Keep Cloud View dormant on launch #29
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: release | |
| on: | |
| push: | |
| tags: | |
| - "v*" | |
| permissions: | |
| contents: write | |
| concurrency: | |
| group: release-${{ github.ref }} | |
| cancel-in-progress: false | |
| jobs: | |
| macos: | |
| runs-on: macos-15 | |
| timeout-minutes: 90 | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 | |
| - name: Verify release version | |
| run: | | |
| version=$(/usr/libexec/PlistBuddy -c 'Print :CFBundleShortVersionString' Resources/Info.plist) | |
| test "$GITHUB_REF_NAME" = "v$version" | |
| - name: Test core behavior | |
| run: ./Scripts/test.sh | |
| - name: Build notarized release and signed update feed | |
| env: | |
| APPLE_APP_SPECIFIC_PASSWORD: ${{ secrets.APPLE_APP_SPECIFIC_PASSWORD }} | |
| APPLE_DEVELOPER_ID_CERTIFICATE: ${{ secrets.APPLE_DEVELOPER_ID_CERTIFICATE }} | |
| APPLE_DEVELOPER_ID_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_DEVELOPER_ID_CERTIFICATE_PASSWORD }} | |
| APPLE_ID: ${{ secrets.APPLE_ID }} | |
| APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }} | |
| CODEWINDOW_POSTHOG_KEY: ${{ secrets.CODEWINDOW_POSTHOG_KEY }} | |
| CODEWINDOW_POSTHOG_HOST: ${{ vars.CODEWINDOW_POSTHOG_HOST }} | |
| SPARKLE_PRIVATE_KEY: ${{ secrets.SPARKLE_PRIVATE_KEY }} | |
| run: | | |
| set -euo pipefail | |
| for variable in \ | |
| APPLE_APP_SPECIFIC_PASSWORD \ | |
| APPLE_DEVELOPER_ID_CERTIFICATE \ | |
| APPLE_DEVELOPER_ID_CERTIFICATE_PASSWORD \ | |
| APPLE_ID \ | |
| APPLE_TEAM_ID \ | |
| CODEWINDOW_POSTHOG_KEY \ | |
| SPARKLE_PRIVATE_KEY; do | |
| test -n "${!variable}" | |
| done | |
| certificate_path="$RUNNER_TEMP/codewindow-developer-id.p12" | |
| keychain_path="$RUNNER_TEMP/codewindow-signing.keychain-db" | |
| keychain_password="$(uuidgen)" | |
| cleanup() { | |
| security delete-keychain "$keychain_path" >/dev/null 2>&1 || true | |
| /usr/bin/find "$certificate_path" -delete 2>/dev/null || true | |
| } | |
| trap cleanup EXIT | |
| printf '%s' "$APPLE_DEVELOPER_ID_CERTIFICATE" | /usr/bin/base64 --decode > "$certificate_path" | |
| security create-keychain -p "$keychain_password" "$keychain_path" | |
| security set-keychain-settings -lut 21600 "$keychain_path" | |
| security unlock-keychain -p "$keychain_password" "$keychain_path" | |
| security import "$certificate_path" \ | |
| -k "$keychain_path" \ | |
| -P "$APPLE_DEVELOPER_ID_CERTIFICATE_PASSWORD" \ | |
| -T /usr/bin/codesign | |
| security set-key-partition-list \ | |
| -S apple-tool:,apple:,codesign: \ | |
| -s \ | |
| -k "$keychain_password" \ | |
| "$keychain_path" | |
| security list-keychains -d user -s "$keychain_path" | |
| xcrun notarytool store-credentials codewindow-ci \ | |
| --apple-id "$APPLE_ID" \ | |
| --team-id "$APPLE_TEAM_ID" \ | |
| --password "$APPLE_APP_SPECIFIC_PASSWORD" \ | |
| --keychain "$keychain_path" | |
| signing_identity="$(security find-identity -v -p codesigning "$keychain_path" | awk '/Developer ID Application:/ { print $2; exit }')" | |
| test -n "$signing_identity" | |
| export CODEWINDOW_EXPECTED_TEAM_ID="$APPLE_TEAM_ID" | |
| export CODEWINDOW_NOTARY_KEYCHAIN="$keychain_path" | |
| export CODEWINDOW_NOTARY_PROFILE="codewindow-ci" | |
| export CODEWINDOW_REQUIRE_NOTARIZATION=1 | |
| export CODEWINDOW_SIGN_IDENTITY="$signing_identity" | |
| ./Scripts/package-release.sh | |
| test -s build/appcast.xml | |
| test -s build/notary-log.json | |
| test -s build/dmg-notary-log.json | |
| xcrun stapler validate build/CodeWindow.app | |
| spctl --assess --type execute --verbose=4 build/CodeWindow.app | |
| - name: Verify distributable disk image | |
| run: | | |
| set -euo pipefail | |
| version=$(/usr/libexec/PlistBuddy -c 'Print :CFBundleShortVersionString' Resources/Info.plist) | |
| disk_image="build/CodeWindow-v${version}-macOS-universal.dmg" | |
| test -s "$disk_image" | |
| (cd build && shasum -a 256 -c "CodeWindow-v${version}-macOS-universal.dmg.sha256") | |
| xcrun stapler validate "$disk_image" | |
| codesign --verify --strict --verbose=2 "$disk_image" | |
| spctl --assess --type open --context context:primary-signature --verbose=4 "$disk_image" | |
| mount_point="$RUNNER_TEMP/codewindow-dmg" | |
| mkdir -p "$mount_point" | |
| cleanup_mount() { | |
| hdiutil detach "$mount_point" >/dev/null 2>&1 || true | |
| } | |
| trap cleanup_mount EXIT | |
| hdiutil attach -readonly -nobrowse -mountpoint "$mount_point" "$disk_image" >/dev/null | |
| test -d "$mount_point/CodeWindow.app" | |
| test -L "$mount_point/Applications" | |
| test "$(readlink "$mount_point/Applications")" = "/Applications" | |
| cmp "$mount_point/.DS_Store" Resources/DMG/.DS_Store | |
| test ! -e "$mount_point/.background" | |
| xcrun stapler validate "$mount_point/CodeWindow.app" | |
| codesign --verify --deep --strict --verbose=2 "$mount_point/CodeWindow.app" | |
| spctl --assess --type execute --verbose=4 "$mount_point/CodeWindow.app" | |
| cleanup_mount | |
| trap - EXIT | |
| - name: Publish GitHub release | |
| env: | |
| GH_TOKEN: ${{ github.token }} | |
| run: | | |
| version=$(/usr/libexec/PlistBuddy -c 'Print :CFBundleShortVersionString' Resources/Info.plist) | |
| gh release create "$GITHUB_REF_NAME" \ | |
| "build/CodeWindow-v${version}-macOS-universal.zip" \ | |
| "build/CodeWindow-v${version}-macOS-universal.zip.sha256" \ | |
| "build/CodeWindow-v${version}-macOS-universal.dmg" \ | |
| "build/CodeWindow-v${version}-macOS-universal.dmg.sha256" \ | |
| build/appcast.xml \ | |
| --verify-tag \ | |
| --title "CodeWindow $version" \ | |
| --generate-notes |