FilesExpand file tree

main

/

release.yml

Copy path

View runs

Blame

More file actions

Blame

More file actions

Latest commit

 

History

History

History

219 lines (185 loc) · 7.13 KB

main

/

release.yml

Copy path

Top

File metadata and controls

• Code
• Blame

219 lines (185 loc) · 7.13 KB

Raw

Copy raw file

Download raw file

Open symbols panel

Edit and raw actions

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

34

35

36

37

38

39

40

41

42

43

44

45

46

47

48

49

50

51

52

53

54

55

56

57

58

59

60

61

62

63

64

65

66

67

68

69

70

71

72

73

74

75

76

77

78

79

80

81

82

83

84

85

86

87

88

89

90

91

92

93

94

95

96

97

98

99

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

117

118

119

120

121

122

123

124

125

126

127

128

129

130

131

132

133

134

135

136

137

138

139

140

141

142

143

144

145

146

147

148

149

150

151

152

153

154

155

156

157

158

159

160

161

162

163

164

165

166

167

168

169

170

171

172

173

174

175

176

177

178

179

180

181

182

183

184

185

186

187

188

189

190

191

192

193

194

195

196

197

198

199

200

201

202

203

204

205

206

207

208

209

210

211

212

213

214

215

216

217

218

219

name: Release

on:

push:

tags:

- "v*"

permissions:

contents: write

jobs:

build-mac:

name: Build macOS ${{ matrix.arch }}

runs-on: macos-latest

strategy:

fail-fast: false

matrix:

arch: [arm64, x64]

env:

APPLE_ID: ${{ secrets.APPLE_ID }}

APPLE_APP_SPECIFIC_PASSWORD: ${{ secrets.APPLE_APP_SPECIFIC_PASSWORD }}

APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}

CSC_LINK: ${{ secrets.CSC_LINK }}

CSC_KEY_PASSWORD: ${{ secrets.CSC_KEY_PASSWORD }}

steps:

- uses: actions/checkout@v4

- uses: pnpm/action-setup@v4

with:

version: 10.33.2

- uses: actions/setup-node@v4

with:

node-version-file: .node-version

cache: pnpm

- name: Install dependencies

run: pnpm install --frozen-lockfile

- name: Check signing and notarization secrets

shell: bash

run: |

missing=0

for name in APPLE_ID APPLE_APP_SPECIFIC_PASSWORD APPLE_TEAM_ID CSC_LINK CSC_KEY_PASSWORD; do

if [[ -z "${!name}" ]]; then

echo "::error::$name is missing"

missing=1

fi

done

exit "$missing"

- name: Prepare macOS signing certificate

shell: bash

run: |

cert_path="$RUNNER_TEMP/developer-id-application.p12"

if [[ "$CSC_LINK" == base64://* ]]; then

printf "%s" "${CSC_LINK#base64://}" | base64 -D > "$cert_path"

elif [[ "$CSC_LINK" == http://* || "$CSC_LINK" == https://* ]]; then

curl -fsSL "$CSC_LINK" -o "$cert_path"

elif [[ -f "$CSC_LINK" ]]; then

cert_path="$CSC_LINK"

else

printf "%s" "$CSC_LINK" | base64 -D > "$cert_path"

fi

echo "CSC_LINK=$cert_path" >> "$GITHUB_ENV"

- name: Build signed and notarized macOS artifact

shell: bash

run: |

set -euo pipefail

corepack pnpm build

env -u APPLE_ID -u APPLE_APP_SPECIFIC_PASSWORD -u APPLE_TEAM_ID \

SKIP_NOTARIZE=1 pnpm exec electron-builder --mac --${{ matrix.arch }} --dir --publish never

app_path="$(find dist -name 'PawPause.app' -type d -print -quit)"

if [[ -z "$app_path" ]]; then

echo "::error::PawPause.app was not generated"

exit 1

fi

app_zip="$RUNNER_TEMP/PawPause-${{ matrix.arch }}.app.zip"

ditto -c -k --keepParent "$app_path" "$app_zip"

echo "Submitting app bundle for notarization..."

