Skip to content

Emt 1964 Automate code signing and dSym binaries generation #1497

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 3 commits into from
Jul 14, 2025
Merged

Emt 1964 Automate code signing and dSym binaries generation #1497

Show file tree
Hide file tree
Changes from 2 commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
9491290
Updated Scripts to codesign and generate xcframework with dSym
NidhiDixit09 May 27, 2025
711d8ab
Updated release GHA for importing certificate.
NidhiDixit09 May 27, 2025
20b17d9
Added --deep param
NidhiDixit09 Jun 5, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
69 changes: 69 additions & 0 deletions .github/workflows/release.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -57,6 +57,27 @@ jobs:
steps:
- name: Check out code
uses: actions/checkout@v4
- name: Install the Apple certificate
env:
BUILD_CERTIFICATE_BASE64: ${{ secrets.BUILD_CERTIFICATE_BASE64 }}
P12_PASSWORD: ${{ secrets.P12_PASSWORD }}
KEYCHAIN_PASSWORD: ${{ secrets.KEYCHAIN_PASSWORD }}
run: |
# create variables
CERTIFICATE_PATH=$RUNNER_TEMP/build_certificate.p12
KEYCHAIN_PATH=$RUNNER_TEMP/app-signing.keychain-db

# import certificate
echo -n "$BUILD_CERTIFICATE_BASE64" | base64 --decode -o $CERTIFICATE_PATH

# create temporary keychain
security create-keychain -p "$KEYCHAIN_PASSWORD" $KEYCHAIN_PATH
security set-keychain-settings -lut 21600 $KEYCHAIN_PATH
security unlock-keychain -p "$KEYCHAIN_PASSWORD" $KEYCHAIN_PATH

# import certificate to keychain
security import $CERTIFICATE_PATH -P "$P12_PASSWORD" -A -t cert -f pkcs12 -k $KEYCHAIN_PATH
security list-keychain -d user -s $KEYCHAIN_PATH
- name: Build xcframework
run: |
./scripts/prep_xcframework.sh
Expand All @@ -67,6 +88,10 @@ jobs:
path: |
./Branch.zip
./checksum.txt
./Branch_signed_xcframework.zip
./checksum_signed_xcframework.txt
./Branch_xcframework_WithdSym.zip
./checksum_xcframework_WithdSym.txt

build-noidfa-framework:
runs-on: macos-latest
Expand All @@ -85,6 +110,8 @@ jobs:
path: |
./Branch_noidfa.zip
./checksum_noidfa.txt
./Branch_noidfa_signed_xcframework
./checksum_noidfa_signed_xcframework.txt

build-static-framework:
runs-on: macos-latest
Expand Down Expand Up @@ -248,6 +275,48 @@ jobs:
assetName: 'checksum',
path: 'release_framework/checksum.txt',
});
await uploadAsset({
github,
context,
releaseId,
assetName: 'Branch_signed_xcframework',
path: 'release_framework/Branch_signed_xcframework.zip',
});
await uploadAsset({
github,
context,
releaseId,
assetName: 'checksum_signed_xcframework',
path: 'release_framework/checksum_signed_xcframework.txt',
});
await uploadAsset({
github,
context,
releaseId,
assetName: 'Branch_xcframework_WithdSym',
path: 'release_framework/Branch_xcframework_WithdSym.zip',
});
await uploadAsset({
github,
context,
releaseId,
assetName: 'checksum_xcframework_WithdSym',
path: 'release_framework/checksum_xcframework_WithdSym.txt',
});
await uploadAsset({
github,
context,
releaseId,
assetName: 'Branch_noidfa_signed_xcframework',
path: 'framework-noidfa/Branch_noidfa_signed_xcframework.zip',
});
await uploadAsset({
github,
context,
releaseId,
assetName: 'checksum_noidfa_signed_xcframework',
path: 'framework-noidfa/checksum_noidfa_signed_xcframework.txt',
});

