finicky/.github/workflows/macos-build.yml at 2da05e73055376d48511f55b7e1e44aefdc322c2 · johnste/finicky · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
# This workflow builds the Finicky macOS app for both Silicon (ARM64) and Intel (x86_64) architectures
name: macOS Build

on:
    push:
      branches: [main]
    pull_request:
      branches: [main]
    workflow_dispatch:

jobs:
  build-macos:
    runs-on: macos-latest

    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Set up Node.js
        uses: actions/setup-node@v4
        with:
          node-version: '22'
          cache: 'npm'
          cache-dependency-path: |
            packages/config-api/package-lock.json
            packages/finicky-ui/package-lock.json

      - name: Set up Go
        uses: actions/setup-go@v4
        with:
          go-version: '1.24'
          cache-dependency-path: |
            apps/finicky/src/go.sum

      - name: Install dependencies
        run: |
          chmod +x scripts/install.sh
          ./scripts/install.sh

      - name: Build universal binary
        env:
          API_HOST: ${{ vars.API_HOST || '' }}
          BUILD_UNIVERSAL: '1'
        run: |
          echo "API_HOST=${{ vars.API_HOST || '' }}" > .env
          chmod +x scripts/build.sh
          ./scripts/build.sh

      - name: Create archive
        run: |
          cd apps/finicky/build
          tar -czf Finicky-universal.tar.gz Finicky.app

      - name: Upload universal binary
        uses: actions/upload-artifact@v4
        with:
          name: Finicky-universal
          path: apps/finicky/build/Finicky-universal.tar.gz
          retention-days: 14

  sign-and-notarize:
    runs-on: macos-latest
    needs: build-macos
    if: (github.event_name == 'push' || github.event_name == 'workflow_dispatch') && github.ref == 'refs/heads/main'

    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Download universal binary
        uses: actions/download-artifact@v4
        with:
          name: Finicky-universal
          path: ./universal

      - name: Extract universal binary
        run: |
          cd universal
          tar -xzf Finicky-universal.tar.gz

      - name: Import signing certificate
        env:
          SIGNING_CERTIFICATE_P12_DATA: ${{ secrets.SIGNING_CERTIFICATE_P12_DATA }}
          SIGNING_CERTIFICATE_PASSWORD: ${{ secrets.SIGNING_CERTIFICATE_PASSWORD }}
        run: |
          # Create temporary keychain
          security create-keychain -p temp_password temp.keychain
          security default-keychain -s temp.keychain
          security unlock-keychain -p temp_password temp.keychain

          # Import certificate
          echo "$SIGNING_CERTIFICATE_P12_DATA" | base64 --decode > certificate.p12
          security import certificate.p12 -k temp.keychain -P "$SIGNING_CERTIFICATE_PASSWORD" -T /usr/bin/codesign

          # Set partition list
          security set-key-partition-list -S apple-tool:,apple:,codesign: -s -k temp_password temp.keychain

          # Clean up
          rm certificate.p12

      - name: Pre-sign bundle
        run: |
          codesign --deep --force --options runtime \
            --sign "Developer ID Application: John Sterling" \
            ./universal/Finicky.app

      - name: Install gon
        run: |
          brew install Bearer/tap/gon

      - name: Update gon config for CI
        run: |
          # Create the directory structure expected by the existing gon config
          mkdir -p apps/finicky/build
          # Copy the universal binary to the expected location for the existing gon config
          cp -r universal/Finicky.app apps/finicky/build/Finicky.app

      - name: Sign and notarize
        env:
          AC_USERNAME: ${{ secrets.APPLE_ID_USERNAME }}
          AC_PASSWORD: ${{ secrets.APPLE_ID_PASSWORD }}
          AC_PROVIDER: ${{ secrets.AC_PROVIDER }}
        run: |
          mkdir -p dist
          gon scripts/gon-config.json

      - name: Upload signed DMG
        uses: actions/upload-artifact@v4
        with:
          name: Finicky-signed-dmg
          path: dist/Finicky.dmg
          retention-days: 30

      - name: Cleanup keychain
        if: always()
        run: |
          security delete-keychain temp.keychain || true