CD #552
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CD | |
| # | Platform | Nightly | Weekly (if diff HEAD) | TestFlight Tag | Release | | |
| # |-----------------|---------|------------------------|----------------|---------------------| | |
| # | macOS | ftp | app-store | app-store | app-store, ftp | | |
| # | iOS | ftp | app-store | app-store | app-store | | |
| # |-----------------|---------|------------------------|----------------|---------------------| | |
| # | VERSION | Date | get from project.yml | project.yml | project.yml | | |
| # |-----------------|---------|------------------------|----------------|---------------------| | |
| # | UPLOAD_FOLDER | nightly | - | - | release/kiwix-macos | | |
| # |-----------------|---------|------------------------|----------------|---------------------| | |
| on: | |
| schedule: | |
| - cron: '32 1 * * *' # Nightly download.kiwix.org @ 01:32 | |
| - cron: '00 2 * * 1' # Weekly testflight @ 02:00 on Monday | |
| push: | |
| tags: | |
| - testflight # On-demand TestFlight | |
| release: | |
| types: [published] # Release | |
| env: | |
| KEYCHAIN: /Users/runner/build.keychain-db | |
| KEYCHAIN_PASSWORD: mysecretpassword | |
| KEYCHAIN_PROFILE: build-profile | |
| SSH_KEY: /tmp/id_rsa | |
| APPLE_STORE_AUTH_KEY_PATH: /tmp/authkey.p8 | |
| APPLE_AUTH_PARAMS: "-authenticationKeyPath /tmp/authkey.p8 -authenticationKeyID ${{ secrets.APPLE_STORE_AUTH_KEY_ID }} -authenticationKeyIssuerID ${{ secrets.APPLE_STORE_AUTH_KEY_ISSUER_ID }}" | |
| # conditionally updated later: | |
| EXPORT_METHOD: "app-store" | |
| EXTRA_XCODEBUILD: "" | |
| UPLOAD_TO: "" # !important this filters down the matrix combinations | |
| VERSION: "" | |
| HAS_CHANGED_LAST_WEEK: "no" | |
| SIGNING_CERTIFICATE: "" | |
| SIGNING_CERTIFICATE_P12_PASSWORD: "" | |
| jobs: | |
| build_and_deploy: | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| platform: [iOS, macOS] | |
| destination: [app-store, ftp] | |
| runs-on: macos-13 | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@v4 | |
| - name: Install python dependencies | |
| run: pip install pyyaml==6.0.1 | |
| - name: Set VERSION from code | |
| shell: python | |
| run: | | |
| import yaml | |
| import os | |
| with open("project.yml") as yml_file: | |
| project = yaml.safe_load(yml_file) | |
| version = project['targets']['Kiwix']['settings']['base']['MARKETING_VERSION'] | |
| with open(os.getenv("GITHUB_ENV"), "a") as fh: | |
| fh.write(f"VERSION={version}\n") | |
| - name: Get the date of last change | |
| run: echo "DATE_OF_LAST_CHANGE=`git log -1 --format=%ct`" >> $GITHUB_ENV | |
| - name: Check for code changes in the last week | |
| shell: python | |
| run: | | |
| import datetime | |
| import os | |
| now = datetime.datetime.now() | |
| last_change = datetime.datetime.fromtimestamp(int(os.getenv("DATE_OF_LAST_CHANGE"))) | |
| value = "yes" if (now - last_change).days < 7 else "no" | |
| with open(os.getenv("GITHUB_ENV"), "a") as fh: | |
| fh.write(f"HAS_CHANGED_LAST_WEEK={value}\n") | |
| - name: Nightly setup # use ftp and overrwrite VERSION with current date | |
| if: github.event_name == 'schedule' && github.event.schedule == '32 1 * * *' | |
| shell: python | |
| run: | | |
| import datetime | |
| import os | |
| version = str(datetime.date.today()) | |
| with open(os.getenv("GITHUB_ENV"), "a") as fh: | |
| fh.write(f"VERSION={version}\n") | |
| fh.write(f"UPLOAD_TO=\"ftp\"\n") | |
| fh.write(f"UPLOAD_FOLDER=nightly/{version}\n") | |
| - name: Weekly setup | |
| if: github.event_name == 'schedule' && github.event.schedule == '00 2 * * 1' && env.HAS_CHANGED_LAST_WEEK == 'yes' | |
| run: echo 'UPLOAD_TO="app-store"' >> $GITHUB_ENV | |
