Build MacOS #2
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Build MacOS | |
| on: | |
| release: | |
| types: [published] | |
| permissions: | |
| contents: write | |
| jobs: | |
| build: | |
| runs-on: macos-latest | |
| environment: Sign Executables | |
| steps: | |
| - name: Checkout repo | |
| uses: actions/checkout@v6 | |
| - name: Setup Go | |
| uses: actions/setup-go@v6 | |
| with: | |
| go-version: 1.25.0 | |
| - name: Install gogio tool | |
| run: make install_deps | |
| - name: Install create-dmg and librsvg tools | |
| run: brew install create-dmg librsvg | |
| - name: Generate macOS icon | |
| run: | | |
| chmod +x ./assets/svg_to_icns.sh | |
| ./assets/svg_to_icns.sh | |
| - name: Import signing certificate | |
| env: | |
| CERTIFICATE_P12_BASE64: ${{ secrets.CERTIFICATE_P12_BASE64 }} | |
| CERTIFICATE_PASSWORD: ${{ secrets.CERTIFICATE_PASSWORD }} | |
| run: | | |
| CERTIFICATE_PATH=$RUNNER_TEMP/certificate.p12 | |
| KEYCHAIN_PATH=$RUNNER_TEMP/app-signing.keychain-db | |
| KEYCHAIN_PASSWORD=$(openssl rand -base64 32) | |
| echo -n "$CERTIFICATE_P12_BASE64" | base64 --decode -o $CERTIFICATE_PATH | |
| security create-keychain -p "$KEYCHAIN_PASSWORD" $KEYCHAIN_PATH | |
| security set-keychain-settings -lut 21600 $KEYCHAIN_PATH | |
| security unlock-keychain -p "$KEYCHAIN_PASSWORD" $KEYCHAIN_PATH | |
| security import $CERTIFICATE_PATH -P "$CERTIFICATE_PASSWORD" -A -t cert -f pkcs12 -k $KEYCHAIN_PATH | |
| security set-key-partition-list -S apple-tool:,apple: -k "$KEYCHAIN_PASSWORD" $KEYCHAIN_PATH | |
| security list-keychains -d user -s $KEYCHAIN_PATH login.keychain-db | |
| - name: Build and sign macOS app | |
| run: | | |
| make build_macos_signed | |
| make notarize_macos | |
| make build_macos_dmg | |
| env: | |
| APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }} | |
| IDENTITY: ${{ secrets.IDENTITY }} | |
| APPLE_ID: ${{ secrets.APPLE_ID }} | |
| APPLE_APP_SPECIFIC_PASSWORD: ${{ secrets.APPLE_APP_SPECIFIC_PASSWORD }} | |
| - name: Upload Release Asset | |
| run: | | |
| gh release upload ${{github.event.release.tag_name}} ./dist/debrief-macos-${{ github.ref_name }}-amd64.dmg | |
| gh release upload ${{github.event.release.tag_name}} ./dist/debrief-macos-${{ github.ref_name }}-arm64.dmg | |
| env: | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| shell: bash |