126 lines
4.1 KiB
YAML
126 lines
4.1 KiB
YAML
name: Build macOS DMG (arm64)
|
|
|
|
on:
|
|
workflow_dispatch:
|
|
inputs:
|
|
macos_version:
|
|
description: macOS runner version
|
|
required: true
|
|
type: choice
|
|
options:
|
|
- "macos-15"
|
|
- "macos-26"
|
|
default: "macos-15"
|
|
ref:
|
|
description: Git ref to build (branch, tag, or sha)
|
|
required: false
|
|
default: ""
|
|
|
|
env:
|
|
CARGO_INCREMENTAL: 0
|
|
RUST_BACKTRACE: short
|
|
|
|
jobs:
|
|
build-macos-dmg-arm64:
|
|
name: Build DMG (arm64, ${{ inputs.macos_version }})
|
|
runs-on: ${{ inputs.macos_version }}
|
|
steps:
|
|
- name: Checkout
|
|
uses: actions/checkout@v4
|
|
with:
|
|
ref: ${{ inputs.ref || github.ref }}
|
|
|
|
- name: Setup bun
|
|
uses: oven-sh/setup-bun@v2
|
|
|
|
- name: Setup Node.js
|
|
uses: actions/setup-node@v4
|
|
with:
|
|
node-version: "20"
|
|
|
|
- name: Install Rust stable
|
|
uses: dtolnay/rust-toolchain@stable
|
|
with:
|
|
targets: aarch64-apple-darwin
|
|
|
|
- name: Rust cache
|
|
uses: swatinem/rust-cache@v2
|
|
with:
|
|
workspaces: packages/desktop/src-tauri
|
|
key: aarch64-apple-darwin
|
|
|
|
- name: Install dependencies
|
|
run: bun install --frozen-lockfile
|
|
|
|
- name: Install Apple Certificate
|
|
env:
|
|
APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }}
|
|
APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
|
|
run: |
|
|
KEYCHAIN_PATH=$RUNNER_TEMP/app-signing.keychain-db
|
|
KEYCHAIN_PASSWORD=$(openssl rand -base64 32)
|
|
|
|
security create-keychain -p "$KEYCHAIN_PASSWORD" "$KEYCHAIN_PATH"
|
|
security set-keychain-settings -lut 21600 "$KEYCHAIN_PATH"
|
|
security unlock-keychain -p "$KEYCHAIN_PASSWORD" "$KEYCHAIN_PATH"
|
|
|
|
echo "$APPLE_CERTIFICATE" | base64 --decode > $RUNNER_TEMP/certificate.p12
|
|
security import $RUNNER_TEMP/certificate.p12 \
|
|
-P "$APPLE_CERTIFICATE_PASSWORD" \
|
|
-A -t cert -f pkcs12 \
|
|
-k "$KEYCHAIN_PATH"
|
|
|
|
security list-keychain -d user -s "$KEYCHAIN_PATH"
|
|
security set-key-partition-list -S apple-tool:,apple:,codesign: \
|
|
-s -k "$KEYCHAIN_PASSWORD" "$KEYCHAIN_PATH"
|
|
|
|
- name: Set up notarization credentials
|
|
env:
|
|
APPLE_ID: ${{ secrets.APPLE_ID }}
|
|
APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
|
|
APPLE_PASSWORD: ${{ secrets.APPLE_PASSWORD }}
|
|
run: |
|
|
if [ -z "$APPLE_ID" ] || [ -z "$APPLE_TEAM_ID" ] || [ -z "$APPLE_PASSWORD" ]; then
|
|
echo "Error: Missing Apple notarization credentials"
|
|
exit 1
|
|
fi
|
|
|
|
xcrun notarytool store-credentials "openchamber-notarize" \
|
|
--apple-id "$APPLE_ID" \
|
|
--team-id "$APPLE_TEAM_ID" \
|
|
--password "$APPLE_PASSWORD"
|
|
|
|
- name: Build UI package
|
|
run: bun run --cwd packages/ui build
|
|
|
|
- name: Build Desktop app (arm64)
|
|
run: bun run --cwd packages/desktop build && bun run --cwd packages/desktop tauri build --target aarch64-apple-darwin
|
|
env:
|
|
TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
|
|
TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
|
|
APPLE_SIGNING_IDENTITY: ${{ secrets.APPLE_SIGNING_IDENTITY }}
|
|
APPLE_ID: ${{ secrets.APPLE_ID }}
|
|
APPLE_PASSWORD: ${{ secrets.APPLE_PASSWORD }}
|
|
APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
|
|
|
|
- name: Prepare DMG artifact
|
|
run: |
|
|
set -euo pipefail
|
|
mkdir -p artifacts
|
|
DMG_PATH="packages/desktop/src-tauri/target/aarch64-apple-darwin/release/bundle/dmg/*.dmg"
|
|
if ls $DMG_PATH 1> /dev/null 2>&1; then
|
|
DMG_FILE=$(ls $DMG_PATH | head -n 1)
|
|
DMG_NAME="OpenChamber_${{ inputs.macos_version }}_arm64.dmg"
|
|
cp "$DMG_FILE" "artifacts/$DMG_NAME"
|
|
else
|
|
echo "Error: DMG file not found at $DMG_PATH"
|
|
exit 1
|
|
fi
|
|
|
|
- name: Upload DMG artifact
|
|
uses: actions/upload-artifact@v4
|
|
with:
|
|
name: dmg-${{ inputs.macos_version }}-arm64
|
|
path: artifacts/*.dmg
|
|
retention-days: 7
|