xcrun notarytool store-credentials "notarytool-profile" --apple-id "$PROD_MACOS_NOTARIZATION_APPLE_ID" --team-id "$PROD_MACOS_NOTARIZATION_TEAM_ID" --password "$PROD_MACOS_NOTARIZATION_PWD"
|
|
|
|
# We can't notarize an app bundle directly, but we need to compress it as an archive.
|
|
# Therefore, we create a zip file containing our app bundle, so that we can send it to the
|
|
# notarization service
|
|
echo "Creating temp notarization archive"
|
|
ditto -c -k --keepParent "build/Release/Ghostty.app" "notarization.zip"
|
|
|
|
# Here we send the notarization request to the Apple's Notarization service, waiting for the result.
|
|
# This typically takes a few seconds inside a CI environment, but it might take more depending on the App
|
|
# characteristics. Visit the Notarization docs for more information and strategies on how to optimize it if
|
|
# you're curious
|
|
echo "Notarize app"
|
|
xcrun notarytool submit "notarization.zip" --keychain-profile "notarytool-profile" --wait
|
|
|
|
# Finally, we need to "attach the staple" to our executable, which will allow our app to be
|
|
# validated by macOS even when an internet connection is not available.
|
|
echo "Attach staple"
|
|
xcrun stapler staple "build/Release/Ghostty.app"
|
|
|
|
# Zip up the app
|
|
- name: Zip App
|
|
run: cd build/Release && zip -9 -r ../../../ghostty-macos-universal.zip Ghostty.app
|
|
|
|
# Update Release
|
|
- name: Release
|
|
uses: softprops/action-gh-release@v1
|
|
with:
|
|
name: "Ghostty Tip (\"Nightly\")"
|
|
prerelease: true
|
|
tag_name: tip
|
|
target_commitish: ${{ github.sha }}
|
|
files: ghostty-macos-universal.zip
|