fix: download Sparkle tools directly in CI instead of searching Deriv… #3
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Release | |
| on: | |
| push: | |
| tags: ['v*'] | |
| permissions: | |
| contents: write | |
| jobs: | |
| build-and-release: | |
| runs-on: macos-15 | |
| steps: | |
| - uses: actions/checkout@v4 | |
| with: | |
| fetch-depth: 0 | |
| - name: Build universal binary | |
| run: ./package.sh | |
| - name: Download Sparkle tools | |
| run: | | |
| SPARKLE_VERSION="2.9.0" | |
| curl -sL "https://github.com/sparkle-project/Sparkle/releases/download/${SPARKLE_VERSION}/Sparkle-${SPARKLE_VERSION}.tar.xz" -o /tmp/sparkle.tar.xz | |
| mkdir -p /tmp/sparkle | |
| tar -xf /tmp/sparkle.tar.xz -C /tmp/sparkle | |
| echo "SIGN_UPDATE=/tmp/sparkle/bin/sign_update" >> "$GITHUB_ENV" | |
| - name: Sign update with Sparkle | |
| env: | |
| SPARKLE_PRIVATE_KEY: ${{ secrets.SPARKLE_PRIVATE_KEY }} | |
| run: | | |
| echo "$SPARKLE_PRIVATE_KEY" > /tmp/sparkle_key | |
| SIGNATURE=$("$SIGN_UPDATE" -f /tmp/sparkle_key dist/BrowserRouter.zip) | |
| rm -f /tmp/sparkle_key | |
| echo "SPARKLE_SIGNATURE=$SIGNATURE" >> "$GITHUB_ENV" | |
| echo "Signed successfully" | |
| - name: Update appcast.xml | |
| run: | | |
| VERSION="${GITHUB_REF_NAME#v}" | |
| python3 scripts/update_appcast.py \ | |
| --version "$VERSION" \ | |
| --signature "$SPARKLE_SIGNATURE" \ | |
| --file dist/BrowserRouter.zip | |
| - name: Commit updated appcast.xml | |
| run: | | |
| git config user.name "github-actions[bot]" | |
| git config user.email "github-actions[bot]@users.noreply.github.com" | |
| git checkout main | |
| git add appcast.xml | |
| git diff --cached --quiet && echo "No appcast changes" || \ | |
| (git commit -m "Update appcast.xml for ${GITHUB_REF_NAME}" && git push origin main) | |
| - name: Create GitHub Release | |
| env: | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| run: | | |
| SHA256=$(shasum -a 256 dist/BrowserRouter.zip | awk '{print $1}') | |
| gh release create "$GITHUB_REF_NAME" dist/BrowserRouter.zip \ | |
| --title "$GITHUB_REF_NAME" \ | |
| --notes "SHA256: \`${SHA256}\`" |