mirror of
https://github.com/outbackdingo/firezone.git
synced 2026-01-27 10:18:54 +00:00
4e95dd1cb6
Setting `fail-fast: false` unsurprisingly makes our CI fail pretty slowly. This is especially noticable in the merge queue where a long-running job could still hold up the entire queue even though a different job has failed already and the PR is never going to make it in anyway. To avoid this scenario, we set `fail-fast: true` whenever we are in the merge queue.
142 lines
7.2 KiB
YAML
142 lines
7.2 KiB
YAML
name: Build macOS/iOS app
|
|
on:
|
|
workflow_call:
|
|
workflow_dispatch:
|
|
|
|
jobs:
|
|
update-release-draft:
|
|
name: update-release-draft
|
|
runs-on: ubuntu-24.04
|
|
env:
|
|
# mark:next-apple-version
|
|
RELEASE_NAME: macos-client-1.5.10
|
|
steps:
|
|
- uses: release-drafter/release-drafter@b1476f6e6eb133afa41ed8589daba6dc69b4d3f5 # v6.1.0
|
|
if: "${{ github.event_name == 'workflow_dispatch' && github.ref_name == 'main' }}"
|
|
id: update-release-draft
|
|
with:
|
|
config-name: release-drafter-macos-client.yml
|
|
tag: ${{ env.RELEASE_NAME}}
|
|
version: ${{ env.RELEASE_NAME}}
|
|
name: ${{ env.RELEASE_NAME}}
|
|
commitish: ${{ github.sha }}
|
|
env:
|
|
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
|
|
|
build:
|
|
name: ${{ matrix.job_name }}
|
|
needs: update-release-draft
|
|
runs-on: macos-15
|
|
env:
|
|
XCODE_VERSION: "26.0"
|
|
permissions:
|
|
contents: write # for attaching the build artifacts to the release
|
|
id-token: write
|
|
strategy:
|
|
fail-fast: ${{ github.event_name == 'merge_group' }}
|
|
matrix:
|
|
include:
|
|
- job_name: build-ios
|
|
rust-targets: aarch64-apple-ios
|
|
build-script: scripts/build/ios-appstore.sh
|
|
upload-script: scripts/upload/app-store-connect.sh
|
|
artifact-file: "Firezone.ipa"
|
|
platform: iOS
|
|
|
|
- job_name: build-macos-appstore
|
|
rust-targets: aarch64-apple-darwin x86_64-apple-darwin
|
|
build-script: scripts/build/macos-appstore.sh
|
|
upload-script: scripts/upload/app-store-connect.sh
|
|
artifact-file: "Firezone.pkg"
|
|
platform: macOS
|
|
|
|
- job_name: build-macos-standalone
|
|
rust-targets: aarch64-apple-darwin x86_64-apple-darwin
|
|
build-script: scripts/build/macos-standalone.sh
|
|
upload-script: scripts/upload/github-release.sh
|
|
# mark:next-apple-version
|
|
artifact-file: "firezone-macos-client-1.5.10.dmg"
|
|
# mark:next-apple-version
|
|
pkg-artifact-file: "firezone-macos-client-1.5.10.pkg"
|
|
# mark:next-apple-version
|
|
release-name: macos-client-1.5.10
|
|
steps:
|
|
- uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
|
|
with:
|
|
fetch-tags: true # Otherwise we cannot embed the correct version into the build.
|
|
- uses: ./.github/actions/setup-rust
|
|
with:
|
|
targets: ${{ matrix.rust-targets }}
|
|
sccache_azure_connection_string: ${{ secrets.SCCACHE_AZURE_CONNECTION_STRING }}
|
|
- run: ${{ matrix.build-script }}
|
|
env:
|
|
IOS_APP_PROVISIONING_PROFILE: "${{ secrets.APPLE_IOS_APP_PROVISIONING_PROFILE }}"
|
|
IOS_NE_PROVISIONING_PROFILE: "${{ secrets.APPLE_IOS_NE_PROVISIONING_PROFILE }}"
|
|
MACOS_APP_PROVISIONING_PROFILE: "${{ secrets.APPLE_MACOS_APP_PROVISIONING_PROFILE }}"
|
|
MACOS_NE_PROVISIONING_PROFILE: "${{ secrets.APPLE_MACOS_NE_PROVISIONING_PROFILE }}"
|
|
STANDALONE_MACOS_APP_PROVISIONING_PROFILE: "${{ secrets.APPLE_STANDALONE_MACOS_APP_PROVISIONING_PROFILE }}"
|
|
STANDALONE_MACOS_NE_PROVISIONING_PROFILE: "${{ secrets.APPLE_STANDALONE_MACOS_NE_PROVISIONING_PROFILE }}"
|
|
BUILD_CERT: "${{ secrets.APPLE_BUILD_CERTIFICATE_BASE64 }}"
|
|
BUILD_CERT_PASS: "${{ secrets.APPLE_BUILD_CERTIFICATE_P12_PASSWORD }}"
|
|
