ci: add universal macOS release workflow

2026-08-14 20:40:26 -05:00
parent d1fa7825fb
commit d3849acdd3
7 changed files with 173 additions and 3 deletions
@@ -0,0 +1,95 @@
+name: macOS release
+
+on:
+  workflow_dispatch:
+  push:
+    tags:
+      - 'v*'
+
+permissions:
+  contents: read
+
+jobs:
+  build-macos:
+    runs-on: macos-14
+    timeout-minutes: 45
+    env:
+      HAS_APPLE_SIGNING: ${{ secrets.MAC_CERTIFICATE_P12 != '' }}
+      HAS_APPLE_NOTARIZATION: ${{ secrets.APPLE_API_KEY_P8 != '' }}
+      CSC_LINK: ${{ secrets.MAC_CERTIFICATE_P12 }}
+      CSC_KEY_PASSWORD: ${{ secrets.MAC_CERTIFICATE_PASSWORD }}
+      APPLE_API_KEY_ID: ${{ secrets.APPLE_API_KEY_ID }}
+      APPLE_API_ISSUER: ${{ secrets.APPLE_API_ISSUER }}
+
+    steps:
+      - name: Check out source
+        uses: actions/checkout@v4
+
+      - name: Set up Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: 22
+          cache: npm
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Generate macOS icon
+        run: bash scripts/create-mac-icon.sh
+
+      - name: Verify source
+        run: |
+          npm run typecheck
+          npm run test:run
+          npm run build
+
+      - name: Prepare Apple API key
+        if: env.HAS_APPLE_NOTARIZATION == 'true'
+        env:
+          APPLE_API_KEY_P8: ${{ secrets.APPLE_API_KEY_P8 }}
+        run: |
+          printf '%s' "$APPLE_API_KEY_P8" > "$RUNNER_TEMP/AuthKey.p8"
+          chmod 600 "$RUNNER_TEMP/AuthKey.p8"
+
+      - name: Build unsigned universal DMG and ZIP
+        if: env.HAS_APPLE_SIGNING != 'true'
+        run: npx electron-builder --mac dmg zip --universal --publish never
+
+      - name: Build signed and notarized universal DMG and ZIP
+        if: env.HAS_APPLE_SIGNING == 'true' && env.HAS_APPLE_NOTARIZATION == 'true'
+        env:
+          APPLE_API_KEY: ${{ runner.temp }}/AuthKey.p8
+        run: npx electron-builder --mac dmg zip --universal --publish never -c.mac.notarize=true
+
+      - name: Reject incomplete signing configuration
+        if: env.HAS_APPLE_SIGNING == 'true' && env.HAS_APPLE_NOTARIZATION != 'true'
+        run: |
+          echo 'A signing certificate was supplied without Apple notarization credentials.' >&2
+          exit 1
+
+      - name: Verify embedded PAC catalog
+        run: |
+          test -f dist/module-catalog/wordpress-1.2.0.pac
+          test -f "dist/mac-universal/Aurora Dockside.app/Contents/Resources/module-catalog/wordpress-1.2.0.pac"
+          cmp dist/module-catalog/wordpress-1.2.0.pac "dist/mac-universal/Aurora Dockside.app/Contents/Resources/module-catalog/wordpress-1.2.0.pac"
+          unzip -t "dist/mac-universal/Aurora Dockside.app/Contents/Resources/module-catalog/wordpress-1.2.0.pac"
+
+      - name: Create checksums
+        run: |
+          find dist -maxdepth 1 -type f \( -name '*.dmg' -o -name '*-mac.zip' -o -name '*.yml' \) -print0 | sort -z | xargs -0 shasum -a 256 > dist/SHA256SUMS-macos.txt
+          shasum -a 256 dist/module-catalog/*.pac >> dist/SHA256SUMS-macos.txt
+          cat dist/SHA256SUMS-macos.txt
+
+      - name: Upload macOS release bundle
+        uses: actions/upload-artifact@v4
+        with:
+          name: aurora-dockside-macos-universal
+          if-no-files-found: error
+          retention-days: 14
+          path: |
+            dist/*.dmg
+            dist/*-mac.zip
+            dist/*.yml
+            dist/SHA256SUMS-macos.txt
+            dist/module-catalog/*.pac
+