- name: Trigger workflow in iOS Branch SDK spm repo for updating code and creating release
run: |
Expand Down
22 changes: 20 additions & 2 deletions scripts/build_xcframework.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,6 +8,8 @@ TVOS_PATH="./build/tvos/tvos.xcarchive"
TVOS_SIM_PATH="./build/tvos/tvos_sim.xcarchive"
CATALYST_PATH="./build/catalyst/catalyst.xcarchive"
XCFRAMEWORK_PATH="./build/BranchSDK.xcframework"
XCFRAMEWORK_PATH_SIGNED="./build/signedFramework/"
XCFRAMEWORK_PATH_dSYM="./build/dSymFramework/BranchSDK.xcframework"

Comment on lines 10 to 13
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🛠️ Code Refactor

Issue: The certificate name is hardcoded, which makes it less maintainable and harder to change in the future.
Fix: Extract the certificate name to a variable at the top of the script.
Impact: Improves maintainability and makes it easier to update the certificate name in the future.

Suggested change
XCFRAMEWORK_PATH="./build/BranchSDK.xcframework"
XCFRAMEWORK_PATH_SIGNED="./build/signedFramework/"
XCFRAMEWORK_PATH_dSYM="./build/dSymFramework/BranchSDK.xcframework"
XCFRAMEWORK_PATH=\"./build/BranchSDK.xcframework\"
XCFRAMEWORK_PATH_SIGNED=\"./build/signedFramework/\"
XCFRAMEWORK_PATH_dSYM=\"./build/dSymFramework/BranchSDK.xcframework\"
CODESIGN_IDENTITY=\"Apple Distribution: Branch Metrics, Inc. (R63EM248DP)\"
# delete previous build

# delete previous build
rm -rf "./build"
Expand Down Expand Up @@ -56,5 +58,21 @@ xcodebuild -create-xcframework \
-framework "${CATALYST_PATH}/Products/Library/Frameworks/BranchSDK.framework" \
-output "${XCFRAMEWORK_PATH}"



# create signed binary
mkdir -p "${XCFRAMEWORK_PATH_SIGNED}"
cp -rf "${XCFRAMEWORK_PATH}" "${XCFRAMEWORK_PATH_SIGNED}"
codesign --deep --timestamp -s "Apple Distribution: Branch Metrics, Inc. (R63EM248DP)" "${XCFRAMEWORK_PATH_SIGNED}/BranchSDK.xcframework"
Comment on lines +61 to +64
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🛠️ Code Refactor

Issue: The codesign command doesn't have error handling, which could lead to silent failures.
Fix: Add error handling to check if the codesign command succeeded.
Impact: Prevents silent failures and makes debugging easier.

Suggested change
# create signed binary
mkdir -p "${XCFRAMEWORK_PATH_SIGNED}"
cp -rf "${XCFRAMEWORK_PATH}" "${XCFRAMEWORK_PATH_SIGNED}"
codesign --deep --timestamp -s "Apple Distribution: Branch Metrics, Inc. (R63EM248DP)" "${XCFRAMEWORK_PATH_SIGNED}/BranchSDK.xcframework"
# create signed binary
mkdir -p \"${XCFRAMEWORK_PATH_SIGNED}\"
cp -rf \"${XCFRAMEWORK_PATH}\" \"${XCFRAMEWORK_PATH_SIGNED}\"
if ! codesign --deep --timestamp -s \"${CODESIGN_IDENTITY}\" \"${XCFRAMEWORK_PATH_SIGNED}/BranchSDK.xcframework\"; then
echo \"Error: Code signing failed\"
exit 1
fi


