build.yml

# Required secrets:
#   P12_PASSWORD                            - Password for all .p12 certificate files
#   MAC_INSTALLER_P12_BASE64                - Base64-encoded MacInstallerDistribution20260524.p12
#   DISTRIBUTION_P12_BASE64                 - Base64-encoded AppleDistribution20260524.p12
#   DEVELOPER_ID_P12_BASE64                 - Base64-encoded DeveloperIDApplication20270202.p12
#   IOS_PROVISIONING_PROFILE_BASE64         - Base64-encoded iOSDistribution20260524.mobileprovision
#   IOS_NSE_PROVISIONING_PROFILE_BASE64     - Base64-encoded iOS distribution profile for the NotificationServiceExtension App ID
#   MAC_APP_STORE_PROVISIONING_PROFILE_BASE64 - Base64-encoded MacDistribution20260524.provisionprofile
#   MAC_DEVELOPER_ID_PROVISIONING_PROFILE_BASE64 - Base64-encoded DeveloperIDApplication20270202.provisionprofile
#   SENTRY_AUTH_TOKEN                       - Sentry auth token
#   SENTRY_CATALYST_DSN                     - Sentry DSN for Catalyst
#   SENTRY_IOS_DSN                          - Sentry DSN for iOS
#   AC_ACCOUNT_NAME                         - Apple ID for notarization
#   AC_ACCOUNT_PASSWORD                     - App-specific password for notarization

name: Build

on:
  push:
    branches:
      - 'releases/*'
      - main
      - develop
  pull_request:
    branches:
      - 'releases/*'
      - main
      - develop

env:
  DEPENDENCY_VERSION: '1.0.56'
  CONTENT_COMMIT_HASH: '67a542671ace4ed5c92e32519525716038498f11'
  XC_VERSION: '26.4'
  XC_PROJECT: 'MobileCelestia/MobileCelestia.xcodeproj'
  XC_SCHEME: 'MobileCelestia'
  DISTRIBUTION_IDENTITY: 'Apple Distribution: Linfeng Li (22NR5428TD)'
  DEVELOPER_ID_IDENTITY: 'Developer ID Application: Linfeng Li (22NR5428TD)'

jobs:
  build:
    name: 'Build ${{ matrix.name }}'
    runs-on: macos-26

    strategy:
      fail-fast: false
      matrix:
        include:
          - sdk: iphoneos
            signing: appStore
            backend: openGL
            name: iOS
          - sdk: iphoneos
            signing: appStore
            backend: angle
            name: iOS (ANGLE)
          - sdk: macosx
            signing: developerID
            backend: angle
            name: Catalyst (Developer ID, ANGLE)
          - sdk: macosx
            signing: developerID
            backend: openGL
            name: Catalyst (Developer ID, OpenGL)
          - sdk: macosx
            signing: appStore
            backend: openGL
            name: Catalyst (App Store)

    env:
      XC_ARCHIVE_PARENT_PATH: '${{ github.workspace }}/archive'
      XC_ARCHIVE_PATH: '${{ github.workspace }}/archive/MobileCelestia.xcarchive'

    steps:
      - name: Checkout MobileCelestia
        uses: actions/checkout@v4
        with:
          path: MobileCelestia
          fetch-depth: 0

      - name: Checkout Celestia
        uses: actions/checkout@v4
        with:
          repository: celestiamobile/Celestia
          path: Celestia
          fetch-depth: 0

      - name: Checkout CelestiaCore
        uses: actions/checkout@v4
        with:
          repository: celestiamobile/CelestiaCore
          path: CelestiaCore
          fetch-depth: 0

      - name: Checkout CelestiaContent
        uses: actions/checkout@v4
        with:
          repository: CelestiaProject/CelestiaContent
          path: CelestiaContent
          fetch-depth: 0

      - name: Checkout CelestiaLocalization
        uses: actions/checkout@v4
        with:
          repository: celestiamobile/CelestiaLocalization
          path: CelestiaLocalization
          fetch-depth: 0

      - name: Checkout Branch
        if: github.event_name != 'pull_request'
        run: |
          cd Celestia
          git checkout origin/${{ github.ref_name }}
          cd ../CelestiaCore
          git checkout origin/${{ github.ref_name }}
          cd ../CelestiaLocalization
          git checkout origin/${{ github.ref_name }}

      - name: Checkout Branch (PR)
        if: github.event_name == 'pull_request'
        run: |
          cd Celestia
          git checkout origin/${{ github.event.pull_request.base.ref }}
          cd ../CelestiaCore
          git checkout origin/${{ github.event.pull_request.base.ref }}
          cd ../CelestiaLocalization
          git checkout origin/${{ github.event.pull_request.base.ref }}

