notchy/.github/workflows/release.yml at 9ad62134ddfe0b9fa6e8c1741a76ea038c392f1a · bones7456/notchy · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
name: Release

on:
  push:
    tags:
      - 'v*'
  workflow_dispatch:
    inputs:
      tag:
        description: 'Tag to release (e.g. v0.1.0). Must already exist.'
        required: true

permissions:
  contents: write

jobs:
  release:
    runs-on: macos-26
    env:
      SIGNING_IDENTITY: ${{ secrets.SIGNING_IDENTITY }}
      APPLE_ID: ${{ secrets.APPLE_ID }}
      APPLE_APP_PASSWORD: ${{ secrets.APPLE_APP_PASSWORD }}
      APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
      SPARKLE_PRIVATE_KEY: ${{ secrets.SPARKLE_PRIVATE_KEY }}

    steps:
      - name: Checkout
        uses: actions/checkout@v5
        with:
          ref: ${{ github.event.inputs.tag || github.ref }}

      - name: Select Xcode
        uses: maxim-lobanov/setup-xcode@v1
        with:
          xcode-version: latest-stable

      - name: Import Developer ID certificate
        env:
          BUILD_CERTIFICATE_BASE64: ${{ secrets.BUILD_CERTIFICATE_BASE64 }}
          P12_PASSWORD: ${{ secrets.P12_PASSWORD }}
          KEYCHAIN_PASSWORD: ${{ secrets.KEYCHAIN_PASSWORD }}
        run: |
          set -euo pipefail
          CERT_PATH="$RUNNER_TEMP/cert.p12"
          KEYCHAIN_PATH="$RUNNER_TEMP/build.keychain-db"

          echo "$BUILD_CERTIFICATE_BASE64" | base64 --decode > "$CERT_PATH"

          security create-keychain -p "$KEYCHAIN_PASSWORD" "$KEYCHAIN_PATH"
          security set-keychain-settings -lut 21600 "$KEYCHAIN_PATH"
          security unlock-keychain -p "$KEYCHAIN_PASSWORD" "$KEYCHAIN_PATH"
          security import "$CERT_PATH" \
            -P "$P12_PASSWORD" \
            -A -t cert -f pkcs12 \
            -k "$KEYCHAIN_PATH"
          security list-keychain -d user -s "$KEYCHAIN_PATH" $(security list-keychain -d user | xargs)
          security set-key-partition-list -S apple-tool:,apple:,codesign: \
            -s -k "$KEYCHAIN_PASSWORD" "$KEYCHAIN_PATH" >/dev/null

      - name: Build, sign, notarize, and package
        run: ./scripts/package_release.sh

      - name: Resolve tag
        id: resolve_tag
        run: |
          if [ -n "${{ github.event.inputs.tag }}" ]; then
            echo "tag=${{ github.event.inputs.tag }}" >> "$GITHUB_OUTPUT"
          else
            echo "tag=${GITHUB_REF_NAME}" >> "$GITHUB_OUTPUT"
          fi

      - name: Upload artifacts to GitHub Release
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          TAG: ${{ steps.resolve_tag.outputs.tag }}
        run: |
          set -euo pipefail
          if ! gh release view "$TAG" >/dev/null 2>&1; then
            gh release create "$TAG" --title "Notchy $TAG" --generate-notes
          fi
          ASSETS=(dist/Notchy-*.zip dist/Notchy-*.dmg)
          if [ -f dist/appcast.xml ]; then
            ASSETS+=(dist/appcast.xml)
          fi
          gh release upload "$TAG" "${ASSETS[@]}" --clobber

      - name: Clean up keychain
        if: always()
        run: |
          security delete-keychain "$RUNNER_TEMP/build.keychain-db" || true