Skip to content

Commit ff8a78f

Browse files
hedgecrwhedgecrw
committed
Add GitHub workflow script to allow signing/notarizing Mac libraries
1 parent ceb28d0 commit ff8a78f

File tree

1 file changed

+137
-0
lines changed

1 file changed

+137
-0
lines changed

‎.github/workflows/release_to_maven_central_signed_macos.yml‎

Lines changed: 137 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,137 @@
1+
name: Release to Maven Central Signed MacOS
2+
permissions:
3+
actions: read
4+
contents: write
5+
deployments: write
6+
pages: write
7+
8+
on: [workflow_dispatch]
9+
10+
jobs:
11+
buildpublish:
12+
runs-on: macos-latest
13+
steps:
14+
- name: Check out source code
15+
uses: actions/checkout@v4
16+
17+
- name: Get source code version number
18+
id: gitversion
19+
run: echo "version=$(grep -o "versionString = [^, ;]*" src/main/java/com/fazecast/jSerialComm/SerialPort.java | grep -o "\".*\"" | grep -o [^\"].*[^\"])" >> $GITHUB_OUTPUT
20+
21+
- name: Update library version string
22+
run: |
23+
sed -i "s/@version .*/@version ${{ steps.gitversion.outputs.version }}/" src/main/java/com/fazecast/jSerialComm/package-info.java
24+
sed -i "s/nativeLibraryVersion\[\] = [^, ;]*/nativeLibraryVersion\[\] = \"${{ steps.gitversion.outputs.version }}\"/g" src/main/c/Posix/SerialPort_Posix.c
25+
sed -i "s/nativeLibraryVersion\[\] = [^, ;]*/nativeLibraryVersion\[\] = \"${{ steps.gitversion.outputs.version }}\"/g" src/main/c/Windows/SerialPort_Windows.c
26+
27+
- name: Build native libraries using Docker toolchain
28+
uses: addnab/docker-run-action@v3
29+
with:
30+
image: fazecast/jserialcomm:builder
31+
options: --user root --privileged --rm -v ${{ github.workspace }}:/home/toolchain/jSerialComm
32+
run: /home/toolchain/compile.sh libs
33+
34+
- name: Sign MacOS native libraries
35+
env:
36+
MACOS_CERTIFICATE: ${{ secrets.PROD_MACOS_CERTIFICATE }}
37+
MACOS_INTERMEDIATE_CERTIFICATE: ${{ secrets.PROD_MACOS_INTERMEDIATE_CERTIFICATE }}
38+
MACOS_CERTIFICATE_PWD: ${{ secrets.PROD_MACOS_CERTIFICATE_PWD }}
39+
MACOS_CERTIFICATE_NAME: ${{ secrets.PROD_MACOS_CERTIFICATE_NAME }}
40+
MACOS_CI_KEYCHAIN_PWD: ${{ secrets.PROD_MACOS_CI_KEYCHAIN_PWD }}
41+
run: |
42+
echo $MACOS_CERTIFICATE | base64 --decode > certificate.p12
43+
echo $MACOS_INTERMEDIATE_CERTIFICATE | base64 --decode > intermediate.cer
44+
security create-keychain -p "$MACOS_CI_KEYCHAIN_PWD" build.keychain
45+
security default-keychain -s build.keychain
46+
security list-keychains -s build.keychain
47+
security unlock-keychain -p "$MACOS_CI_KEYCHAIN_PWD" build.keychain
48+
security set-keychain-settings build.keychain
49+
security import certificate.p12 -k build.keychain -P "$MACOS_CERTIFICATE_PWD" -T /usr/bin/codesign -T /usr/bin/productsign
50+
security import intermediate.cer -k build.keychain -P "$MACOS_CERTIFICATE_PWD" -T /usr/bin/codesign -T /usr/bin/productsign
51+
security set-key-partition-list -S apple-tool:,apple:,codesign: -s -k "$MACOS_CI_KEYCHAIN_PWD" build.keychain
52+
/usr/bin/codesign --force -s "$MACOS_CERTIFICATE_NAME" --options runtime src/main/resources/OSX/aarch64/libjSerialComm.jnilib -v
53+
/usr/bin/codesign --force -s "$MACOS_CERTIFICATE_NAME" --options runtime src/main/resources/OSX/x86/libjSerialComm.jnilib -v
54+
/usr/bin/codesign --force -s "$MACOS_CERTIFICATE_NAME" --options runtime src/main/resources/OSX/x86_64/libjSerialComm.jnilib -v
55+
56+
- name: Notarize MacOS native libraries
57+
env:
58+
PROD_MACOS_NOTARIZATION_APPLE_ID: ${{ secrets.PROD_MACOS_NOTARIZATION_APPLE_ID }}
59+