INSTALLER_CERT: "${{ secrets.APPLE_MAC_INSTALLER_CERTIFICATE_BASE64 }}"
|
|
INSTALLER_CERT_PASS: "${{ secrets.APPLE_MAC_INSTALLER_CERTIFICATE_P12_PASSWORD }}"
|
|
STANDALONE_BUILD_CERT: "${{ secrets.APPLE_STANDALONE_BUILD_CERTIFICATE_BASE64 }}"
|
|
STANDALONE_BUILD_CERT_PASS: "${{ secrets.APPLE_STANDALONE_BUILD_CERTIFICATE_P12_PASSWORD }}"
|
|
STANDALONE_INSTALLER_CERT: "${{ secrets.APPLE_STANDALONE_MAC_INSTALLER_CERTIFICATE_BASE64 }}"
|
|
STANDALONE_INSTALLER_CERT_PASS: "${{ secrets.APPLE_STANDALONE_MAC_INSTALLER_CERTIFICATE_P12_PASSWORD }}"
|
|
ARTIFACT_PATH: "${{ runner.temp }}/${{ matrix.artifact-file }}"
|
|
PKG_ARTIFACT_PATH: "${{ runner.temp }}/${{ matrix.pkg-artifact-file }}"
|
|
NOTARIZE: "${{ github.event_name == 'workflow_dispatch' }}"
|
|
ISSUER_ID: "${{ secrets.APPLE_APP_STORE_CONNECT_ISSUER_ID }}"
|
|
API_KEY_ID: "${{ secrets.APPLE_APP_STORE_CONNECT_API_KEY_ID }}"
|
|
API_KEY: "${{ secrets.APPLE_APP_STORE_CONNECT_API_KEY }}"
|
|
TEMP_DIR: "${{ runner.temp }}"
|
|
- name: Upload .dmg artifact
|
|
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
|
|
if: "${{ github.event_name == 'workflow_dispatch' && matrix.job_name == 'build-macos-standalone' }}"
|
|
with:
|
|
name: macos-client-standalone-dmg
|
|
path: "${{ runner.temp }}/${{ matrix.artifact-file }}"
|
|
- name: Upload .pkg artifact
|
|
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
|
|
if: "${{ github.event_name == 'workflow_dispatch' && matrix.job_name == 'build-macos-standalone' }}"
|
|
with:
|
|
name: macos-client-standalone-pkg
|
|
path: "${{ runner.temp }}/${{ matrix.pkg-artifact-file }}"
|
|
- run: ${{ matrix.upload-script }}
|
|
if: "${{ github.event_name == 'workflow_dispatch' && (github.ref_name == 'main' || matrix.job_name != 'build-macos-standalone') }}"
|
|
env:
|
|
ARTIFACT_PATH: "${{ runner.temp }}/${{ matrix.artifact-file }}"
|
|
ISSUER_ID: "${{ secrets.APPLE_APP_STORE_CONNECT_ISSUER_ID }}"
|
|
API_KEY_ID: "${{ secrets.APPLE_APP_STORE_CONNECT_API_KEY_ID }}"
|
|
API_KEY: "${{ secrets.APPLE_APP_STORE_CONNECT_API_KEY }}"
|
|
GITHUB_TOKEN: "${{ secrets.GITHUB_TOKEN }}"
|
|
RELEASE_NAME: "${{ matrix.release-name }}"
|
|
PLATFORM: "${{ matrix.platform }}"
|
|
# We also publish a pkg file for MDMs that don't like our DMG (Intune error 0x87D30139)
|
|
- run: ${{ matrix.upload-script }}
|
|
if: "${{ github.event_name == 'workflow_dispatch' && github.ref_name == 'main' && matrix.job_name == 'build-macos-standalone' }}"
|
|
env:
|
|
ARTIFACT_PATH: "${{ runner.temp }}/${{ matrix.pkg-artifact-file }}"
|
|
ISSUER_ID: "${{ secrets.APPLE_APP_STORE_CONNECT_ISSUER_ID }}"
|
|
API_KEY_ID: "${{ secrets.APPLE_APP_STORE_CONNECT_API_KEY_ID }}"
|
|
API_KEY: "${{ secrets.APPLE_APP_STORE_CONNECT_API_KEY }}"
|
|
GITHUB_TOKEN: "${{ secrets.GITHUB_TOKEN }}"
|
|
RELEASE_NAME: "${{ matrix.release-name }}"
|
|
PLATFORM: "${{ matrix.platform }}"
|
|
- name: Setup sentry CLI
|
|
if: "${{ github.event_name == 'workflow_dispatch' }}"
|
|
uses: matbour/setup-sentry-cli@3e938c54b3018bdd019973689ef984e033b0454b #v2.0.0
|
|
with:
|
|
token: ${{ secrets.SENTRY_AUTH_TOKEN }}
|
|
organization: firezone-inc
|
|
- name: Upload debug symbols to Sentry
|
|
if: "${{ github.event_name == 'workflow_dispatch' }}"
|
|
run: |
|
|
# Remove the /Applications symlink in the DMG staging directory so Sentry doesn't
|
|
# attempt to walk it.
|
|
rm -f "${{ runner.temp }}/dmg/Applications"
|
|
|
|
sentry-cli debug-files upload --log-level info --project apple-client --include-sources ${{ runner.temp }}
|
|
sentry-cli debug-files upload --log-level info --project apple-client --include-sources ./rust/target
|