name: macOS release to Hetzner on: push: # Gitea enforces the configured macos-v* protection when tags are pushed. # Reading /tag_protections requires admin rights unavailable to job tokens. tags: - "macos-v*" workflow_dispatch: inputs: tag: description: "Existing protected macos-vMAJOR.MINOR.PATCH tag on main" required: true type: string permissions: contents: read concurrency: group: macos-release cancel-in-progress: false env: APPLE_SIGNING_IDENTITY: "Developer ID Application: Nico Schröder (ZZX2KZGTHU)" APPLE_TEAM_ID: ZZX2KZGTHU MACOS_RELEASE_TARGET: ${{ vars.MACOS_RELEASE_TARGET || 'aarch64-apple-darwin' }} S3_BUCKET: ${{ vars.S3_BUCKET }} S3_REGION: ${{ vars.S3_REGION }} S3_PREFIX: ${{ vars.S3_PREFIX || 'releases/macos' }} S3_PUBLIC_BASE_URL: ${{ vars.S3_PUBLIC_BASE_URL }} jobs: prepare: name: Validate release ref and configuration runs-on: ubuntu-latest timeout-minutes: 10 outputs: commit: ${{ steps.ref.outputs.commit }} tag: ${{ steps.ref.outputs.tag }} runner: ${{ steps.ref.outputs.runner }} steps: - name: Check out repository uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 with: fetch-depth: 0 - name: Select an existing version tag contained in main id: ref shell: bash env: REQUESTED_TAG: ${{ inputs.tag }} MACOS_RUNNER: ${{ vars.MACOS_RUNNER }} run: | set -Eeuo pipefail if [[ "$GITHUB_EVENT_NAME" == workflow_dispatch ]]; then [[ "$GITHUB_REF" == refs/heads/main ]] || { echo 'Dispatch this workflow from main.' >&2; exit 1; } tag="$REQUESTED_TAG" else tag="${GITHUB_REF#refs/tags/}" fi [[ "$tag" =~ ^macos-v(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)$ ]] || { echo 'Invalid macOS release tag.' >&2; exit 1; } [[ "$MACOS_RUNNER" =~ ^[a-zA-Z0-9_-]+$ ]] || { echo 'Set MACOS_RUNNER to a registered macOS runner label.' >&2; exit 1; } git fetch --no-tags origin main:refs/remotes/origin/main commit="$(git rev-parse --verify "refs/tags/$tag^{commit}")" git merge-base --is-ancestor "$commit" origin/main || { echo 'Release tag must belong to main.' >&2; exit 1; } git checkout --detach "$commit" printf 'commit=%s\ntag=%s\nrunner=%s\n' "$commit" "$tag" "$MACOS_RUNNER" >> "$GITHUB_OUTPUT" - name: Setup Node.js uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 with: node-version: 22 - name: Validate app versions and Hetzner configuration env: RELEASE_TAG: ${{ steps.ref.outputs.tag }} run: | node native/macos-ci.mjs metadata node native/publish-macos.mjs config release: name: Sign, notarize, verify and publish macOS needs: prepare runs-on: ${{ needs.prepare.outputs.runner }} timeout-minutes: 120 env: RELEASE_TAG: ${{ needs.prepare.outputs.tag }} steps: - name: Check out the validated commit uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 with: ref: ${{ needs.prepare.outputs.commit }} persist-credentials: false - name: Validate runner and required secrets shell: bash env: APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }} APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }} APPLE_PASSWORD: ${{ secrets.APPLE_PASSWORD }} S3_ACCESS_KEY_ID: ${{ secrets.S3_ACCESS_KEY_ID }} S3_SECRET_ACCESS_KEY: ${{ secrets.S3_SECRET_ACCESS_KEY }} run: | set -Eeuo pipefail [[ "$(uname -s)" == Darwin ]] || { echo 'A macOS runner is required.' >&2; exit 1; } case "$MACOS_RELEASE_TARGET:$(uname -m)" in aarch64-apple-darwin:arm64|x86_64-apple-darwin:x86_64) ;; *) echo 'Runner architecture must match MACOS_RELEASE_TARGET.' >&2; exit 1 ;; esac xcodebuild -version xcrun --find notarytool aws --version | grep '^aws-cli/2\.' || { echo 'Install AWS CLI v2 permanently on this runner.' >&2; exit 1; } for name in APPLE_CERTIFICATE