PROD_MACOS_NOTARIZATION_TEAM_ID: ${{ secrets.PROD_MACOS_NOTARIZATION_TEAM_ID }}
60+
PROD_MACOS_NOTARIZATION_PWD: ${{ secrets.PROD_MACOS_NOTARIZATION_PWD }}
61+
run: |
62+
xcrun notarytool store-credentials "notarytool-profile" --apple-id "$PROD_MACOS_NOTARIZATION_APPLE_ID" --team-id "$PROD_MACOS_NOTARIZATION_TEAM_ID" --password "$PROD_MACOS_NOTARIZATION_PWD"
63+
ditto -c -k --keepParent "src/main/resources/OSX" "notarization.zip"
64+
xcrun notarytool submit "notarization.zip" --keychain-profile "notarytool-profile" --wait
65+
66+
- name: Set up Java build environment
67+
uses: actions/setup-java@v4
68+
with:
69+
distribution: 'zulu'
70+
java-version: '11'
71+
cache: maven
72+
server-id: central
73+
server-username: MAVEN_USERNAME
74+
server-password: MAVEN_PASSWORD
75+
gpg-private-key: ${{ secrets.MAVEN_GPG_PRIVATE_KEY }}
76+
gpg-passphrase: SIGN_KEY_PASS
77+
78+
- name: Build and publish library using Maven
79+
run: ./mvnw versions:set -DnewVersion=${{ steps.gitversion.outputs.version }} && ./mvnw clean deploy -DskipTests
80+
env:
81+
MAVEN_USERNAME: ${{ secrets.OSS_SONATYPE_USERNAME }}
82+
MAVEN_PASSWORD: ${{ secrets.OSS_SONATYPE_PASSWORD }}
83+
SIGN_KEY: ${{ secrets.MAVEN_GPG_PRIVATE_KEY }}
84+
SIGN_KEY_PASS: ${{ secrets.MAVEN_GPG_PASSPHRASE }}
85+
86+
- name: Generate changelog
87+
id: changelog
88+
uses: metcalfc/[email protected]
89+
with:
90+
myToken: ${{ secrets.GRADLE_UPDATE_PAT }}
91+
92+
- name: Create GitHub release
93+
uses: ncipollo/release-action@v1
94+
with:
95+
token: ${{ secrets.GRADLE_UPDATE_PAT }}
96+
name: "jSerialComm v${{ steps.gitversion.outputs.version }}"
97+
tag: "v${{ steps.gitversion.outputs.version }}"
98+
body: ${{ steps.changelog.outputs.changelog }}
99+
commit: "master"
100+
artifacts: "target/jSerialComm-${{ steps.gitversion.outputs.version }}.jar"
101+
generateReleaseNotes: false
102+
prerelease: false
103+
makeLatest: true
104+
draft: true
105+
106+
- name: Check out existing library documentation
107+
uses: actions/checkout@v4
108+
with:
109+
ref: gh-pages
110+
path: documentation
111+
112+
- name: Update Javadoc library documentation
113+
run: rm -rf documentation/binaries/* documentation/javadoc && mv target/javadoc/apidocs documentation/javadoc && sed -i "s@maven2/com/fazecast/jSerialComm/[^\"]*@maven2/com/fazecast/jSerialComm/${{ steps.gitversion.outputs.version }}/jSerialComm-${{ steps.gitversion.outputs.version }}.jar@g" documentation/index.html
114+
115+
- name: Publish new library documentation
116+
uses: s0/git-publish-subdir-action@develop
117+
env:
118+
REPO: self
119+
BRANCH: gh-pages
120+
FOLDER: documentation
121+
GITHUB_TOKEN: ${{ secrets.GRADLE_UPDATE_PAT }}
122+
MESSAGE: "Updated docs to v${{ steps.gitversion.outputs.version }}"
123+
124+
- name: Check out Wiki source data
125+
uses: actions/checkout@v4
126+
with:
127+
repository: ${{ github.repository }}.wiki
128+
path: markdown
129+
130+
- name: Update and publish Wiki release link
131+
run: |
132+
cd markdown
133+
sed -i "s@\*\*Current Version\*\*:.*@\*\*Current Version\*\*: \*${{ steps.gitversion.outputs.version }}\* ([[Download JAR file here|https://repo1.maven.org/maven2/com/fazecast/jSerialComm/${{ steps.gitversion.outputs.version }}/jSerialComm-${{ steps.gitversion.outputs.version }}.jar]])<br />@" Home.md
134+
git config --local user.email "[email protected]"
135+
git config --local user.name "GitHub Action"
136+
git add .
137+
git diff-index --quiet HEAD || git commit -m "New jSerialComm release version" && git push

0 commit comments

Comments
 (0)