xcrun notarytool submit "$app_zip" \

--apple-id "$APPLE_ID" \

--password "$APPLE_APP_SPECIFIC_PASSWORD" \

--team-id "$APPLE_TEAM_ID" \

--wait \

--timeout 30m

xcrun stapler staple "$app_path"

xcrun stapler validate "$app_path"

app_dir="$(dirname "$app_path")"

env -u APPLE_ID -u APPLE_APP_SPECIFIC_PASSWORD -u APPLE_TEAM_ID \

SKIP_NOTARIZE=1 pnpm exec electron-builder --mac dmg --${{ matrix.arch }} --prepackaged "$app_dir" --publish never

dmg_path="$(find dist -name 'PawPause-*-mac-${{ matrix.arch }}.dmg' -type f -print -quit)"

if [[ -z "$dmg_path" ]]; then

echo "::error::macOS DMG was not generated"

exit 1

fi

echo "Submitting DMG for notarization..."

xcrun notarytool submit "$dmg_path" \

--apple-id "$APPLE_ID" \

--password "$APPLE_APP_SPECIFIC_PASSWORD" \

--team-id "$APPLE_TEAM_ID" \

--wait \

--timeout 30m

xcrun stapler staple "$dmg_path"

xcrun stapler validate "$dmg_path"

updater_file="dist/latest-mac-${{ matrix.arch }}.yml"

cp dist/latest-mac.yml "$updater_file"

- name: Verify notarized macOS artifact

shell: bash

run: |

app_path="$(find dist -name 'PawPause.app' -type d -print -quit)"

if [[ -z "$app_path" ]]; then

echo "::error::PawPause.app was not generated"

exit 1

fi

codesign --verify --deep --strict --verbose=2 "$app_path"

codesign -dv --verbose=4 "$app_path"

xcrun stapler validate "$app_path"

spctl --assess --type execute --verbose=4 "$app_path"

dmg_path="$(find dist -name 'PawPause-*-mac-${{ matrix.arch }}.dmg' -type f -print -quit)"

if [[ -z "$dmg_path" ]]; then

echo "::error::macOS DMG was not generated"

exit 1

fi

xcrun stapler validate "$dmg_path"

spctl --assess --type open --context context:primary-signature --verbose=4 "$dmg_path"

- name: Upload macOS artifact

uses: actions/upload-artifact@v4

with:

name: macos-${{ matrix.arch }}

path: |

dist/PawPause-*-mac-${{ matrix.arch }}.dmg

dist/PawPause-*-mac-${{ matrix.arch }}.dmg.blockmap

dist/latest-mac-${{ matrix.arch }}.yml

if-no-files-found: error

build-windows:

name: Build Windows x64

runs-on: windows-latest

steps:

- uses: actions/checkout@v4

- uses: pnpm/action-setup@v4

with:

version: 10.33.2

- uses: actions/setup-node@v4

with:

node-version-file: .node-version

cache: pnpm

- name: Install dependencies

run: pnpm install --frozen-lockfile

- name: Build Windows installer

run: pnpm dist:win

- name: Upload Windows artifact

uses: actions/upload-artifact@v4

with:

name: windows-x64

path: |

dist/PawPause-*-win-x64.exe

dist/PawPause-*-win-x64.exe.blockmap

dist/latest.yml

if-no-files-found: error

publish:

name: Publish GitHub Release

runs-on: ubuntu-latest

needs: [build-mac, build-windows]

steps:

- uses: actions/checkout@v4

- name: Download release artifacts

uses: actions/download-artifact@v4

with:

path: release-artifacts

merge-multiple: true

- name: Merge macOS updater metadata

shell: bash

run: |

ruby -ryaml -e '

paths = Dir["release-artifacts/latest-mac-*.yml"].sort

abort "missing macOS updater metadata" if paths.empty?

documents = paths.map { |path| YAML.safe_load(File.read(path), permitted_classes: [Time], aliases: true) }

merged = documents.first

merged["files"] = documents.flat_map { |document| document.fetch("files") }.uniq { |file| file.fetch("url") }

preferred = merged["files"].find { |file| file.fetch("url").include?("arm64") } || merged["files"].first

merged["path"] = preferred.fetch("url")

merged["sha512"] = preferred.fetch("sha512")

File.write("release-artifacts/latest-mac.yml", YAML.dump(merged))

paths.each { |path| File.delete(path) }

'

- name: Publish release

uses: softprops/action-gh-release@v2

with:

body_path: release-notes/${{ github.ref_name }}.md

files: release-artifacts/*

fail_on_unmatched_files: true

make_latest: true