yves-cli/.github/workflows/release.yml at master · jorisroling/yves-cli · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
name: Release

on:
  push:
    tags:
      - "v*"

permissions:
  contents: write

jobs:
  build-linux:
    strategy:
      matrix:
        include:
          - target: x86_64-unknown-linux-gnu
            name: linux-x64
          - target: aarch64-unknown-linux-gnu
            name: linux-arm64

    runs-on: ubuntu-latest

    steps:
      - uses: actions/checkout@v4

      - uses: denoland/setup-deno@v2
        with:
          deno-version: v2.x

      - name: Compile
        run: deno compile --allow-read --allow-env --allow-net=api.github.com --allow-write --target ${{ matrix.target }} --output yves cli.ts

      - name: Zip
        run: zip yves-${{ matrix.name }}.zip yves

      - uses: actions/upload-artifact@v4
        with:
          name: yves-${{ matrix.name }}
          path: yves-${{ matrix.name }}.zip

  build-windows:
    runs-on: windows-latest

    steps:
      - uses: actions/checkout@v4

      - uses: denoland/setup-deno@v2
        with:
          deno-version: v2.x

      - name: Compile
        run: deno compile --allow-read --allow-env --allow-net=api.github.com --allow-write --target x86_64-pc-windows-msvc --output yves cli.ts

      - name: Zip
        run: Compress-Archive -Path yves.exe -DestinationPath yves-windows-x64.zip

      - uses: actions/upload-artifact@v4
        with:
          name: yves-windows-x64
          path: yves-windows-x64.zip

  build-macos:
    runs-on: macos-latest

    steps:
      - uses: actions/checkout@v4

      - uses: denoland/setup-deno@v2
        with:
          deno-version: v2.x

      - name: Compile both architectures
        run: |
          deno compile --allow-read --allow-env --allow-net=api.github.com --allow-write --target x86_64-apple-darwin --output yves-x64 cli.ts
          deno compile --allow-read --allow-env --allow-net=api.github.com --allow-write --target aarch64-apple-darwin --output yves-arm64 cli.ts

      - name: Create universal binary
        run: lipo -create -output yves yves-x64 yves-arm64

      - name: Sign and notarize
        env:
          APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }}
          APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
          APPLE_ID: ${{ secrets.APPLE_ID }}
          APPLE_ID_PASSWORD: ${{ secrets.APPLE_ID_PASSWORD }}
          APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
        run: |
          # Import certificate into temporary keychain
          KEYCHAIN_PATH=$RUNNER_TEMP/app-signing.keychain-db
          KEYCHAIN_PASSWORD=$(openssl rand -base64 32)
          security create-keychain -p "$KEYCHAIN_PASSWORD" $KEYCHAIN_PATH
          security set-keychain-settings -lut 21600 $KEYCHAIN_PATH
          security unlock-keychain -p "$KEYCHAIN_PASSWORD" $KEYCHAIN_PATH
          echo "$APPLE_CERTIFICATE" | base64 --decode > $RUNNER_TEMP/certificate.p12
          security import $RUNNER_TEMP/certificate.p12 -P "$APPLE_CERTIFICATE_PASSWORD" -A -t cert -f pkcs12 -k $KEYCHAIN_PATH
          security set-key-partition-list -S apple-tool:,apple: -k "$KEYCHAIN_PASSWORD" $KEYCHAIN_PATH
          security list-keychain -d user -s $KEYCHAIN_PATH

          # Sign the universal binary
          IDENTITY=$(security find-identity -v -p codesigning $KEYCHAIN_PATH | head -1 | sed 's/.*"\(.*\)"/\1/')
          echo "Signing with: $IDENTITY"
          codesign --force --options runtime --entitlements entitlements.plist --sign "$IDENTITY" yves

          # Notarize
          zip yves-notarize.zip yves
          xcrun notarytool submit yves-notarize.zip --apple-id "$APPLE_ID" --password "$APPLE_ID_PASSWORD" --team-id "$APPLE_TEAM_ID" --wait
          rm yves-notarize.zip

          # Cleanup
          security delete-keychain $KEYCHAIN_PATH

      - name: Zip
        run: zip yves-macos.zip yves

      - uses: actions/upload-artifact@v4
        with:
          name: yves-macos
          path: yves-macos.zip

  release:
    needs: [build-linux, build-windows, build-macos]
    runs-on: ubuntu-latest

    steps:
      - uses: actions/download-artifact@v4
        with:
          merge-multiple: true

      - name: Create release
        uses: softprops/action-gh-release@v2
        with:
          files: yves-*.zip
          generate_release_notes: true