      - name: Apply ANGLE Patches (1)
        if: matrix.backend == 'angle'
        run: |
          cd CelestiaCore
          git apply ../MobileCelestia/patches/angle/celestiacore.patch --ignore-whitespace --whitespace=nowarn -3

      - name: Apply ANGLE Patches (2)
        if: matrix.backend == 'angle'
        run: |
          cd MobileCelestia
          git apply patches/angle/mobilecelestia.patch --ignore-whitespace --whitespace=nowarn -3

      - name: Checkout Content
        run: |
          cd CelestiaContent
          git checkout ${{ env.CONTENT_COMMIT_HASH }}

      - name: Install Dependencies
        run: |
          brew update
          brew install gettext gperf node imagemagick wget

      - name: Download Pre-built Dependencies
        run: |
          wget https://github.com/celestiamobile/apple-android-dependencies/releases/download/${{ env.DEPENDENCY_VERSION }}/apple-dependencies.tar.gz -O /tmp/apple-dependencies.tar.gz
          mkdir -p CelestiaCore/libs/dependency
          tar -xzf /tmp/apple-dependencies.tar.gz -C CelestiaCore/libs/dependency

      - name: Use libepoxy with ANGLE
        if: matrix.backend == 'angle'
        run: |
          cd CelestiaCore/libs/dependency
          rm -rf libepoxy.xcframework
          mv libepoxy_angle.xcframework libepoxy.xcframework

      - name: Select Latest Xcode
        run: |
          sudo xcode-select -s /Applications/Xcode_${{ env.XC_VERSION }}.app
          xcodebuild -version

      - name: Running imagemagick
        run: sh $GITHUB_WORKSPACE/CelestiaCore/downsize_textures.sh

      - name: Running gperf
        run: sh $GITHUB_WORKSPACE/CelestiaCore/run_gperf.sh $GITHUB_WORKSPACE/Celestia

      - name: Install Sentry-CLI
        run: brew install sentry-cli

      - name: Replace Sentry Placeholders
        working-directory: '${{ github.workspace }}/MobileCelestia'
        run: |
          sed -i '' "s#SENTRY-CATALYST-DSN#${{ secrets.SENTRY_CATALYST_DSN }}#g" MobileCelestia/AppDelegate.swift
          sed -i '' "s#SENTRY-IOS-DSN#${{ secrets.SENTRY_IOS_DSN }}#g" MobileCelestia/AppDelegate.swift

      - name: Install Provisioning Profiles
        run: |
          mkdir -p ~/Library/MobileDevice/Provisioning\ Profiles

          echo "${{ secrets.IOS_PROVISIONING_PROFILE_BASE64 }}" | base64 --decode > $RUNNER_TEMP/ios_distribution.mobileprovision
          security cms -D -i $RUNNER_TEMP/ios_distribution.mobileprovision > $RUNNER_TEMP/ios_profile.plist
          IOS_UUID=$(/usr/libexec/PlistBuddy -c 'Print :UUID' $RUNNER_TEMP/ios_profile.plist)
          cp $RUNNER_TEMP/ios_distribution.mobileprovision ~/Library/MobileDevice/Provisioning\ Profiles/${IOS_UUID}.mobileprovision
          echo "IOS_PROVISIONING_PROFILE_UUID=${IOS_UUID}" >> $GITHUB_ENV

          echo "${{ secrets.IOS_NSE_PROVISIONING_PROFILE_BASE64 }}" | base64 --decode > $RUNNER_TEMP/ios_nse.mobileprovision
          security cms -D -i $RUNNER_TEMP/ios_nse.mobileprovision > $RUNNER_TEMP/ios_nse_profile.plist
          IOS_NSE_UUID=$(/usr/libexec/PlistBuddy -c 'Print :UUID' $RUNNER_TEMP/ios_nse_profile.plist)
          cp $RUNNER_TEMP/ios_nse.mobileprovision ~/Library/MobileDevice/Provisioning\ Profiles/${IOS_NSE_UUID}.mobileprovision
          echo "IOS_NSE_PROVISIONING_PROFILE_UUID=${IOS_NSE_UUID}" >> $GITHUB_ENV

