allow to close the prompt window using esc key, add new providers: op… #75
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Build and Release | |
| on: | |
| push: | |
| branches: [ main ] | |
| tags: [ 'v*' ] | |
| pull_request: | |
| branches: [ main ] | |
| # Add permissions for the GITHUB_TOKEN | |
| permissions: | |
| contents: write | |
| jobs: | |
| build: | |
| runs-on: macos-latest | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@v3 | |
| - name: Set up Xcode | |
| uses: maxim-lobanov/setup-xcode@v1 | |
| with: | |
| xcode-version: latest-stable | |
| - name: Install Apple Certificate | |
| if: github.event_name != 'pull_request' | |
| env: | |
| CERTIFICATE_BASE64: ${{ secrets.APPLE_DEVELOPER_CERTIFICATE_P12_BASE64 }} | |
| CERTIFICATE_PASSWORD: ${{ secrets.APPLE_DEVELOPER_CERTIFICATE_PASSWORD }} | |
| KEYCHAIN_PASSWORD: ${{ github.run_id }} | |
| CERTIFICATE_NAME: ${{ secrets.APPLE_CERTIFICATE_NAME }} | |
| run: | | |
| # Create keychain | |
| security create-keychain -p "${KEYCHAIN_PASSWORD}" build.keychain | |
| security default-keychain -s build.keychain | |
| security unlock-keychain -p "${KEYCHAIN_PASSWORD}" build.keychain | |
| security set-keychain-settings -t 3600 -u build.keychain | |
| # Import certificate | |
| echo $CERTIFICATE_BASE64 | base64 --decode > certificate.p12 | |
| security import certificate.p12 -k build.keychain -P "${CERTIFICATE_PASSWORD}" -T /usr/bin/codesign | |
| security set-key-partition-list -S apple-tool:,apple: -s -k "${KEYCHAIN_PASSWORD}" build.keychain | |
| # Check if the certificate was imported correctly and find its identity | |
| security find-identity -v -p codesigning build.keychain | |
| # Clean up | |
| rm certificate.p12 | |
| - name: Build for macOS | |
| run: | | |
| xcodebuild clean build -project A-Instant.xcodeproj -scheme A-Instant -configuration Release -derivedDataPath build ARCHS="arm64 x86_64" ONLY_ACTIVE_ARCH=NO | |
| - name: Create and Sign App Bundle | |
| if: github.event_name != 'pull_request' | |
| env: | |
| TEAM_ID: ${{ secrets.APPLE_TEAM_ID }} | |
| CERTIFICATE_NAME: ${{ secrets.APPLE_CERTIFICATE_NAME }} | |
| run: | | |
| mkdir -p ./artifacts | |
| cd build/Build/Products/Release | |
| # Find the Developer ID Application certificate identity | |
| IDENTITY=$(security find-identity -v -p codesigning | grep "Developer ID Application" | head -1 | sed -E 's/.*\) ([A-F0-9]+) ".*"/\1/') | |
| if [ -z "$IDENTITY" ]; then | |
| echo "Error: No Developer ID Application certificate found in keychain" | |
| exit 1 | |
| fi | |
| echo "Using certificate identity: $IDENTITY" | |
| # Sign the app with entitlements | |
| codesign --force --deep --options runtime --entitlements "${GITHUB_WORKSPACE}/A-Instant/A-Instant.entitlements" --sign "$IDENTITY" A-Instant.app | |
| # Verify signature | |
| codesign --verify --verbose A-Instant.app | |
| # Create zip for GitHub release | |
| ditto -c -k --sequesterRsrc --keepParent A-Instant.app ../../../../artifacts/A-Instant.zip | |
| - name: Create Unsigned App Bundle (PR only) | |
| if: github.event_name == 'pull_request' | |
| run: | | |
| mkdir -p ./artifacts | |
| cd build/Build/Products/Release | |
| # Ad-hoc sign for PR builds | |
| codesign --force --deep -s - A-Instant.app | |
| ditto -c -k --sequesterRsrc --keepParent A-Instant.app ../../../../artifacts/A-Instant.zip | |
| - name: Notarize macOS Application | |
| if: github.event_name != 'pull_request' && startsWith(github.ref, 'refs/tags/') | |
| env: | |
| APPLE_ID: ${{ secrets.APPLE_DEVELOPER_ID }} | |
| TEAM_ID: ${{ secrets.APPLE_TEAM_ID }} | |
| APP_PASSWORD: ${{ secrets.APPLE_APP_SPECIFIC_PASSWORD }} | |
| run: | | |
| # Notarize the app | |
| xcrun notarytool submit artifacts/A-Instant.zip \ | |
| --apple-id "$APPLE_ID" \ | |
| --team-id "$TEAM_ID" \ | |
| --password "$APP_PASSWORD" \ | |
| --wait | |
| # Create a copy of the zip for notarization result | |
| cp artifacts/A-Instant.zip artifacts/A-Instant-notarized.zip | |
| # Extract the app for stapling | |
| mkdir -p artifacts/extracted | |
| unzip -q artifacts/A-Instant.zip -d artifacts/extracted | |
| # Staple the notarization ticket | |
| xcrun stapler staple artifacts/extracted/A-Instant.app | |
| # Create final release zip after notarization | |
| cd artifacts/extracted | |
| ditto -c -k --sequesterRsrc --keepParent A-Instant.app ../../artifacts/A-Instant-notarized.zip | |
| cd ../.. | |
| mv artifacts/A-Instant-notarized.zip artifacts/A-Instant.zip | |
| # Clean up | |
| rm -rf artifacts/extracted | |
| - name: Upload build artifacts | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: app-macos | |
| path: artifacts/*.zip | |
| - name: Create Release | |
| id: create_release | |
| if: startsWith(github.ref, 'refs/tags/') | |
| uses: softprops/action-gh-release@v1 | |
| with: | |
| draft: false | |
| prerelease: false | |
| files: | | |
| artifacts/A-Instant.zip | |
| name: A-Instant ${{ github.ref_name }} | |
| body: | | |
| A-Instant ${{ github.ref_name }} | |
| ## What's New | |
| Please check the commit history for changes since the last release. | |
| env: | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} |