6.58.0 - A Profile 8.1 is served as a Profile 5 where the display has no Dolby Vision #312
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Release .dmg | |
| # Builds, signs, notarizes, and uploads Examples/DemoPlayerMac as a | |
| # .dmg asset on every published GitHub Release. Can also be invoked | |
| # manually against an existing tag via `workflow_dispatch`. | |
| # | |
| # Required secrets on the repo (Settings → Secrets and variables → | |
| # Actions → New repository secret): | |
| # | |
| # DEVELOPER_ID_P12_BASE64 base64 of the Developer ID Application | |
| # cert + private key exported from | |
| # Keychain Access as a .p12 file. | |
| # See .github/RELEASE_SETUP.md for how | |
| # to export and base64-encode. | |
| # DEVELOPER_ID_P12_PASSWORD password used when exporting the .p12 | |
| # DEVELOPER_ID the full identity string, e.g. | |
| # "Developer ID Application: Your Name | |
| # (TEAMID0123)" | |
| # APPLE_ID Apple ID email used for notarization | |
| # APPLE_TEAM_ID 10-character team ID (parenthesised part | |
| # of the DEVELOPER_ID identity above) | |
| # APPLE_APP_PASSWORD app-specific password from | |
| # account.apple.com (xxxx-xxxx-xxxx-xxxx) | |
| on: | |
| release: | |
| types: [published] | |
| workflow_dispatch: | |
| inputs: | |
| tag: | |
| description: 'Existing release tag to attach the .dmg to (e.g. 2.0.0)' | |
| required: true | |
| type: string | |
| # Needed for `gh release upload --clobber` to overwrite an existing | |
| # asset on the release. Default GITHUB_TOKEN scopes on newer repos are | |
| # read-only; without this the upload step fails with `HTTP 403: | |
| # Resource not accessible by integration`. | |
| permissions: | |
| contents: write | |
| concurrency: | |
| group: release-dmg-${{ github.event.release.tag_name || inputs.tag }} | |
| cancel-in-progress: false | |
| jobs: | |
| build-and-upload: | |
| name: Build + notarize + upload .dmg | |
| runs-on: macos-15 | |
| timeout-minutes: 30 | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: maxim-lobanov/setup-xcode@v1 | |
| with: | |
| xcode-version: latest-stable | |
| - name: Resolve tag | |
| id: tag | |
| run: | | |
| if [ "${{ github.event_name }}" = "release" ]; then | |
| TAG="${{ github.event.release.tag_name }}" | |
| else | |
| TAG="${{ inputs.tag }}" | |
| fi | |
| echo "tag=$TAG" >> "$GITHUB_OUTPUT" | |
| echo "Building for tag: $TAG" | |
| - name: Import Developer ID certificate into temporary keychain | |
| env: | |
| DEVELOPER_ID_P12_BASE64: ${{ secrets.DEVELOPER_ID_P12_BASE64 }} | |
| DEVELOPER_ID_P12_PASSWORD: ${{ secrets.DEVELOPER_ID_P12_PASSWORD }} | |
| run: | | |
| # Decode the .p12 from the secret. | |
| echo "$DEVELOPER_ID_P12_BASE64" | base64 --decode > /tmp/cert.p12 | |
| # Use a fresh keychain unique to this run so leaking it has | |
| # no consequence past the job. | |
| KEYCHAIN="ci-$RANDOM.keychain-db" | |
| KEYCHAIN_PASSWORD="$(uuidgen)" | |
| echo "KEYCHAIN=$KEYCHAIN" >> "$GITHUB_ENV" | |
| security create-keychain -p "$KEYCHAIN_PASSWORD" "$KEYCHAIN" | |
| security set-keychain-settings -lut 3600 "$KEYCHAIN" | |
| security unlock-keychain -p "$KEYCHAIN_PASSWORD" "$KEYCHAIN" | |
| # Import the cert + private key. -T grants codesign access to | |
| # the private key without further keychain prompts. | |
| security import /tmp/cert.p12 \ | |
| -P "$DEVELOPER_ID_P12_PASSWORD" \ | |
| -k "$KEYCHAIN" \ | |
| -T /usr/bin/codesign | |
| # Authorize codesign to use the imported key without UI prompt. | |
| security set-key-partition-list \ | |
| -S apple-tool:,apple: \ | |
| -s -k "$KEYCHAIN_PASSWORD" "$KEYCHAIN" | |
| # Make the temporary keychain the search default for this run | |
| # so codesign + notarytool find the identity. | |
| security list-keychain -d user -s "$KEYCHAIN" login.keychain-db | |
| security default-keychain -s "$KEYCHAIN" | |
| # Sanity: the cert is visible to codesigning. | |
| security find-identity -v -p codesigning "$KEYCHAIN" | |
| rm /tmp/cert.p12 | |
| - name: Store notarization credentials | |
| env: | |
| APPLE_ID: ${{ secrets.APPLE_ID }} | |
| APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }} | |
| APPLE_APP_PASSWORD: ${{ secrets.APPLE_APP_PASSWORD }} | |
| run: | | |
| # No --keychain flag: notarytool writes to whatever | |
| # `security default-keychain` points at, which the prior step | |
| # set to our disposable CI keychain. | |
| xcrun notarytool store-credentials AETHER_NOTARY \ | |
| --apple-id "$APPLE_ID" \ | |
| --team-id "$APPLE_TEAM_ID" \ | |
| --password "$APPLE_APP_PASSWORD" | |
| - name: Build + notarize + package | |
| env: | |
| DEVELOPER_ID: ${{ secrets.DEVELOPER_ID }} | |
| VERSION: ${{ steps.tag.outputs.tag }} | |
| run: | | |
| cd Examples/DemoPlayerMac | |
| DEVELOPER_ID="$DEVELOPER_ID" \ | |
| NOTARY_PROFILE="AETHER_NOTARY" \ | |
| VERSION="$VERSION" \ | |
| ./Scripts/build-dmg.sh | |
| - name: Upload .dmg to release | |
| env: | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| run: | | |
| DMG="Examples/DemoPlayerMac/build/AetherEngine-Demo-${{ steps.tag.outputs.tag }}.dmg" | |
| ls -la "$DMG" | |
| gh release upload "${{ steps.tag.outputs.tag }}" "$DMG" --clobber | |
| - name: Tear down keychain | |
| if: always() | |
| run: | | |
| if [ -n "${KEYCHAIN:-}" ]; then | |
| security delete-keychain "$KEYCHAIN" || true | |
| fi |