v2.4.10 #253
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: "build" | |
| # Single workflow for both CI builds and releases so the two can't diverge. | |
| # | |
| # - `build` job runs on every push that ISN'T a release: build + test the | |
| # universal macOS app and upload the artifacts to the workflow run. Unsigned, | |
| # and runs with a read-only token (no signing secrets). | |
| # - `release` job runs ONLY on the `release` branch (created by `make release`): | |
| # it gets a `contents: write` token, imports the Apple Developer certificate, | |
| # notarizes, and creates a draft GitHub release. | |
| # | |
| # The two jobs are mutually exclusive (one runs per push) and share the same | |
| # setup steps so they stay in sync while keeping least-privilege separation. | |
| on: | |
| push: | |
| # Least privilege by default; only the release job opts up to contents: write. | |
| permissions: | |
| contents: read | |
| jobs: | |
| build: | |
| if: github.ref != 'refs/heads/release' | |
| runs-on: macos-latest | |
| steps: | |
| - uses: actions/checkout@v6 | |
| with: | |
| persist-credentials: false | |
| - uses: oven-sh/setup-bun@v2 | |
| with: | |
| bun-version: latest | |
| - name: install Rust stable | |
| uses: dtolnay/rust-toolchain@stable | |
| with: | |
| targets: aarch64-apple-darwin,x86_64-apple-darwin | |
| - name: Rust cache | |
| uses: swatinem/rust-cache@v2 | |
| with: | |
| workspaces: "./src-tauri -> target" | |
| cache-on-failure: true | |
| - name: install frontend dependencies | |
| run: bun install --frozen-lockfile | |
| - name: test cargo build | |
| run: cd src-tauri && cargo test | |
| - name: build universal app (unsigned) | |
| id: tauri | |
| uses: tauri-apps/tauri-action@v0.6.2 | |
| env: | |
| # CI=false so tauri's DMG bundler renders the background image correctly | |
| # (CI=true causes hdiutil to skip the background/icon layout stage) | |
| # See: https://github.com/tauri-apps/tauri-action/issues/740 | |
| CI: false | |
| with: | |
| # CI has no TAURI_SIGNING_PRIVATE_KEY (least privilege), so disable updater | |
| # artifact generation — tauri.conf.json's createUpdaterArtifacts otherwise | |
| # tries to sign the .app.tar.gz and fails. The .app/.dmg still build. | |
| args: '--target universal-apple-darwin --config {"bundle":{"createUpdaterArtifacts":false}}' | |
| # tauri-action's own `uploadWorkflowArtifacts` input is unreleased (dev only), | |
| # so we upload its `artifactPaths` output (a JSON array) ourselves. | |
| - name: collect artifact paths | |
| id: artifacts | |
| run: | | |
| { | |
| echo 'paths<<EOF' | |
| jq -r '.[]' <<< '${{ steps.tauri.outputs.artifactPaths }}' | |
| echo 'EOF' | |
| } >> "$GITHUB_OUTPUT" | |
| - name: upload workflow artifacts | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: alic-universal | |
| path: ${{ steps.artifacts.outputs.paths }} | |
| if-no-files-found: error | |
| release: | |
| if: github.ref == 'refs/heads/release' | |
| permissions: | |
| contents: write | |
| runs-on: macos-latest | |
| steps: | |
| - uses: actions/checkout@v6 | |
| with: | |
| persist-credentials: false | |
| - uses: oven-sh/setup-bun@v2 | |
| with: | |
| bun-version: latest | |
| - name: install Rust stable | |
| uses: dtolnay/rust-toolchain@stable | |
| with: | |
| targets: aarch64-apple-darwin,x86_64-apple-darwin | |
| - name: Rust cache | |
| uses: swatinem/rust-cache@v2 | |
| with: | |
| workspaces: "./src-tauri -> target" | |
| cache-on-failure: true | |
| - name: install frontend dependencies | |
| run: bun install --frozen-lockfile | |
| - name: test cargo build | |
| run: cd src-tauri && cargo test | |
| - name: import Apple Developer Certificate | |
| # Prevents keychain from locking automatically for 3600 seconds. | |
| env: | |
| APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }} | |
| APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }} | |
| KEYCHAIN_PASSWORD: ${{ secrets.KEYCHAIN_PASSWORD }} | |
| run: | | |
| echo $APPLE_CERTIFICATE | base64 --decode > certificate.p12 | |
| security create-keychain -p "$KEYCHAIN_PASSWORD" build.keychain | |
| security default-keychain -s build.keychain | |
| security unlock-keychain -p "$KEYCHAIN_PASSWORD" build.keychain | |
| security set-keychain-settings -t 3600 -u build.keychain | |
| security import certificate.p12 -k build.keychain -P "$APPLE_CERTIFICATE_PASSWORD" -T /usr/bin/codesign | |
| security set-key-partition-list -S apple-tool:,apple:,codesign: -s -k "$KEYCHAIN_PASSWORD" build.keychain | |
| security find-identity -v -p codesigning build.keychain | |
| - name: verify certificate | |
| run: | | |
| CERT_INFO=$(security find-identity -v -p codesigning build.keychain | grep "Developer ID Application") | |
| CERT_ID=$(echo "$CERT_INFO" | awk -F'"' '{print $2}') | |
| echo "CERT_ID=$CERT_ID" >> $GITHUB_ENV | |
| echo "Certificate imported." | |
| - name: build and publish a draft release | |
| id: tauri | |
| uses: tauri-apps/tauri-action@v0.6.2 | |
| env: | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| APPLE_ID: ${{ secrets.APPLE_ID }} | |
| APPLE_ID_PASSWORD: ${{ secrets.APPLE_ID_PASSWORD }} | |
| APPLE_PASSWORD: ${{ secrets.APPLE_PASSWORD }} | |
| APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }} | |
| APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }} | |
| APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }} | |
| APPLE_SIGNING_IDENTITY: ${{ env.CERT_ID }} | |
| TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }} | |
| TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }} | |
| # CI=false so tauri's DMG bundler renders the background image correctly | |
| # (CI=true causes hdiutil to skip the background/icon layout stage) | |
| # See: https://github.com/tauri-apps/tauri-action/issues/740 | |
| CI: false | |
| with: | |
| tagName: app-v__VERSION__ # the action automatically replaces __VERSION__ with the app version. | |
| releaseName: "App v__VERSION__" | |
| releaseBody: | | |
| See the assets to download this version and install. | |
| Use `Alic.Image.Compressor___VERSION___universal.dmg` for both Apple Silicon and Intel Macs. | |
| [Changelog](https://github.com/blopker/alic/blob/main/CHANGELOG.md) | |
| releaseDraft: true | |
| prerelease: false | |
| args: --target universal-apple-darwin | |
| # See note in the build job: replace the unreleased `uploadWorkflowArtifacts` | |
| # input by uploading the action's `artifactPaths` output ourselves. | |
| - name: collect artifact paths | |
| id: artifacts | |
| run: | | |
| { | |
| echo 'paths<<EOF' | |
| jq -r '.[]' <<< '${{ steps.tauri.outputs.artifactPaths }}' | |
| echo 'EOF' | |
| } >> "$GITHUB_OUTPUT" | |
| - name: upload workflow artifacts | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: alic-universal | |
| path: ${{ steps.artifacts.outputs.paths }} | |
| if-no-files-found: error |