fix(newm-admin): Add macOS code signing and notarization #8
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # Release workflow for NEWM Admin - runs only on version tags (v*) | |
| # For CI on PRs/pushes, see newm-admin.yml | |
| on: | |
| push: | |
| tags: | |
| - 'v*' | |
| name: NEWM Admin Release | |
| jobs: | |
| build: | |
| name: Build | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| job: | |
| - { os: ubuntu-24.04, label: ubuntu24, target: x86_64-unknown-linux-gnu } | |
| - { os: macos-latest, label: macos, target: aarch64-apple-darwin } | |
| - { os: windows-latest, label: windows, target: x86_64-pc-windows-msvc } | |
| rust: [ stable ] | |
| runs-on: ${{ matrix.job.os }} | |
| defaults: | |
| run: | |
| working-directory: newm-admin | |
| steps: | |
| - name: Checkout sources | |
| uses: actions/checkout@v4 | |
| - name: Install stable toolchain | |
| uses: dtolnay/rust-toolchain@stable | |
| with: | |
| toolchain: stable | |
| components: rustfmt, clippy | |
| - name: Setup Rust cache | |
| uses: Swatinem/rust-cache@v2 | |
| with: | |
| workspaces: "newm-admin -> target" | |
| - name: Install Linux dependencies | |
| if: runner.os == 'Linux' | |
| run: | | |
| sudo apt-get update | |
| sudo apt-get install -y libxkbcommon-x11-dev libxkbcommon-dev libwayland-dev libfuse2 | |
| - name: Run cargo check | |
| if: ${{ matrix.job.target == 'x86_64-unknown-linux-gnu' }} | |
| run: cargo check | |
| - name: Run cargo fmt | |
| if: ${{ matrix.job.target == 'x86_64-unknown-linux-gnu' }} | |
| run: cargo fmt --all -- --check | |
| - name: Run cargo clippy | |
| run: cargo clippy --release --target ${{ matrix.job.target }} -- -D warnings | |
| - name: Run cargo test | |
| run: cargo test --release --target ${{ matrix.job.target }} | |
| - name: Build Release | |
| run: cargo build --release --target ${{ matrix.job.target }} --locked | |
| - name: Package (basic archive) | |
| id: package | |
| shell: bash | |
| run: | | |
| PROJECT_NAME=$(sed -n 's/^name = "\(.*\)"/\1/p' Cargo.toml) | |
| PROJECT_VERSION=$(sed -n 's/^version = "\(.*\)"/\1/p' Cargo.toml | head -n1) | |
| if [[ "${{ matrix.job.target }}" == *-pc-windows-* ]]; then | |
| PKG_SUFFIX=".zip" | |
| else | |
| PKG_SUFFIX=".tar.gz" | |
| fi | |
| PKG_NAME=${PROJECT_NAME}-${PROJECT_VERSION}-${{ matrix.job.label }}-${{ matrix.job.target }}${PKG_SUFFIX} | |
| if [[ "${{ matrix.job.target }}" == *-pc-windows-* ]]; then | |
| 7z -y a "${PKG_NAME}" ./target/${{matrix.job.target}}/release/newm-admin.exe | tail -2 | |
| else | |
| tar -C target/${{matrix.job.target}}/release -czf "${PKG_NAME}" newm-admin | |
| fi | |
| echo "PKG_NAME=${PKG_NAME}" >> $GITHUB_OUTPUT | |
| echo "PKG_PATH=${PKG_NAME}" >> $GITHUB_OUTPUT | |
| echo "PROJECT_VERSION=${PROJECT_VERSION}" >> $GITHUB_OUTPUT | |
| - name: Upload Artifacts (basic archive) | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: ${{ steps.package.outputs.PKG_NAME }} | |
| path: newm-admin/${{ steps.package.outputs.PKG_PATH }} | |
| package-macos: | |
| name: Package macOS DMG (Universal) | |
| needs: build | |
| runs-on: macos-latest | |
| defaults: | |
| run: | |
| working-directory: newm-admin | |
| steps: | |
| - name: Checkout sources | |
| uses: actions/checkout@v4 | |
| - name: Install stable toolchain | |
| uses: dtolnay/rust-toolchain@stable | |
| with: | |
| toolchain: stable | |
