alic/.github/workflows/build.yml at 96a91a4e70d1baebb603bfef51c6f2b4b3a9c809 · blopker/alic · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
name: "build"

# Single workflow for both CI builds and releases so the two can't diverge.
#
# - `build` job runs on every push that ISN'T a release: build + test the
#   universal macOS app and upload the artifacts to the workflow run. Unsigned,
#   and runs with a read-only token (no signing secrets).
# - `release` job runs ONLY on the `release` branch (created by `make release`):
#   it gets a `contents: write` token, imports the Apple Developer certificate,
#   notarizes, and creates a draft GitHub release.
#
# The two jobs are mutually exclusive (one runs per push) and share the same
# setup steps so they stay in sync while keeping least-privilege separation.

on:
  push:

# Least privilege by default; only the release job opts up to contents: write.
permissions:
  contents: read

jobs:
  build:
    if: github.ref != 'refs/heads/release'
    runs-on: macos-latest
    steps:
      - uses: actions/checkout@v6
        with:
          persist-credentials: false

      - uses: oven-sh/setup-bun@v2
        with:
          bun-version: latest

      - name: install Rust stable
        uses: dtolnay/rust-toolchain@stable
        with:
          targets: aarch64-apple-darwin,x86_64-apple-darwin

      - name: Rust cache
        uses: swatinem/rust-cache@v2
        with:
          workspaces: "./src-tauri -> target"
          cache-on-failure: true

      - name: install frontend dependencies
        run: bun install --frozen-lockfile

      - name: test cargo build
        run: cd src-tauri && cargo test

      - name: build universal app (unsigned)
        uses: tauri-apps/tauri-action@v0.6.2
        env:
          # CI=false so tauri's DMG bundler renders the background image correctly
          # (CI=true causes hdiutil to skip the background/icon layout stage)
          # See: https://github.com/tauri-apps/tauri-action/issues/740
          CI: false
        with:
          args: --target universal-apple-darwin
          uploadWorkflowArtifacts: true

  release:
    if: github.ref == 'refs/heads/release'
    permissions:
      contents: write
    runs-on: macos-latest
    steps:
      - uses: actions/checkout@v6
        with:
          persist-credentials: false

      - uses: oven-sh/setup-bun@v2
        with:
          bun-version: latest

      - name: install Rust stable
        uses: dtolnay/rust-toolchain@stable
        with:
          targets: aarch64-apple-darwin,x86_64-apple-darwin

      - name: Rust cache
        uses: swatinem/rust-cache@v2
        with:
          workspaces: "./src-tauri -> target"
          cache-on-failure: true

      - name: install frontend dependencies
        run: bun install --frozen-lockfile

      - name: test cargo build
        run: cd src-tauri && cargo test

      - name: import Apple Developer Certificate
        # Prevents keychain from locking automatically for 3600 seconds.
        env:
          APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }}
          APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
          KEYCHAIN_PASSWORD: ${{ secrets.KEYCHAIN_PASSWORD }}
        run: |
          echo $APPLE_CERTIFICATE | base64 --decode > certificate.p12
          security create-keychain -p "$KEYCHAIN_PASSWORD" build.keychain
          security default-keychain -s build.keychain
          security unlock-keychain -p "$KEYCHAIN_PASSWORD" build.keychain
          security set-keychain-settings -t 3600 -u build.keychain
          security import certificate.p12 -k build.keychain -P "$APPLE_CERTIFICATE_PASSWORD" -T /usr/bin/codesign
          security set-key-partition-list -S apple-tool:,apple:,codesign: -s -k "$KEYCHAIN_PASSWORD" build.keychain
          security find-identity -v -p codesigning build.keychain

      - name: verify certificate
        run: |
          CERT_INFO=$(security find-identity -v -p codesigning build.keychain | grep "Developer ID Application")
          CERT_ID=$(echo "$CERT_INFO" | awk -F'"' '{print $2}')
          echo "CERT_ID=$CERT_ID" >> $GITHUB_ENV
          echo "Certificate imported."

      - name: build and publish a draft release
        uses: tauri-apps/tauri-action@v0.6.2
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          APPLE_ID: ${{ secrets.APPLE_ID }}
          APPLE_ID_PASSWORD: ${{ secrets.APPLE_ID_PASSWORD }}
          APPLE_PASSWORD: ${{ secrets.APPLE_PASSWORD }}
          APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
          APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }}
          APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
          APPLE_SIGNING_IDENTITY: ${{ env.CERT_ID }}
          TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
          TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
          # CI=false so tauri's DMG bundler renders the background image correctly
          # (CI=true causes hdiutil to skip the background/icon layout stage)
          # See: https://github.com/tauri-apps/tauri-action/issues/740
          CI: false
        with:
          tagName: app-v__VERSION__ # the action automatically replaces __VERSION__ with the app version.
          releaseName: "App v__VERSION__"
          releaseBody: |
            See the assets to download this version and install.

            Use `Alic.Image.Compressor___VERSION___universal.dmg` for both Apple Silicon and Intel Macs.

            [Changelog](https://github.com/blopker/alic/blob/main/CHANGELOG.md)
          releaseDraft: true
          prerelease: false
          uploadWorkflowArtifacts: true
          args: --target universal-apple-darwin