          echo "${{ secrets.MAC_APP_STORE_PROVISIONING_PROFILE_BASE64 }}" | base64 --decode > $RUNNER_TEMP/mac_distribution.provisionprofile
          security cms -D -i $RUNNER_TEMP/mac_distribution.provisionprofile > $RUNNER_TEMP/mac_app_store_profile.plist
          MAC_APP_STORE_UUID=$(/usr/libexec/PlistBuddy -c 'Print :UUID' $RUNNER_TEMP/mac_app_store_profile.plist)
          cp $RUNNER_TEMP/mac_distribution.provisionprofile ~/Library/MobileDevice/Provisioning\ Profiles/${MAC_APP_STORE_UUID}.provisionprofile
          echo "MAC_APP_STORE_PROVISIONING_PROFILE_UUID=${MAC_APP_STORE_UUID}" >> $GITHUB_ENV

          echo "${{ secrets.MAC_DEVELOPER_ID_PROVISIONING_PROFILE_BASE64 }}" | base64 --decode > $RUNNER_TEMP/mac_developer_id.provisionprofile
          security cms -D -i $RUNNER_TEMP/mac_developer_id.provisionprofile > $RUNNER_TEMP/mac_developer_id_profile.plist
          MAC_DEVELOPER_ID_UUID=$(/usr/libexec/PlistBuddy -c 'Print :UUID' $RUNNER_TEMP/mac_developer_id_profile.plist)
          cp $RUNNER_TEMP/mac_developer_id.provisionprofile ~/Library/MobileDevice/Provisioning\ Profiles/${MAC_DEVELOPER_ID_UUID}.provisionprofile
          echo "MAC_DEVELOPER_ID_PROVISIONING_PROFILE_UUID=${MAC_DEVELOPER_ID_UUID}" >> $GITHUB_ENV

      - name: Patch ExportOptions Plists
        run: |
          IOS_BUNDLE_ID=$(/usr/libexec/PlistBuddy -c 'Print :Entitlements:application-identifier' $RUNNER_TEMP/ios_profile.plist | sed 's/^[^.]*\.//')
          MAC_BUNDLE_ID=$(/usr/libexec/PlistBuddy -c 'Print :Entitlements:com.apple.application-identifier' $RUNNER_TEMP/mac_app_store_profile.plist | sed 's/^[^.]*\.//')
          MAC_DEV_ID_BUNDLE_ID=$(/usr/libexec/PlistBuddy -c 'Print :Entitlements:com.apple.application-identifier' $RUNNER_TEMP/mac_developer_id_profile.plist | sed 's/^[^.]*\.//')
          /usr/libexec/PlistBuddy -c "Set :provisioningProfiles:${IOS_BUNDLE_ID} ${IOS_PROVISIONING_PROFILE_UUID}" MobileCelestia/ExportOptions-iphoneos-appStore.plist
          /usr/libexec/PlistBuddy -c "Set :provisioningProfiles:${IOS_BUNDLE_ID}.NotificationServiceExtension ${IOS_NSE_PROVISIONING_PROFILE_UUID}" MobileCelestia/ExportOptions-iphoneos-appStore.plist
          /usr/libexec/PlistBuddy -c "Set :provisioningProfiles:${MAC_BUNDLE_ID} ${MAC_APP_STORE_PROVISIONING_PROFILE_UUID}" MobileCelestia/ExportOptions-macosx-appStore.plist
          /usr/libexec/PlistBuddy -c "Set :provisioningProfiles:${MAC_DEV_ID_BUNDLE_ID} ${MAC_DEVELOPER_ID_PROVISIONING_PROFILE_UUID}" MobileCelestia/ExportOptions-macosx-developerID.plist

      - name: Install Certificates (Mac Installer)
        run: |
          KEYCHAIN_PATH=$RUNNER_TEMP/app-signing-mac-installer.keychain-db
          KEYCHAIN_PASSWORD=temppassword
          echo "${{ secrets.MAC_INSTALLER_P12_BASE64 }}" | base64 --decode > $RUNNER_TEMP/mac_installer.p12
          security create-keychain -p "$KEYCHAIN_PASSWORD" $KEYCHAIN_PATH
          security set-keychain-settings -lut 21600 $KEYCHAIN_PATH
          security unlock-keychain -p "$KEYCHAIN_PASSWORD" $KEYCHAIN_PATH
          security import "$RUNNER_TEMP/mac_installer.p12" -P "${{ secrets.P12_PASSWORD }}" -A -t cert -f pkcs12 -k $KEYCHAIN_PATH
          security list-keychains -d user -s $(security list-keychains -d user | sed -e s/\"//g) $KEYCHAIN_PATH

