integration: assemble OpenUsage Bar 0.6 RC candidate (#48) #8
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Pre-release | |
| on: | |
| push: | |
| tags: ["v*"] | |
| permissions: | |
| contents: write | |
| id-token: write | |
| attestations: write | |
| jobs: | |
| release: | |
| runs-on: macos-26 | |
| timeout-minutes: 45 | |
| env: | |
| DEVELOPER_DIR: /Applications/Xcode_26.6.app/Contents/Developer | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| fetch-depth: 0 | |
| - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 | |
| with: | |
| python-version: "3.13" | |
| cache: pip | |
| cache-dependency-path: requirements-build.txt | |
| - name: Verify immutable GitHub Action pins | |
| run: python3 scripts/verify_action_pins.py | |
| - name: Bootstrap pinned build dependencies | |
| run: scripts/bootstrap.sh | |
| - name: Verify immutable tag and release metadata | |
| run: .build-venv/bin/python scripts/verify_release_metadata.py | |
| - name: Audit locked Python dependencies | |
| run: scripts/audit_dependencies.sh | |
| - name: Scan the complete Git history for credentials | |
| run: scripts/release_secret_scan.py --history | |
| - name: Test and build | |
| run: scripts/build_app.sh | |
| - name: Package | |
| run: scripts/package_release.sh | |
| - name: Audit packaged artifact | |
| run: | | |
| .build-venv/bin/python scripts/release_artifact_audit.py dist/OpenUsage-Bar-*.zip | |
| scripts/release_dmg_audit.sh dist/OpenUsage-Bar-*.dmg | |
| - name: Prove isolated install, upgrade, rollback, and uninstall | |
| run: scripts/release_smoke.sh | |
| - name: Attest release assets | |
| uses: actions/attest@f7c74d28b9d84cb8768d0b8ca14a4bac6ef463e6 # v4.2.0 | |
| with: | |
| subject-path: | | |
| dist/OpenUsage-Bar-*.dmg | |
| dist/OpenUsage-Bar-*.dmg.sha256 | |
| dist/OpenUsage-Bar-*.zip | |
| dist/OpenUsage-Bar-*.zip.sha256 | |
| dist/OpenUsage-Bar-*-manifest.json | |
| dist/OpenUsage-Bar-*-sbom.spdx.json | |
| - name: Publish pre-release | |
| env: | |
| GH_TOKEN: ${{ github.token }} | |
| run: | | |
| gh release create "$GITHUB_REF_NAME" \ | |
| dist/OpenUsage-Bar-*.dmg \ | |
| dist/OpenUsage-Bar-*.dmg.sha256 \ | |
| dist/OpenUsage-Bar-*.zip \ | |
| dist/OpenUsage-Bar-*.zip.sha256 \ | |
| dist/OpenUsage-Bar-*-manifest.json \ | |
| dist/OpenUsage-Bar-*-sbom.spdx.json \ | |
| --prerelease \ | |
| --generate-notes \ | |
| --title "OpenUsage Bar $GITHUB_REF_NAME" |