# package framework with dSyms
xcodebuild -create-xcframework \
-framework "${IOS_PATH}/Products/Library/Frameworks/BranchSDK.framework" \
-debug-symbols "$(pwd)/build/ios/ios.xcarchive/dSYMs/BranchSDK.framework.dSYM"\
-framework "${IOS_SIM_PATH}/Products/Library/Frameworks/BranchSDK.framework" \
-debug-symbols "$(pwd)/build/ios/ios_sim.xcarchive/dSYMs/BranchSDK.framework.dSYM"\
-framework "${TVOS_PATH}/Products/Library/Frameworks/BranchSDK.framework" \
-debug-symbols "$(pwd)/build/tvos/tvos.xcarchive/dSYMs/BranchSDK.framework.dSYM"\
-framework "${TVOS_SIM_PATH}/Products/Library/Frameworks/BranchSDK.framework" \
-debug-symbols "$(pwd)/build/tvos/tvos_sim.xcarchive/dSYMs/BranchSDK.framework.dSYM"\
-framework "${CATALYST_PATH}/Products/Library/Frameworks/BranchSDK.framework" \
-debug-symbols "$(pwd)/build/catalyst/catalyst.xcarchive/dSYMs/BranchSDK.framework.dSYM"\
-output "${XCFRAMEWORK_PATH_dSYM}"
7 changes: 5 additions & 2 deletions scripts/build_xcframework_noidfa.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,6 +8,7 @@ TVOS_PATH="./build/tvos/tvos.xcarchive"
TVOS_SIM_PATH="./build/tvos/tvos_sim.xcarchive"
CATALYST_PATH="./build/catalyst/catalyst.xcarchive"
XCFRAMEWORK_PATH="./build/BranchSDK.xcframework"
XCFRAMEWORK_PATH_SIGNED="./build/signedNoIDFAFramework/"

# delete previous build
rm -rf "./build"
Expand Down Expand Up @@ -61,5 +62,7 @@ xcodebuild -create-xcframework \
-framework "${CATALYST_PATH}/Products/Library/Frameworks/BranchSDK.framework" \
-output "${XCFRAMEWORK_PATH}"



# create signed binary
mkdir -p "${XCFRAMEWORK_PATH_SIGNED}"
cp -rf "${XCFRAMEWORK_PATH}" "${XCFRAMEWORK_PATH_SIGNED}"
codesign --timestamp -s "Apple Distribution: Branch Metrics, Inc. (R63EM248DP)" "${XCFRAMEWORK_PATH_SIGNED}/BranchSDK.xcframework"
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚡️ Performance Improvement

Issue: The codesign command for the no-IDFA version doesn't use the --deep flag, unlike the regular version.
Fix: Add the --deep flag for consistency and to ensure all nested components are signed.
Impact: Ensures thorough code signing of all components in the framework.

Suggested change
# create signed binary
mkdir -p "${XCFRAMEWORK_PATH_SIGNED}"
cp -rf "${XCFRAMEWORK_PATH}" "${XCFRAMEWORK_PATH_SIGNED}"
codesign --timestamp -s "Apple Distribution: Branch Metrics, Inc. (R63EM248DP)" "${XCFRAMEWORK_PATH_SIGNED}/BranchSDK.xcframework"
# create signed binary
mkdir -p \"${XCFRAMEWORK_PATH_SIGNED}\"
cp -rf \"${XCFRAMEWORK_PATH}\" \"${XCFRAMEWORK_PATH_SIGNED}\"
codesign --deep --timestamp -s \"Apple Distribution: Branch Metrics, Inc. (R63EM248DP)\" \"${XCFRAMEWORK_PATH_SIGNED}/BranchSDK.xcframework\"```

18 changes: 18 additions & 0 deletions scripts/prep_xcframework.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,6 +6,12 @@ scheme='xcframework'
checksum_file=checksum.txt
zip_file=Branch.zip

checksum_file_signed=checksum_signed_xcframework.txt
zip_file_signed=Branch_signed_xcframework.zip

checksum_file_WithdSym=checksum_xcframework_WithdSym.txt
zip_file_WithdSym=Branch_xcframework_WithdSym.zip

scriptname=$(basename "${BASH_SOURCE[0]}")
scriptpath="${BASH_SOURCE[0]}"
scriptpath=$(cd "$(dirname "${scriptpath}")" && pwd)
Expand Down Expand Up @@ -33,3 +39,15 @@ mv $checksum_file ..
# Remove source frameworks
echo "Cleaning up"
rm -rf BranchSDK.xcframework

echo "Packaging signed BranchSDK.xcframework"
zip -rqy $zip_file_signed ./signedFramework/BranchSDK.xcframework/
shasum $zip_file_signed >> $checksum_file_signed
mv $zip_file_signed ..
mv $checksum_file_signed ..
Comment on lines +42 to +47
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🛠️ Code Refactor