      - name: Install Certificates (Apple Distribution)
        run: |
          KEYCHAIN_PATH=$RUNNER_TEMP/app-signing-distribution.keychain-db
          KEYCHAIN_PASSWORD=temppassword
          echo "${{ secrets.DISTRIBUTION_P12_BASE64 }}" | base64 --decode > $RUNNER_TEMP/distribution.p12
          security create-keychain -p "$KEYCHAIN_PASSWORD" $KEYCHAIN_PATH
          security set-keychain-settings -lut 21600 $KEYCHAIN_PATH
          security unlock-keychain -p "$KEYCHAIN_PASSWORD" $KEYCHAIN_PATH
          security import "$RUNNER_TEMP/distribution.p12" -P "${{ secrets.P12_PASSWORD }}" -A -t cert -f pkcs12 -k $KEYCHAIN_PATH
          security list-keychains -d user -s $(security list-keychains -d user | sed -e s/\"//g) $KEYCHAIN_PATH

      - name: Install Certificates (Developer ID)
        run: |
          KEYCHAIN_PATH=$RUNNER_TEMP/app-signing-developer-id.keychain-db
          KEYCHAIN_PASSWORD=temppassword
          echo "${{ secrets.DEVELOPER_ID_P12_BASE64 }}" | base64 --decode > $RUNNER_TEMP/developer_id.p12
          security create-keychain -p "$KEYCHAIN_PASSWORD" $KEYCHAIN_PATH
          security set-keychain-settings -lut 21600 $KEYCHAIN_PATH
          security unlock-keychain -p "$KEYCHAIN_PASSWORD" $KEYCHAIN_PATH
          security import "$RUNNER_TEMP/developer_id.p12" -P "${{ secrets.P12_PASSWORD }}" -A -t cert -f pkcs12 -k $KEYCHAIN_PATH
          security list-keychains -d user -s $(security list-keychains -d user | sed -e s/\"//g) $KEYCHAIN_PATH

      - name: Build Archive (iOS)
        if: matrix.sdk == 'iphoneos'
        run: |
          sed -i '' 's/CODE_SIGN_STYLE = Automatic;/CODE_SIGN_STYLE = Manual;/g' $XC_PROJECT/project.pbxproj
          awk -v main_uuid="$IOS_PROVISIONING_PROFILE_UUID" -v nse_uuid="$IOS_NSE_PROVISIONING_PROFILE_UUID" '
            /PRODUCT_BUNDLE_IDENTIFIER = space\.celestia\.MobileCelestia\.NotificationServiceExtension;/ { uuid = nse_uuid; print; next }
            /PRODUCT_BUNDLE_IDENTIFIER = / { uuid = main_uuid; print; next }
            /PROVISIONING_PROFILE_SPECIFIER = "";/ {
              if (uuid != "") sub(/""/, "\"" uuid "\"")
              print
              next
            }
            { print }
          ' $XC_PROJECT/project.pbxproj > $RUNNER_TEMP/project.pbxproj && mv $RUNNER_TEMP/project.pbxproj $XC_PROJECT/project.pbxproj
          sed -i '' "s/CODE_SIGN_IDENTITY = \"Apple Development\";/CODE_SIGN_IDENTITY = \"${DISTRIBUTION_IDENTITY}\";/g" $XC_PROJECT/project.pbxproj
          /usr/bin/xcodebuild archive -project "$XC_PROJECT" -scheme "$XC_SCHEME" -configuration "Release" -destination "generic/platform=iOS" -archivePath "$XC_ARCHIVE_PATH" SHARED_BUILD_NUMBER=$((6661 + ${{ github.run_number }}))

      - name: Build Archive (Mac, App Store)
        if: matrix.sdk == 'macosx' && matrix.signing == 'appStore'
        run: |
          sed -i '' 's/CODE_SIGN_STYLE = Automatic;/CODE_SIGN_STYLE = Manual;/g' $XC_PROJECT/project.pbxproj
          sed -i '' "s/PROVISIONING_PROFILE_SPECIFIER = \"\";/PROVISIONING_PROFILE_SPECIFIER = \"${MAC_APP_STORE_PROVISIONING_PROFILE_UUID}\";/g" $XC_PROJECT/project.pbxproj
          sed -i '' "s/CODE_SIGN_IDENTITY = \"Apple Development\";/CODE_SIGN_IDENTITY = \"${DISTRIBUTION_IDENTITY}\";/g" $XC_PROJECT/project.pbxproj
          /usr/bin/xcodebuild archive -project "$XC_PROJECT" -scheme "$XC_SCHEME" -configuration "Release" -destination "platform=macOS,variant=Mac Catalyst" -archivePath "$XC_ARCHIVE_PATH" SHARED_BUILD_NUMBER=$((6661 + ${{ github.run_number }}))

