Release #2
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Release | |
| on: | |
| push: | |
| tags: | |
| - "v*.*.*" | |
| workflow_dispatch: | |
| inputs: | |
| version: | |
| description: "Stable version without v, for example 0.1.0 (main only)" | |
| required: true | |
| type: string | |
| # One stable feed: never cancel a run midway through signing or publication. | |
| # GitHub may replace a pending run with another pending run; dispatch again if | |
| # several versions were queued. The monotonic-version check still prevents rollback. | |
| concurrency: | |
| group: chippytea-stable-release | |
| cancel-in-progress: false | |
| permissions: | |
| contents: read | |
| defaults: | |
| run: | |
| shell: bash | |
| jobs: | |
| validate: | |
| if: github.repository == 'richiemcilroy/chippytea' | |
| runs-on: ubuntu-24.04 | |
| timeout-minutes: 10 | |
| outputs: | |
| version: ${{ steps.plan.outputs.version }} | |
| tag: ${{ steps.plan.outputs.tag }} | |
| sha: ${{ steps.plan.outputs.sha }} | |
| steps: | |
| - name: Check out the triggering commit | |
| uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6 | |
| with: | |
| fetch-depth: 0 | |
| persist-credentials: false | |
| - name: Set up release tooling | |
| uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6 | |
| with: | |
| python-version: "3.12" | |
| - name: Test release safety checks | |
| run: python3 -B -m unittest discover -s scripts/release -p test_release.py -v | |
| - name: Validate source, version, tag, and previous channel | |
| id: plan | |
| env: | |
| GH_TOKEN: ${{ github.token }} | |
| RELEASE_INPUT_VERSION: ${{ inputs.version || '' }} | |
| run: | | |
| python3 -B scripts/release/release.py plan \ | |
| --output "$RUNNER_TEMP/release-plan.json" \ | |
| --github-output "$GITHUB_OUTPUT" | |
| release: | |
| needs: validate | |
| runs-on: macos-15 | |
| environment: release | |
| timeout-minutes: 100 | |
| permissions: | |
| contents: write | |
| env: | |
| DEVELOPER_DIR: /Applications/Xcode_26.2.app/Contents/Developer | |
| RELEASE_VERSION: ${{ needs.validate.outputs.version }} | |
| steps: | |
| - name: Check out the validated source commit | |
| uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6 | |
| with: | |
| ref: ${{ needs.validate.outputs.sha }} | |
| fetch-depth: 0 | |
| persist-credentials: false | |
| - name: Set up release tooling | |
| uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6 | |
| with: | |
| python-version: "3.12" | |
| - name: Configure isolated release paths | |
| run: | | |
| { | |
| printf '%s\n' "CHIPPYTEA_RELEASE_PLAN=$RUNNER_TEMP/release-plan.json" | |
| printf '%s\n' "CHIPPYTEA_RELEASE_LOG_DIR=$RUNNER_TEMP/chippytea-release-logs" | |
| } >> "$GITHUB_ENV" | |
| - name: Set up universal Rust targets | |
| run: | | |
| rustup toolchain install stable --profile minimal | |
| rustup default stable | |
| rustup target add aarch64-apple-darwin x86_64-apple-darwin | |
| - name: Recheck the channel before accessing signing secrets | |
| env: | |
| GH_TOKEN: ${{ github.token }} | |
| RELEASE_INPUT_VERSION: ${{ inputs.version || '' }} | |
| run: | | |
| python3 -B scripts/release/release.py plan --output "$CHIPPYTEA_RELEASE_PLAN" | |
| unset GH_TOKEN GITHUB_TOKEN | |
| python3 -B -m unittest discover -s scripts/release -p test_release.py -v | |
| env -u CARGO_TARGET_DIR -u CARGO_BUILD_TARGET_DIR \ | |
| cargo test --locked --target-dir "$RUNNER_TEMP/chippytea-release-checks" | |
| - name: Build, notarize, staple, and validate the signed update | |
| env: | |
| GH_TOKEN: ${{ github.token }} | |
| APPLE_CERTIFICATE_P12_BASE64: ${{ secrets.APPLE_CERTIFICATE_P12_BASE64 }} | |
| APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }} | |
| APPLE_SIGNING_IDENTITY: ${{ vars.APPLE_SIGNING_IDENTITY || secrets.APPLE_SIGNING_IDENTITY }} | |
| APPLE_TEAM_ID: ${{ vars.APPLE_TEAM_ID || secrets.APPLE_TEAM_ID }} | |
| APPLE_ID: ${{ secrets.APPLE_ID }} | |
| APPLE_APP_SPECIFIC_PASSWORD: ${{ secrets.APPLE_APP_SPECIFIC_PASSWORD }} | |
| ASC_KEY_ID: ${{ secrets.ASC_KEY_ID }} | |
| ASC_ISSUER_ID: ${{ secrets.ASC_ISSUER_ID }} | |
| ASC_PRIVATE_KEY: ${{ secrets.ASC_PRIVATE_KEY }} | |
| SPARKLE_PRIVATE_KEY: ${{ secrets.SPARKLE_PRIVATE_KEY }} | |
| run: | | |
| bash scripts/release/build-release.sh "$RELEASE_VERSION" \ | |
| "$RUNNER_TEMP/chippytea-release-output" | |
| - name: Preserve the verified release artifacts | |
| uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6 | |
| with: | |
| name: chippytea-${{ needs.validate.outputs.version }}-${{ needs.validate.outputs.sha }} | |
| path: | | |
| ${{ runner.temp }}/chippytea-release-output/chippytea-${{ needs.validate.outputs.version }}-universal.dmg | |
| ${{ runner.temp }}/chippytea-release-output/chippytea-${{ needs.validate.outputs.version }}-universal.zip | |
| ${{ runner.temp }}/chippytea-release-output/appcast.xml | |
| ${{ runner.temp }}/chippytea-release-output/release-notes.md | |
| ${{ runner.temp }}/chippytea-release-output/release.json | |
| ${{ runner.temp }}/chippytea-release-output/SHA256SUMS | |
| if-no-files-found: error | |
| retention-days: 14 | |
| - name: Publish verified draft assets and advance the public feed | |
| env: | |
| GH_TOKEN: ${{ github.token }} | |
| run: | | |
| python3 -B scripts/release/release.py publish \ | |
| --plan "$CHIPPYTEA_RELEASE_PLAN" \ | |
| --artifacts "$RUNNER_TEMP/chippytea-release-output" | |
| - name: Preserve notarization diagnostics on failure | |
| if: failure() | |
| uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6 | |
| with: | |
| name: notarization-diagnostics-${{ needs.validate.outputs.version }} | |
| path: ${{ runner.temp }}/chippytea-release-logs/notary-*.json | |
| if-no-files-found: ignore | |
| retention-days: 7 |