apple mdns client hardening #91
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: iOS CI | |
| on: | |
| push: | |
| branches: | |
| - master | |
| pull_request: | |
| branches: | |
| - master | |
| workflow_dispatch: | |
| permissions: | |
| contents: read | |
| concurrency: | |
| group: ios-ci-${{ github.ref }} | |
| cancel-in-progress: true | |
| jobs: | |
| build: | |
| name: iOS simulator build test | |
| runs-on: macos-latest | |
| env: | |
| CLIPP_CACHE_DIR: ${{ github.workspace }}/clipp-cache | |
| VCPKG_ROOT: ${{ github.workspace }}/v | |
| VCPKG_DEFAULT_BINARY_CACHE: ${{ github.workspace }}/vcpkg-cache | |
| VCPKG_BINARY_SOURCES: clear;files,${{ github.workspace }}/vcpkg-cache,readwrite | |
| steps: | |
| - name: Checkout clipp | |
| uses: actions/checkout@v6 | |
| with: | |
| persist-credentials: false | |
| - name: Install build dependencies | |
| run: brew install autoconf autoconf-archive automake libtool | |
| - name: Verify Apple Silicon runner | |
| run: | | |
| if [[ "$(uname -m)" != "arm64" ]]; then | |
| echo "iOS simulator CI currently builds the arm64 simulator slice only." >&2 | |
| exit 1 | |
| fi | |
| - name: Read vcpkg baseline | |
| id: vcpkg-baseline | |
| run: | | |
| baseline="$(python3 - <<'PY' | |
| import json | |
| with open("src/vcpkg.json", encoding="utf-8") as manifest_file: | |
| manifest = json.load(manifest_file) | |
| print(manifest.get("builtin-baseline", "")) | |
| PY | |
| )" | |
| if [[ -z "$baseline" ]]; then | |
| echo "src/vcpkg.json must define builtin-baseline for CI." >&2 | |
| exit 1 | |
| fi | |
| echo "ref=$baseline" >> "$GITHUB_OUTPUT" | |
| - name: Checkout vcpkg | |
| run: | | |
| git clone --no-tags https://github.com/microsoft/vcpkg.git "$VCPKG_ROOT" | |
| git -C "$VCPKG_ROOT" checkout --detach "${{ steps.vcpkg-baseline.outputs.ref }}" | |
| - name: Bootstrap vcpkg | |
| run: | | |
| "$VCPKG_ROOT/bootstrap-vcpkg.sh" -disableMetrics | |
| - name: Prepare vcpkg binary cache | |
| run: mkdir -p "$VCPKG_DEFAULT_BINARY_CACHE" | |
| - name: Cache vcpkg binaries | |
| uses: actions/cache@v5 | |
| with: | |
| path: vcpkg-cache | |
| key: ${{ runner.os }}-${{ runner.arch }}-vcpkg-ios-simulator-${{ hashFiles('src/vcpkg.json', 'src/vcpkg-triplets/**') }} | |
| restore-keys: | | |
| ${{ runner.os }}-${{ runner.arch }}-vcpkg-ios-simulator- | |
| ${{ runner.os }}-${{ runner.arch }}-vcpkg- | |
| - name: Build Release | |
| run: ./scripts/build_ios.sh --disable-code-signing | |
| - name: Verify iOS app bundle | |
| run: | | |
| app="$(find build/ios -name 'Clipp.app' -type d -print -quit)" | |
| if [[ -z "$app" ]]; then | |
| echo "Could not find Clipp.app under build/ios." >&2 | |
| find build/ios -print | sed -n '1,200p' | |
| exit 1 | |
| fi | |
| echo "Verifying app bundle: $app" | |
| find "$app" -maxdepth 2 -print | sed -n '1,160p' | |
| # PrivacyInfo.xcprivacy rides the Clipp file-system-synchronized | |
| # folder; its presence here proves the sync-group pickup works | |
| # before a release run depends on it. | |
| for path in \ | |
| "$app/Clipp" \ | |
| "$app/Info.plist" \ | |
| "$app/Assets.car" \ | |
| "$app/PrivacyInfo.xcprivacy" | |
| do | |
| if [[ ! -e "$path" ]]; then | |
| echo "Missing expected bundle path: $path" >&2 | |
| exit 1 | |
| fi | |
| done | |
| if [[ ! -x "$app/Clipp" ]]; then | |
| echo "App executable is not executable: $app/Clipp" >&2 | |
| ls -l "$app" | |
| exit 1 | |
| fi |