| targets: aarch64-apple-darwin,x86_64-apple-darwin | |
| - name: Setup Rust cache | |
| uses: Swatinem/rust-cache@v2 | |
| with: | |
| workspaces: "newm-admin -> target" | |
| - name: Install create-dmg | |
| run: brew install create-dmg | |
| - name: Build ARM64 (Apple Silicon) | |
| run: cargo build --release --target aarch64-apple-darwin --locked | |
| - name: Build x86_64 (Intel) | |
| run: cargo build --release --target x86_64-apple-darwin --locked | |
| - name: Get version | |
| id: version | |
| run: | | |
| VERSION=$(sed -n 's/^version = "\(.*\)"/\1/p' Cargo.toml | head -n1) | |
| echo "VERSION=${VERSION}" >> $GITHUB_OUTPUT | |
| - name: Import Code Signing Certificate | |
| env: | |
| MACOS_CERTIFICATE: ${{ secrets.MACOS_CERTIFICATE }} | |
| MACOS_CERTIFICATE_PWD: ${{ secrets.MACOS_CERTIFICATE_PWD }} | |
| KEYCHAIN_PASSWORD: ${{ secrets.KEYCHAIN_PASSWORD }} | |
| run: | | |
| # Create a temporary keychain | |
| security create-keychain -p "$KEYCHAIN_PASSWORD" build.keychain | |
| security default-keychain -s build.keychain | |
| security unlock-keychain -p "$KEYCHAIN_PASSWORD" build.keychain | |
| security set-keychain-settings -t 3600 -u build.keychain | |
| # Import certificate | |
| echo "$MACOS_CERTIFICATE" | base64 --decode > certificate.p12 | |
| security import certificate.p12 -k build.keychain -P "$MACOS_CERTIFICATE_PWD" -T /usr/bin/codesign -T /usr/bin/security | |
| security set-key-partition-list -S apple-tool:,apple:,codesign: -s -k "$KEYCHAIN_PASSWORD" build.keychain | |
| # Verify certificate was imported | |
| security find-identity -v -p codesigning build.keychain | |
| # Clean up certificate file | |
| rm certificate.p12 | |
| - name: Create Universal App Bundle and DMG | |
| env: | |
| MACOS_SIGNING_IDENTITY: ${{ secrets.MACOS_SIGNING_IDENTITY }} | |
| run: | | |
| chmod +x packaging/macos/bundle.sh | |
| packaging/macos/bundle.sh ${{ steps.version.outputs.VERSION }} aarch64-apple-darwin | |
| - name: Notarize App | |
| env: | |
| APPLE_ID: ${{ secrets.APPLE_ID }} | |
| APPLE_APP_PASSWORD: ${{ secrets.APPLE_APP_PASSWORD }} | |
| APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }} | |
| run: | | |
| DMG_PATH="target/aarch64-apple-darwin/release/NEWM-Admin-${{ steps.version.outputs.VERSION }}-macos.dmg" | |
| echo "Submitting DMG for notarization..." | |
| xcrun notarytool submit "$DMG_PATH" \ | |
| --apple-id "$APPLE_ID" \ | |
| --password "$APPLE_APP_PASSWORD" \ | |
| --team-id "$APPLE_TEAM_ID" \ | |
| --wait | |
| echo "Stapling notarization ticket to DMG..." | |
| xcrun stapler staple "$DMG_PATH" | |
| echo "Verifying notarization..." | |
| xcrun stapler validate "$DMG_PATH" | |
| - name: Upload DMG | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: NEWM-Admin-${{ steps.version.outputs.VERSION }}-macos.dmg | |
| path: newm-admin/target/aarch64-apple-darwin/release/NEWM-Admin-${{ steps.version.outputs.VERSION }}-macos.dmg | |
| package-linux: | |
| name: Package Linux AppImage | |
| needs: build | |
| runs-on: ubuntu-22.04 | |
| defaults: | |
| run: | |
| working-directory: newm-admin | |
| steps: | |
| - name: Checkout sources | |
| uses: actions/checkout@v4 | |
| - name: Install stable toolchain | |
| uses: dtolnay/rust-toolchain@stable | |
| with: | |
| toolchain: stable | |
| - name: Setup Rust cache | |
| uses: Swatinem/rust-cache@v2 | |