Issue: The script doesn't check if the signed framework directory exists before attempting to package it.
Fix: Add a check to verify the directory exists before packaging.
Impact: Prevents errors when the signed framework doesn't exist and provides clearer error messages.

Suggested change
echo "Packaging signed BranchSDK.xcframework"
zip -rqy $zip_file_signed ./signedFramework/BranchSDK.xcframework/
shasum $zip_file_signed >> $checksum_file_signed
mv $zip_file_signed ..
mv $checksum_file_signed ..
echo \"Packaging signed BranchSDK.xcframework\"
if [ ! -d \"./signedFramework/BranchSDK.xcframework/\" ]; then
echo \"Error: Signed framework directory not found\"
exit 1
fi
zip -rqy $zip_file_signed ./signedFramework/BranchSDK.xcframework/
shasum $zip_file_signed >> $checksum_file_signed
mv $zip_file_signed ..
mv $checksum_file_signed ..


echo "Packaging debug BranchSDK.xcframework with dSyms"
zip -rqy $zip_file_WithdSym ./dSymFramework/BranchSDK.xcframework/
shasum $zip_file_WithdSym >> $checksum_file_WithdSym
mv $zip_file_WithdSym ..
mv $checksum_file_WithdSym ..
Comment on lines +48 to +53
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🛠️ Code Refactor

Issue: Similar to the signed framework, there's no check if the dSym framework directory exists before packaging.
Fix: Add a check to verify the directory exists before packaging.
Impact: Prevents errors when the dSym framework doesn't exist and provides clearer error messages.

Suggested change
echo "Packaging debug BranchSDK.xcframework with dSyms"
zip -rqy $zip_file_WithdSym ./dSymFramework/BranchSDK.xcframework/
shasum $zip_file_WithdSym >> $checksum_file_WithdSym
mv $zip_file_WithdSym ..
mv $checksum_file_WithdSym ..
echo \"Packaging debug BranchSDK.xcframework with dSyms\"
if [ ! -d \"./dSymFramework/BranchSDK.xcframework/\" ]; then
echo \"Error: dSym framework directory not found\"
exit 1
fi
zip -rqy $zip_file_WithdSym ./dSymFramework/BranchSDK.xcframework/
shasum $zip_file_WithdSym >> $checksum_file_WithdSym
mv $zip_file_WithdSym ..
mv $checksum_file_WithdSym ..

8 changes: 8 additions & 0 deletions scripts/prep_xcframework_noidfa.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,6 +5,8 @@ set -euo pipefail
scheme='xcframework-noidfa'
checksum_file=checksum_noidfa.txt
zip_file=Branch_noidfa.zip
checksum_file_noidfa_signed_xcframework=checksum_noidfa_signed_xcframework.txt
zip_file_noidfa_signed_xcframework=Branch_noidfa_signed_xcframework.zip

scriptname=$(basename "${BASH_SOURCE[0]}")
scriptpath="${BASH_SOURCE[0]}"
Expand Down Expand Up @@ -33,3 +35,9 @@ mv $checksum_file ..
# Remove source frameworks
echo "Cleaning up"
rm -rf BranchSDK.xcframework

echo "Packaging signed BranchSDK.xcframework"
zip -rqy $zip_file_noidfa_signed_xcframework ./signedNoIDFAFramework/BranchSDK.xcframework/
shasum $zip_file_noidfa_signed_xcframework >> $checksum_file_noidfa_signed_xcframework
mv $zip_file_noidfa_signed_xcframework ..
mv $checksum_file_noidfa_signed_xcframework ..
Loading