| - name: Testflight tag setup | |
| if: github.event_name == 'push' | |
| run: echo 'UPLOAD_TO="app-store"' >> $GITHUB_ENV | |
| - name: Release setup for iOS | |
| if: github.event_name == 'release' && matrix.platform == 'iOS' | |
| run: echo 'UPLOAD_TO="app-store"' >> $GITHUB_ENV | |
| - name: Release setup for macOS | |
| if: github.event_name == 'release' && matrix.platform == 'macOS' | |
| run: | | |
| echo 'UPLOAD_TO="app-store ftp"' >> $GITHUB_ENV | |
| echo "UPLOAD_FOLDER=release/kiwix-macos" >> $GITHUB_ENV | |
| - name: Set iOS extra xcode params | |
| if: matrix.platform == 'iOS' && contains(env.UPLOAD_TO, matrix.destination) | |
| run: echo "EXTRA_XCODEBUILD=-sdk iphoneos ${{ env.APPLE_AUTH_PARAMS }}" >> $GITHUB_ENV | |
| - name: Set EXTRA_XCODEBUILD for macOS AppStore | |
| if: matrix.platform == 'macOS' && matrix.destination == 'app-store' | |
| run: echo "EXTRA_XCODEBUILD=${{ env.APPLE_AUTH_PARAMS }}" >> $GITHUB_ENV | |
| - name: Set macOS FTP export method, and Developer ID Certificate | |
| if: matrix.platform == 'macOS' && matrix.destination == 'ftp' && contains(env.UPLOAD_TO, matrix.destination) | |
| run: | | |
| echo "EXPORT_METHOD=developer-id" >> $GITHUB_ENV | |
| echo "SIGNING_CERTIFICATE=${{ secrets.APPLE_DEVELOPER_ID_SIGNING_CERTIFICATE }}" >> $GITHUB_ENV | |
| echo "SIGNING_CERTIFICATE_P12_PASSWORD=${{ secrets.APPLE_DEVELOPER_ID_SIGNING_P12_PASSWORD }}" >> $GITHUB_ENV | |
| echo "SIGNING_IDENTITY=${{ secrets.APPLE_DEVELOPER_ID_SIGNING_IDENTITY }}" >> $GITHUB_ENV | |
| - name: Use Apple Development Certificate | |
| if: matrix.platform == 'iOS' && matrix.destination == 'ftp' && contains(env.UPLOAD_TO, matrix.destination) | |
| run: | | |
| echo "SIGNING_CERTIFICATE=${{ secrets.APPLE_DEVELOPMENT_SIGNING_CERTIFICATE }}" >> $GITHUB_ENV | |
| echo "SIGNING_CERTIFICATE_P12_PASSWORD=${{ secrets.APPLE_DEVELOPMENT_SIGNING_P12_PASSWORD }}" >> $GITHUB_ENV | |
| echo "SIGNING_IDENTITY=${{ secrets.APPLE_DEVELOPMENT_SIGNING_IDENTITY }}" >> $GITHUB_ENV | |
| - name: Use Apple Distribution Certificate | |
| if: matrix.destination == 'app-store' && contains(env.UPLOAD_TO, matrix.destination) | |
| run: | | |
| echo "SIGNING_CERTIFICATE=${{ secrets.APPLE_DISTRIBUTION_SIGNING_CERTIFICATE }}" >> $GITHUB_ENV | |
| echo "SIGNING_CERTIFICATE_P12_PASSWORD=${{ secrets.APPLE_DISTRIBUTION_SIGNING_P12_PASSWORD }}" >> $GITHUB_ENV | |
| echo "SIGNING_IDENTITY=${{ secrets.APPLE_DEVELOPMENT_SIGNING_IDENTITY }}" >> $GITHUB_ENV | |
| - name: Decode Apple Store Key | |
| run: echo "${{ secrets.APPLE_STORE_AUTH_KEY }}" | base64 --decode -o ${{ env.APPLE_STORE_AUTH_KEY_PATH }} | |
| - name: Build xcarchive | |
| if: contains(env.UPLOAD_TO, matrix.destination) | |
| uses: ./.github/actions/xcbuild | |
| with: | |
| action: archive | |
| xc-destination: generic/platform=${{ matrix.platform }} | |
| version: ${{ env.VERSION }} | |
| APPLE_DEVELOPMENT_SIGNING_CERTIFICATE: ${{ secrets.APPLE_DEVELOPMENT_SIGNING_CERTIFICATE }} | |
| APPLE_DEVELOPMENT_SIGNING_P12_PASSWORD: ${{ secrets.APPLE_DEVELOPMENT_SIGNING_P12_PASSWORD }} | |
| DEPLOYMENT_SIGNING_CERTIFICATE: ${{ env.SIGNING_CERTIFICATE }} | |
| DEPLOYMENT_SIGNING_CERTIFICATE_P12_PASSWORD: ${{ env.SIGNING_CERTIFICATE_P12_PASSWORD }} | |
| KEYCHAIN: ${{ env.KEYCHAIN }} | |
| KEYCHAIN_PASSWORD: ${{ env.KEYCHAIN_PASSWORD }} | |
| KEYCHAIN_PROFILE: ${{ env.KEYCHAIN_PROFILE }} | |
| EXTRA_XCODEBUILD: ${{ env.EXTRA_XCODEBUILD }} | |
| - name: Add altool credentials to Keychain | |
| if: matrix.destination == 'ftp' && contains(env.UPLOAD_TO, matrix.destination) | |
| env: | |
| APPLE_SIGNING_ALTOOL_USERNAME: ${{ secrets.APPLE_SIGNING_ALTOOL_USERNAME }} | |