      - name: Build Archive (Mac, Developer ID)
        if: matrix.sdk == 'macosx' && matrix.signing == 'developerID'
        run: |
          sed -i '' 's/CODE_SIGN_STYLE = Automatic;/CODE_SIGN_STYLE = Manual;/g' $XC_PROJECT/project.pbxproj
          sed -i '' "s/PROVISIONING_PROFILE_SPECIFIER = \"\";/PROVISIONING_PROFILE_SPECIFIER = \"${MAC_DEVELOPER_ID_PROVISIONING_PROFILE_UUID}\";/g" $XC_PROJECT/project.pbxproj
          sed -i '' "s/CODE_SIGN_IDENTITY = \"Apple Development\";/CODE_SIGN_IDENTITY = \"${DEVELOPER_ID_IDENTITY}\";/g" $XC_PROJECT/project.pbxproj
          /usr/bin/xcodebuild archive -project "$XC_PROJECT" -scheme "$XC_SCHEME" -configuration "Release" -destination "platform=macOS,variant=Mac Catalyst" -archivePath "$XC_ARCHIVE_PATH" SHARED_BUILD_NUMBER=$((6661 + ${{ github.run_number }}))

      - name: Export Archive
        run: |
          /usr/bin/xcodebuild -exportArchive -archivePath "$XC_ARCHIVE_PATH" -exportOptionsPlist "MobileCelestia/ExportOptions-${{ matrix.sdk }}-${{ matrix.signing }}.plist" -exportPath "$RUNNER_TEMP/output"

      - name: Create Artifact Folders
        run: |
          mkdir -p $RUNNER_TEMP/artifacts/archive
          mkdir -p $RUNNER_TEMP/artifacts/product

      - name: Create .zip for .xcarchive
        run: |
          cd ${{ env.XC_ARCHIVE_PARENT_PATH }}
          zip -r -v -y $RUNNER_TEMP/artifacts/archive/Archive.zip *.xcarchive

      - name: Copy .ipa
        if: matrix.sdk == 'iphoneos'
        run: find $RUNNER_TEMP/output -name "*.ipa" -exec cp {} $RUNNER_TEMP/artifacts/product/ \;

      - name: Copy .pkg
        if: matrix.sdk == 'macosx' && matrix.signing == 'appStore'
        run: find $RUNNER_TEMP/output -name "*.pkg" -exec cp {} $RUNNER_TEMP/artifacts/product/ \;

      - name: Create .zip Archive for .app
        if: matrix.sdk == 'macosx' && matrix.signing == 'developerID'
        run: |
          cd $RUNNER_TEMP/output
          zip -r -v -y $RUNNER_TEMP/artifacts/product/App.zip *.app

      - name: Upload Product Artifacts
        uses: actions/upload-artifact@v4
        with:
          name: '${{ matrix.sdk }}-${{ matrix.signing }}-${{ matrix.backend }}-product'
          path: '${{ runner.temp }}/artifacts/product'
          retention-days: 90

      - name: Upload Archive Artifacts
        uses: actions/upload-artifact@v4
        with:
          name: '${{ matrix.sdk }}-${{ matrix.signing }}-${{ matrix.backend }}-archive'
          path: '${{ runner.temp }}/artifacts/archive'
          retention-days: 90

      - name: Upload Symbols (iOS)
        if: matrix.sdk == 'iphoneos'
        env:
          SENTRY_ORG: celestia-vs
          SENTRY_PROJECT: apple-ios
          SENTRY_AUTH_TOKEN: ${{ secrets.SENTRY_AUTH_TOKEN }}
        run: sentry-cli debug-files upload --include-sources ${{ env.XC_ARCHIVE_PATH }}/dSYMs

      - name: Upload Symbols (Mac)
        if: matrix.sdk == 'macosx'
        env:
          SENTRY_ORG: celestia-vs
          SENTRY_PROJECT: apple-catalyst
          SENTRY_AUTH_TOKEN: ${{ secrets.SENTRY_AUTH_TOKEN }}
        run: sentry-cli debug-files upload --include-sources ${{ env.XC_ARCHIVE_PATH }}/dSYMs

      - name: Notarize App
        if: matrix.sdk == 'macosx' && matrix.signing == 'developerID'
        run: |
          xcrun notarytool store-credentials "AC_PASSWORD" --apple-id ${{ secrets.AC_ACCOUNT_NAME }} --team-id 22NR5428TD --password ${{ secrets.AC_ACCOUNT_PASSWORD }}
          xcrun notarytool submit "$RUNNER_TEMP/artifacts/product/App.zip" --keychain-profile "AC_PASSWORD" --wait