v0.1.13 #24
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: release | |
| on: | |
| release: | |
| types: [created] | |
| permissions: | |
| contents: write | |
| jobs: | |
| build: | |
| runs-on: macos-14 | |
| steps: | |
| - uses: actions/checkout@v4 | |
| # Take the version from the release tag (e.g. `v0.1.2` → `0.1.2`) and | |
| # write it into the files that name the built artifacts. Changes stay in | |
| # the runner's checkout — they are not committed back to main. | |
| - name: Sync versions to release tag | |
| run: | | |
| TAG="${{ github.event.release.tag_name }}" | |
| VERSION="${TAG#v}" | |
| if ! [[ "$VERSION" =~ ^[0-9]+\.[0-9]+\.[0-9]+(-[a-zA-Z0-9.]+)?$ ]]; then | |
| echo "::error::Release tag '$TAG' is not a semver version" | |
| exit 1 | |
| fi | |
| echo "Bumping tauri.conf.json and Cargo.toml to $VERSION" | |
| node -e "const f='apps/desktop/tauri.conf.json'; const fs=require('fs'); const j=JSON.parse(fs.readFileSync(f,'utf8')); j.version=process.argv[1]; fs.writeFileSync(f, JSON.stringify(j,null,2)+'\n');" "$VERSION" | |
| sed -i.bak -E '/^\[package\]/,/^\[/ s/^version = "[^"]+"$/version = "'"$VERSION"'"/' apps/desktop/Cargo.toml | |
| rm apps/desktop/Cargo.toml.bak | |
| - uses: pnpm/action-setup@v4 | |
| with: | |
| version: 9 | |
| - uses: actions/setup-node@v4 | |
| with: | |
| node-version: 22 | |
| cache: pnpm | |
| - uses: dtolnay/rust-toolchain@stable | |
| with: | |
| targets: aarch64-apple-darwin,x86_64-apple-darwin | |
| - uses: Swatinem/rust-cache@v2 | |
| - run: pnpm install --frozen-lockfile | |
| - name: Write App Store Connect API key | |
| run: | | |
| mkdir -p "$HOME/private_keys" | |
| echo "${{ secrets.APPLE_API_KEY_BASE64 }}" | base64 --decode > "$HOME/private_keys/AuthKey.p8" | |
| # Fail early with a clear message if the secret was empty or not base64 | |
| if [ ! -s "$HOME/private_keys/AuthKey.p8" ] || ! head -1 "$HOME/private_keys/AuthKey.p8" | grep -q "BEGIN PRIVATE KEY"; then | |
| echo "::error::APPLE_API_KEY_BASE64 secret is missing or not a valid base64-encoded .p8 file" | |
| exit 1 | |
| fi | |
| echo "APPLE_API_KEY_PATH=$HOME/private_keys/AuthKey.p8" >> "$GITHUB_ENV" | |
| # Tauri's bundler doesn't sign binaries placed under Contents/Resources/, | |
| # so bnot-bridge ships unsigned and notarization rejects the bundle. | |
| # Build it, import the Developer ID cert into a temporary keychain, and | |
| # codesign it ourselves with hardened runtime + secure timestamp. The | |
| # `cargo build` inside tauri-action's beforeBuildCommand later is a no-op | |
| # against the unchanged source tree, so the signature is preserved when | |
| # Tauri bundles the binary into the .app. tauri-action sets up its own | |
| # keychain from APPLE_CERTIFICATE to sign the .app wrapper. | |
| - name: Build and sign bnot-bridge | |
| env: | |
| APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }} | |
| APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }} | |
| APPLE_SIGNING_IDENTITY: ${{ secrets.APPLE_SIGNING_IDENTITY }} | |
| run: | | |
| KEYCHAIN="$RUNNER_TEMP/signing.keychain-db" | |
| KEYCHAIN_PW="$(openssl rand -hex 32)" | |
| CERT_PATH="$RUNNER_TEMP/cert.p12" | |
| echo "$APPLE_CERTIFICATE" | base64 --decode > "$CERT_PATH" | |
| security create-keychain -p "$KEYCHAIN_PW" "$KEYCHAIN" | |
| security set-keychain-settings -lut 21600 "$KEYCHAIN" | |
| security unlock-keychain -p "$KEYCHAIN_PW" "$KEYCHAIN" | |
| security import "$CERT_PATH" -P "$APPLE_CERTIFICATE_PASSWORD" \ | |
| -A -t cert -f pkcs12 -k "$KEYCHAIN" | |
| security set-key-partition-list -S apple-tool:,apple:,codesign: \ | |
| -s -k "$KEYCHAIN_PW" "$KEYCHAIN" > /dev/null | |
| security list-keychains -d user -s "$KEYCHAIN" \ | |
| $(security list-keychains -d user | sed 's/"//g') | |
| rm -f "$CERT_PATH" | |
| cargo build -p bnot-bridge --release | |
| codesign --force --options runtime --timestamp \ | |
| --sign "$APPLE_SIGNING_IDENTITY" target/release/bnot-bridge | |
| codesign --verify --verbose=2 target/release/bnot-bridge | |
| - uses: tauri-apps/tauri-action@v0 | |
| env: | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }} | |
| TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }} | |
| APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }} | |
| APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }} | |
| APPLE_SIGNING_IDENTITY: ${{ secrets.APPLE_SIGNING_IDENTITY }} | |
| APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }} | |
| APPLE_API_ISSUER: ${{ secrets.APPLE_API_ISSUER }} | |
| APPLE_API_KEY: ${{ secrets.APPLE_API_KEY }} | |
| with: | |
| releaseId: ${{ github.event.release.id }} | |
| args: --target universal-apple-darwin | |
| projectPath: apps/desktop |