| with: | |
| workspaces: "newm-admin -> target" | |
| - name: Install Linux dependencies | |
| run: | | |
| sudo apt-get update | |
| sudo apt-get install -y libxkbcommon-x11-dev libxkbcommon-dev libwayland-dev libfuse2 | |
| - name: Build Release | |
| run: cargo build --release --target x86_64-unknown-linux-gnu --locked | |
| - name: Get version | |
| id: version | |
| run: | | |
| VERSION=$(sed -n 's/^version = "\(.*\)"/\1/p' Cargo.toml | head -n1) | |
| echo "VERSION=${VERSION}" >> $GITHUB_OUTPUT | |
| - name: Create AppImage | |
| run: | | |
| chmod +x packaging/linux/build-appimage.sh | |
| packaging/linux/build-appimage.sh ${{ steps.version.outputs.VERSION }} x86_64-unknown-linux-gnu | |
| - name: Upload AppImage | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: NEWM-Admin-${{ steps.version.outputs.VERSION }}-x86_64.AppImage | |
| path: newm-admin/target/x86_64-unknown-linux-gnu/release/NEWM-Admin-${{ steps.version.outputs.VERSION }}-x86_64.AppImage | |
| package-windows: | |
| name: Package Windows MSI | |
| needs: build | |
| runs-on: windows-latest | |
| defaults: | |
| run: | |
| working-directory: newm-admin | |
| steps: | |
| - name: Checkout sources | |
| uses: actions/checkout@v4 | |
| - name: Install stable toolchain | |
| uses: dtolnay/rust-toolchain@stable | |
| with: | |
| toolchain: stable | |
| - name: Setup Rust cache | |
| uses: Swatinem/rust-cache@v2 | |
| with: | |
| workspaces: "newm-admin -> target" | |
| - name: Install WiX Toolset | |
| run: | | |
| dotnet tool install --global wix | |
| cargo install cargo-wix | |
| - name: Build Release | |
| run: cargo build --release --target x86_64-pc-windows-msvc --locked | |
| - name: Get version | |
| id: version | |
| shell: bash | |
| run: | | |
| VERSION=$(sed -n 's/^version = "\(.*\)"/\1/p' Cargo.toml | head -n1) | |
| echo "VERSION=${VERSION}" >> $GITHUB_OUTPUT | |
| - name: Build MSI | |
| shell: pwsh | |
| run: | | |
| ./packaging/windows/build-msi.ps1 -Version "${{ steps.version.outputs.VERSION }}" -Target "x86_64-pc-windows-msvc" | |
| - name: Upload MSI | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: NEWM-Admin-${{ steps.version.outputs.VERSION }}-windows.msi | |
| path: newm-admin/target/x86_64-pc-windows-msvc/release/NEWM-Admin-${{ steps.version.outputs.VERSION }}-windows.msi | |
| release: | |
| name: Create Release | |
| needs: [package-macos, package-linux, package-windows] | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout sources | |
| uses: actions/checkout@v4 | |
| - name: Get version | |
| id: version | |
| run: | | |
| VERSION=$(sed -n 's/^version = "\(.*\)"/\1/p' newm-admin/Cargo.toml | head -n1) | |
| echo "VERSION=${VERSION}" >> $GITHUB_OUTPUT | |
| - name: Download all artifacts | |
| uses: actions/download-artifact@v4 | |
| with: | |
| path: artifacts | |
| - name: List artifacts | |
| run: find artifacts -type f | |
| - name: Create Release | |
| uses: softprops/action-gh-release@v2 | |
| with: | |
| name: NEWM Admin v${{ steps.version.outputs.VERSION }} | |
| prerelease: ${{ contains(github.ref, 'alpha') || contains(github.ref, 'beta') || contains(github.ref, 'rc') }} | |
| files: | | |
| artifacts/**/*.dmg | |
| artifacts/**/*.AppImage | |
| artifacts/**/*.msi | |
| artifacts/**/*.tar.gz | |
| artifacts/**/*.zip | |
| env: | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} |