APPLE_CERTIFICATE_PASSWORD APPLE_PASSWORD S3_ACCESS_KEY_ID S3_SECRET_ACCESS_KEY; do [[ -n "${!name}" ]] || { echo "Missing repository secret: $name" >&2; exit 1; } done - name: Setup pnpm uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v11.7.0 with: package-json-file: package.json - name: Setup Node.js uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 with: node-version: 22 - name: Setup Rust uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de with: toolchain: 1.98.1 targets: ${{ env.MACOS_RELEASE_TARGET }} components: rustfmt, clippy - name: Install locked dependencies run: | pnpm install --frozen-lockfile pnpm --dir native install --frozen-lockfile - name: Run native checks before importing signing credentials run: | pnpm exec eslint native --max-warnings 0 pnpm --dir native test pnpm --dir native check - name: Prepare isolated signing keychain id: signing shell: bash env: APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }} run: | set -Eeuo pipefail umask 077 signing_dir="$(mktemp -d "$RUNNER_TEMP/kanbangit-signing.XXXXXX")" printf 'SIGNING_DIRECTORY=%s\n' "$signing_dir" >> "$GITHUB_ENV" security list-keychains -d user > "$signing_dir/original-keychains.txt" printf '%s' "$APPLE_CERTIFICATE" | base64 --decode > "$signing_dir/certificate.p12" password="$(openssl rand -hex 32)" echo "::add-mask::$password" printf 'keychain=kanbangit-%s-%s\npassword=%s\ncertificate=%s/certificate.p12\n' "$GITHUB_RUN_ID" "$GITHUB_RUN_ATTEMPT" "$password" "$signing_dir" >> "$GITHUB_OUTPUT" - name: Import Developer ID certificate uses: Apple-Actions/import-codesign-certs@5142e029c445c10ffc7149d172e540235a065466 # v7.0.0; deletes its keychain in the post step with: keychain: ${{ steps.signing.outputs.keychain }} keychain-password: ${{ steps.signing.outputs.password }} p12-filepath: ${{ steps.signing.outputs.certificate }} p12-password: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }} - name: Confirm release signing identity shell: bash run: | set -Eeuo pipefail security find-identity -v -p codesigning | grep -F "\"$APPLE_SIGNING_IDENTITY\"" - name: Build, sign and notarize with Tauri uses: tauri-apps/tauri-action@1deb371b0cd8bd54025b384f1cd735e725c4060f # v1.0.0 env: APPLE_ID: dev@petsch-studios.de APPLE_PASSWORD: ${{ secrets.APPLE_PASSWORD }} with: projectPath: native tauriScript: pnpm exec tauri args: >- --ci --target ${{ env.MACOS_RELEASE_TARGET }} --bundles app --config '{"bundle":{"createUpdaterArtifacts":false,"macOS":{"hardenedRuntime":true}}}' -- --locked uploadUpdaterJson: false uploadUpdaterSignatures: false uploadWorkflowArtifacts: false - name: Verify signed app and packaged download id: package run: node native/macos-ci.mjs package - name: Publish immutable files and verify public Hetzner downloads env: AWS_ACCESS_KEY_ID: ${{ secrets.S3_ACCESS_KEY_ID }} AWS_SECRET_ACCESS_KEY: ${{ secrets.S3_SECRET_ACCESS_KEY }} AWS_EC2_METADATA_DISABLED: "true" AWS_REQUEST_CHECKSUM_CALCULATION: when_required AWS_RESPONSE_CHECKSUM_VALIDATION: when_required RELEASE_DIRECTORY: ${{ steps.package.outputs.directory }} run: node native/publish-macos.mjs upload - name: Restore keychain search list and remove certificate export if: ${{ always() }} shell: bash run: | python3 - <<'PY' import os, pathlib, shlex, shutil, subprocess value = os.environ.get('SIGNING_DIRECTORY') if value: directory = pathlib.Path(value) original = directory / 'original-keychains.txt' try: if original.exists(): subprocess.run(['security', 'list-keychains', '-d', 'user', '-s', *shlex.split(original.read_text())], check=True) finally: shutil.rmtree(directory) PY