|
| 1 | +name: Build and Release |
| 2 | + |
| 3 | +on: |
| 4 | + push: |
| 5 | + tags: |
| 6 | + - 'v*' |
| 7 | + workflow_dispatch: |
| 8 | + |
| 9 | +jobs: |
| 10 | + build: |
| 11 | + runs-on: macos-latest |
| 12 | + |
| 13 | + steps: |
| 14 | + - name: Checkout |
| 15 | + uses: actions/checkout@v4 |
| 16 | + |
| 17 | + - name: Install certificate |
| 18 | + env: |
| 19 | + CERTIFICATE_BASE64: ${{ secrets.APPLE_CERTIFICATE_BASE64 }} |
| 20 | + CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }} |
| 21 | + KEYCHAIN_PASSWORD: ${{ github.run_id }} |
| 22 | + run: | |
| 23 | + # Create variables |
| 24 | + CERTIFICATE_PATH=$RUNNER_TEMP/certificate.p12 |
| 25 | + KEYCHAIN_PATH=$RUNNER_TEMP/app-signing.keychain-db |
| 26 | +
|
| 27 | + # Decode certificate |
| 28 | + echo -n "$CERTIFICATE_BASE64" | base64 --decode -o $CERTIFICATE_PATH |
| 29 | +
|
| 30 | + # Create temporary keychain |
| 31 | + security create-keychain -p "$KEYCHAIN_PASSWORD" $KEYCHAIN_PATH |
| 32 | + security set-keychain-settings -lut 21600 $KEYCHAIN_PATH |
| 33 | + security unlock-keychain -p "$KEYCHAIN_PASSWORD" $KEYCHAIN_PATH |
| 34 | +
|
| 35 | + # Import certificate |
| 36 | + security import $CERTIFICATE_PATH -P "$CERTIFICATE_PASSWORD" -A -t cert -f pkcs12 -k $KEYCHAIN_PATH |
| 37 | + security set-key-partition-list -S apple-tool:,apple: -k "$KEYCHAIN_PASSWORD" $KEYCHAIN_PATH |
| 38 | + security list-keychain -d user -s $KEYCHAIN_PATH |
| 39 | +
|
| 40 | + - name: Build and Archive |
| 41 | + env: |
| 42 | + TEAM_ID: ${{ secrets.APPLE_TEAM_ID }} |
| 43 | + run: | |
| 44 | + xcodebuild archive \ |
| 45 | + -project "CF Cache Status/CF Cache Status.xcodeproj" \ |
| 46 | + -scheme "CF Cache Status" \ |
| 47 | + -archivePath $RUNNER_TEMP/CacheStatus.xcarchive \ |
| 48 | + DEVELOPMENT_TEAM="$TEAM_ID" \ |
| 49 | + CODE_SIGN_STYLE=Manual \ |
| 50 | + CODE_SIGN_IDENTITY="Developer ID Application" |
| 51 | +
|
| 52 | + - name: Export App |
| 53 | + run: | |
| 54 | + # Create export options plist |
| 55 | + cat > $RUNNER_TEMP/ExportOptions.plist << EOF |
| 56 | + <?xml version="1.0" encoding="UTF-8"?> |
| 57 | + <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"> |
| 58 | + <plist version="1.0"> |
| 59 | + <dict> |
| 60 | + <key>method</key> |
| 61 | + <string>developer-id</string> |
| 62 | + <key>teamID</key> |
| 63 | + <string>${{ secrets.APPLE_TEAM_ID }}</string> |
| 64 | + </dict> |
| 65 | + </plist> |
| 66 | + EOF |
| 67 | +
|
| 68 | + xcodebuild -exportArchive \ |
| 69 | + -archivePath $RUNNER_TEMP/CacheStatus.xcarchive \ |
| 70 | + -exportPath $RUNNER_TEMP/export \ |
| 71 | + -exportOptionsPlist $RUNNER_TEMP/ExportOptions.plist |
| 72 | +
|
| 73 | + - name: Notarize App |
| 74 | + env: |
| 75 | + APPLE_ID: ${{ secrets.APPLE_ID }} |
| 76 | + APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }} |
| 77 | + APPLE_APP_PASSWORD: ${{ secrets.APPLE_APP_SPECIFIC_PASSWORD }} |
| 78 | + run: | |
| 79 | + # Create zip for notarization |
| 80 | + ditto -c -k --keepParent "$RUNNER_TEMP/export/Cache Status.app" $RUNNER_TEMP/CacheStatus.zip |
| 81 | +
|
| 82 | + # Submit for notarization |
| 83 | + xcrun notarytool submit $RUNNER_TEMP/CacheStatus.zip \ |
| 84 | + --apple-id "$APPLE_ID" \ |
| 85 | + --team-id "$APPLE_TEAM_ID" \ |
| 86 | + --password "$APPLE_APP_PASSWORD" \ |
| 87 | + --wait |
| 88 | +
|
| 89 | + # Staple the ticket |
| 90 | + xcrun stapler staple "$RUNNER_TEMP/export/Cache Status.app" |
| 91 | +
|
| 92 | + - name: Create Release Zip |
| 93 | + run: | |
| 94 | + cd $RUNNER_TEMP/export |
| 95 | + ditto -c -k --keepParent "Cache Status.app" CacheStatus.zip |
| 96 | + mv CacheStatus.zip $GITHUB_WORKSPACE/ |
| 97 | +
|
| 98 | + - name: Upload Artifact |
| 99 | + uses: actions/upload-artifact@v4 |
| 100 | + with: |
| 101 | + name: CacheStatus |
| 102 | + path: CacheStatus.zip |
| 103 | + |
| 104 | + - name: Create Release |
| 105 | + if: startsWith(github.ref, 'refs/tags/') |
| 106 | + uses: softprops/action-gh-release@v1 |
| 107 | + with: |
| 108 | + files: CacheStatus.zip |
| 109 | + generate_release_notes: true |
| 110 | + env: |
| 111 | + GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} |
| 112 | + |
| 113 | + - name: Cleanup |
| 114 | + if: always() |
| 115 | + run: | |
| 116 | + security delete-keychain $RUNNER_TEMP/app-signing.keychain-db || true |
0 commit comments