| APPLE_SIGNING_ALTOOL_PASSWORD: ${{ secrets.APPLE_SIGNING_ALTOOL_PASSWORD }} | |
| APPLE_SIGNING_TEAM: ${{ secrets.APPLE_SIGNING_TEAM }} | |
| run: | | |
| security find-identity -v $KEYCHAIN | |
| security unlock-keychain -p $KEYCHAIN_PASSWORD $KEYCHAIN | |
| xcrun notarytool store-credentials \ | |
| --apple-id "${APPLE_SIGNING_ALTOOL_USERNAME}" \ | |
| --password "${APPLE_SIGNING_ALTOOL_PASSWORD}" \ | |
| --team-id "${APPLE_SIGNING_TEAM}" \ | |
| --validate \ | |
| --keychain $KEYCHAIN \ | |
| $KEYCHAIN_PROFILE | |
| - name: Prepare export for IPA | |
| if: matrix.platform == 'iOS' && matrix.destination == 'ftp' && contains(env.UPLOAD_TO, matrix.destination) | |
| run: | | |
| plutil -create xml1 ./export.plist | |
| plutil -insert method -string ad-hoc ./export.plist | |
| plutil -insert provisioningProfiles -dictionary ./export.plist | |
| plutil -replace provisioningProfiles -json '{ "self.Kiwix" : "iOS Team Provisioning Profile" }' ./export.plist | |
| - name: Prepare export for not IPA | |
| # else statement for Prepare export for IPA | |
| # [(macOS, ftp), (macOS, app-store), (iOS, app-store)] | |
| if: (matrix.platform == 'macOS' || matrix.destination == 'app-store') && contains(env.UPLOAD_TO, matrix.destination) | |
| run: | | |
| plutil -create xml1 ./export.plist | |
| plutil -insert destination -string upload ./export.plist | |
| plutil -insert method -string $EXPORT_METHOD ./export.plist | |
| - name: Upload Archive to Apple (App Store or Notarization) | |
| if: contains(env.UPLOAD_TO, matrix.destination) | |
| env: | |
| VERSION: ${{ env.VERSION }} | |
| run: python .github/retry-if-retcode.py --sleep 60 --attempts 5 --retcode 70 xcrun xcodebuild -exportArchive -archivePath $PWD/Kiwix-$VERSION.xcarchive -exportPath $PWD/export/ -exportOptionsPlist export.plist -allowProvisioningUpdates ${{ env.APPLE_AUTH_PARAMS }} | |
| - name: Export notarized App from archive, Create and Notarize DMG | |
| if: matrix.platform == 'macOS' && matrix.destination == 'ftp' && contains(env.UPLOAD_TO, matrix.destination) | |
| run: | | |
| python .github/retry-if-retcode.py --sleep 60 --attempts 20 --retcode 65 xcrun xcodebuild -exportNotarizedApp -archivePath $PWD/Kiwix-$VERSION.xcarchive -exportPath $PWD/export/ -allowProvisioningUpdates ${{ env.APPLE_AUTH_PARAMS }} | |
| pip install dmgbuild | |
| dmgbuild -s .github/dmg-settings.py -Dapp=$PWD/export/Kiwix.app -Dbg=.github/dmg-bg.png "Kiwix-$VERSION" $PWD/kiwix-$VERSION.dmg | |
| xcrun notarytool submit --keychain $KEYCHAIN --keychain-profile $KEYCHAIN_PROFILE --wait $PWD/kiwix-$VERSION.dmg | |
| xcrun stapler staple $PWD/kiwix-$VERSION.dmg | |
| - name: Add SSH_KEY to filesystem | |
| if: matrix.destination == 'ftp' && contains(env.UPLOAD_TO, matrix.destination) | |
| run: | | |
| echo "${{ secrets.SSH_KEY }}" > $SSH_KEY | |
| chmod 600 $SSH_KEY | |
| - name: Upload DMG | |
| if: matrix.platform == 'macOS' && matrix.destination == 'ftp' && contains(env.UPLOAD_TO, matrix.destination) | |
| run: | | |
| mv ${PWD}/kiwix-${VERSION}.dmg ${PWD}/kiwix-macos_${VERSION}.dmg | |
| python .github/upload_file.py --src ${PWD}/kiwix-macos_${VERSION}.dmg --dest [email protected]:30022/data/download/${UPLOAD_FOLDER} --ssh-key ${SSH_KEY} | |
| mv ${PWD}/kiwix-macos_${VERSION}.dmg ${PWD}/kiwix-${VERSION}.dmg | |
| - name: Upload IPA | |
| if: matrix.platform == 'iOS' && matrix.destination == 'ftp' && contains(env.UPLOAD_TO, matrix.destination) | |
| run: | | |
| mv ${PWD}/export/Kiwix.ipa ${PWD}/export/kiwix-${VERSION}.ipa | |
| python .github/upload_file.py --src ${PWD}/export/kiwix-${VERSION}.ipa --dest [email protected]:30022/data/download/${UPLOAD_FOLDER} --ssh-key ${SSH_KEY} |