-
Notifications
You must be signed in to change notification settings - Fork 196
147 lines (142 loc) · 5.78 KB
/
app-artifacts-mac.yml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
name: Build and upload Mac app artifact
on:
workflow_dispatch:
inputs:
buildBranch:
description: 'Headlamp ref/branch/tag'
required: true
default: 'main'
signBinaries:
description: Notarize app
default: false
type: boolean
jobs:
# build-mac:
# runs-on: macos-latest
# steps:
# - uses: actions/checkout@v4
# with:
# ref: ${{ github.event.inputs.buildBranch }}
# - name: Setup nodejs
# uses: actions/setup-node@v4
# with:
# node-version: 18.x
# cache: 'npm'
# cache-dependency-path: |
# app/package-lock.json
# frontend/package-lock.json
# - uses: actions/setup-go@v5
# with:
# go-version: '1.20.*'
# cache-dependency-path: |
# backend/go.sum
# - name: Dependencies
# run: brew install make
# - name: Build Backend and Frontend
# run: |
# make
# - name: Add MacOS certs
# run: cd ./app/mac/scripts/ && sh ./setup-certificate.sh
# env:
# APPLE_CERTIFICATE: ${{ secrets.TEST_APPLE_DEV_CERT }}
# APPLE_CERTIFICATE_PASSWORD: ${{ secrets.TEST_APPLE_DEV_CERT_PASS }}
# - name: Build Notarized App Mac
# if: ${{ inputs.signBinaries }}
# run: |
# make app-build
# # env:
# # APPLEID: ${{ secrets.APPLEID }}
# # APPLEIDPASS: ${{ secrets.APPLEIDPASS }}
# # APPLETEAMID: ${{ secrets.APPLETEAMID }}
# # - name: Build App Mac
# # if: ${{ ! inputs.signBinaries }}
# # run: |
# # make app-mac
# - name: CodeSign
# run: |
# cd ./app/dist/mac && codesign -s ${{ secrets.TEST_APPLE_TEAM_ID }} --deep --force --options runtime --entitlements ../../mac/entitlements.mac.plist ./Headlamp.app
# - name: Zip Artifact
# run: |
# cd ./app/dist/mac && zip -r -X -y ./Headlamp.zip Headlamp.app
# - name: Upload artifact
# uses: actions/upload-artifact@v4
# with:
# name: zipbuild
# path: ./app/dist/mac/Headlamp.zip
# if-no-files-found: error
# retention-days: 1
notarize:
runs-on: windows-latest
# needs: build-mac
if: ${{ inputs.signBinaries }}
steps:
- uses: actions/checkout@v4
with:
ref: ${{ github.event.inputs.buildBranch }}
- name: Setup nodejs
uses: actions/setup-node@v4
with:
node-version: 18.x
cache: 'npm'
cache-dependency-path: |
app/package-lock.json
frontend/package-lock.json
- name: Download Direct (test/temp)
shell: pwsh
run: |
$currentPath = (Get-Location).Path
Invoke-WebRequest -Uri 'https://productionresultssa11.blob.core.windows.net/actions-results/e4420c55-2c75-424d-bd2a-6d68d68ae923/workflow-job-run-6f8d8423-5c14-5ef4-cc1e-ef33e16df4c9/artifacts/700818bb65e893a1e8bc92c8d61be9906c54ffaec4cedca1e84eb903f43dd9de.zip?rscd=attachment%3B+filename%3D%22zipbuild.zip%22&se=2024-02-16T13%3A20%3A21Z&sig=KdKO7YoEyQWSgbqqFtIYrnHhvXDR%2F1WfIUpnTTWipdU%3D&sp=r&spr=https&sr=b&st=2024-02-16T13%3A10%3A21Z&sv=2021-12-02' -OutFile $currentPath\app\dist
- name: Download artifact
id: download-artifact
uses: dawidd6/action-download-artifact@v3
with:
# Optional, GitHub token, a Personal Access Token with `public_repo` scope if needed
# Required, if the artifact is from a different repo
# Required, if the repo is private a Personal Access Token with `repo` scope is needed or GitHub token in a job where the permissions `action` scope set to `read`
github_token: ${{secrets.GITHUB_TOKEN}}
run_id: 7929503220
# - name: Download artifact
# uses: actions/download-artifact@v2
# with:
# name: zipbuild
# path: ./app/dist
- name: Fetch certificates
if: ${{ inputs.signBinaries }}
shell: pwsh
run: |
az login --service-principal -u ${{ secrets.WINDOWS_CLIENT_ID }} -p ${{ secrets.AZ_LOGIN_PASS }} --tenant 72f988bf-86f1-41af-91ab-2d7cd011db47
az keyvault secret download --subscription ${{ secrets.AZ_SUBSCRIPTION_ID }} --vault-name headlamp --name HeadlampAuthCert --file c:\HeadlampAuthCert.pfx --encoding base64
az keyvault secret download --subscription ${{ secrets.AZ_SUBSCRIPTION_ID }} --vault-name headlamp --name ESRPHeadlampReqCert --file c:\HeadlampReqCert.pfx --encoding base64
- name: Set up certificates
if: ${{ inputs.signBinaries }}
shell: pwsh
run: |
Import-PfxCertificate -FilePath c:\HeadlampAuthCert.pfx -CertStoreLocation Cert:\LocalMachine\My -Exportable
Import-PfxCertificate -FilePath c:\HeadlampReqCert.pfx -CertStoreLocation Cert:\LocalMachine\My -Exportable
- name: Download and Set up ESRPClient
if: ${{ inputs.signBinaries }}
shell: pwsh
run: |
nuget.exe sources add -name esrp -source ${{ secrets.ESRP_NUGET_INDEX_URL }} -username headlamp -password ${{ secrets.AZ_DEVOPS_TOKEN }}
nuget.exe install Microsoft.EsrpClient -Version 1.2.80 -source ${{ secrets.ESRP_NUGET_INDEX_URL }} | out-null
- name: App Windows
shell: pwsh
run: |
ls app/mac/scripts
if ("${{ inputs.signBinaries }}" -eq "true") {
$env:ESRP_PATH="$(Get-Location)\..\Microsoft.EsrpClient.1.2.80\tools\EsrpClient.exe"
$env:HEADLAMP_WINDOWS_CLIENT_ID="${{ secrets.WINDOWS_CLIENT_ID }}"
$env:HEADLAMP_WINDOWS_SIGN_EMAIL="${{ secrets.WINDOWS_SIGN_EMAIL }}"
} else {
echo "Not signing binaries"
}
cd ./app/mac/scripts
ls ../../
node ./esrp-notarize.js ../../dist/Headlamp.zip
- name: Upload Notarized
uses: actions/upload-artifact@v4
with:
name: Win exes
path: ./app/dist/Headlamp*.*
if-no-files-found: error
retention-days: 2