Update #92
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Build and Release Addons | |
| on: | |
| push: | |
| jobs: | |
| package: | |
| runs-on: | |
| - self-hosted | |
| - macos | |
| permissions: | |
| contents: write | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@v4 | |
| - name: Import Code Signing Certificate | |
| if: env.MACOS_CERTIFICATE != '' | |
| env: | |
| MACOS_CERTIFICATE: ${{ secrets.MACOS_CERTIFICATE }} | |
| MACOS_CERTIFICATE_PASSWORD: ${{ secrets.MACOS_CERTIFICATE_PASSWORD }} | |
| KEYCHAIN_PASSWORD: ${{ secrets.KEYCHAIN_PASSWORD }} | |
| run: | | |
| # Create temporary keychain | |
| KEYCHAIN_PATH=$RUNNER_TEMP/app-signing.keychain-db | |
| security create-keychain -p "$KEYCHAIN_PASSWORD" $KEYCHAIN_PATH | |
| security set-keychain-settings -lut 21600 $KEYCHAIN_PATH | |
| security unlock-keychain -p "$KEYCHAIN_PASSWORD" $KEYCHAIN_PATH | |
| # Import certificate | |
| echo "$MACOS_CERTIFICATE" | base64 --decode > $RUNNER_TEMP/certificate.p12 | |
| security import $RUNNER_TEMP/certificate.p12 -P "$MACOS_CERTIFICATE_PASSWORD" -A -t cert -f pkcs12 -k $KEYCHAIN_PATH | |
| security list-keychain -d user -s $KEYCHAIN_PATH | |
| # Allow codesign to access keychain | |
| security set-key-partition-list -S apple-tool:,apple:,codesign: -s -k "$KEYCHAIN_PASSWORD" $KEYCHAIN_PATH | |
| - name: Build xcframework package | |
| run: make build | |
| - name: Package for Distribution | |
| run: make dist | |
| - name: Sign macOS frameworks | |
| if: env.MACOS_CERTIFICATE != '' | |
| env: | |
| MACOS_CERTIFICATE: ${{ secrets.MACOS_CERTIFICATE }} | |
| run: | | |
| # Find signing identity from keychain (first code signing certificate) | |
| SIGNING_IDENTITY=$(security find-identity -v -p codesigning | grep -o '"[^"]*"' | head -1 | tr -d '"') | |
| echo "Using signing identity: $SIGNING_IDENTITY" | |
| # Sign all macOS frameworks | |
| for fw in addons/*/bin/*.framework; do | |
| if [[ -d "$fw" ]]; then | |
| echo "Signing $fw" | |
| codesign --keychain $RUNNER_TEMP/app-signing.keychain-db --force --options runtime \ | |
| --sign "$SIGNING_IDENTITY" \ | |
| $fw | |
| echo "Verifying file $signfile" | |
| codesign --keychain $RUNNER_TEMP/app-signing.keychain-db --verify --verbose $fw | |
| fi | |
| done | |
| - name: Archive addons directory | |
| run: | | |
| PACKAGE_NAME="GodotApplePlugins-addons-${GITHUB_SHA}.zip" | |
| mkdir dist | |
| mv addons dist | |
| zip -r "$PACKAGE_NAME" dist | |
| echo "PACKAGE_NAME=$PACKAGE_NAME" >> "$GITHUB_ENV" | |
| - name: Publish release | |
| if: startsWith(github.ref, 'refs/heads/') | |
| uses: softprops/action-gh-release@v1 | |
| with: | |
| tag_name: build-${{ github.sha }} | |
| name: Addons build for ${{ github.sha }} | |
| body: Automated build triggered by ${{ github.ref }} | |
| files: ${{ env.PACKAGE_NAME }} |