Publish #134
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Publish | |
| on: | |
| workflow_dispatch: | |
| inputs: | |
| version: | |
| description: 'Version tag to create (e.g. 2.0.0)' | |
| type: string | |
| required: true | |
| prerelease: | |
| description: 'Mark the GitHub release as a prerelease' | |
| type: boolean | |
| required: false | |
| default: false | |
| dry-run: | |
| description: 'Build and assemble without publishing (no commit/tag/release)' | |
| type: boolean | |
| required: false | |
| default: false | |
| jobs: | |
| build-macos: | |
| name: Build macOS | |
| runs-on: macos-26 | |
| strategy: | |
| matrix: | |
| architecture: ['x86_64', 'arm64'] | |
| fail-fast: false | |
| permissions: | |
| contents: write | |
| steps: | |
| - name: Checkout Repo | |
| uses: actions/checkout@v6 | |
| with: | |
| ref: ${{ github.ref_name }} | |
| - name: Select Xcode Version | |
| run: sudo xcode-select --switch /Applications/Xcode_26.4.app/Contents/Developer | |
| - name: Stamp version | |
| run: sed -i '' 's|"0.0.0-development"|"${{ inputs.version }}"|' Sources/SafeDITool/SafeDITool.swift | |
| - name: Build SafeDITool | |
| run: xcrun swift build -c release --product SafeDITool --arch ${{ matrix.architecture }} -Xswiftc -Osize -Xswiftc -Xfrontend -Xswiftc -internalize-at-link -Xlinker -dead_strip | |
| - name: Strip binary | |
| run: strip -rSTx .build/*/release/SafeDITool | |
| - name: Give SafeDITool executable permissions | |
| run: chmod +x .build/*/release/SafeDITool | |
| - name: Smoke test | |
| run: .build/*/release/SafeDITool --version | |
| - name: Make codesigning folder | |
| run: | | |
| mkdir codesign | |
| cp .build/*/release/SafeDITool codesign/ | |
| - name: Codesign | |
| run: | | |
| echo "${{ secrets.BASE_64_ENCODED_P12 }}" | base64 --decode > codesign/certificate.p12 | |
| security create-keychain -p "" build.keychain | |
| security import codesign/certificate.p12 -k build.keychain -P "${{ secrets.P12_PASSWORD }}" -T /usr/bin/codesign | |
| security list-keychains -s build.keychain | |
| security default-keychain -s build.keychain | |
| security unlock-keychain -p "" build.keychain | |
| security set-key-partition-list -S apple-tool:,apple: -s -k "" build.keychain | |
| codesign --force --options runtime --timestamp --sign "${{ secrets.DEVELOPER_ID_CERTIFICATE }}" codesign/SafeDITool | |
| - name: Notarize | |
| run: | | |
| pushd codesign && zip -r SafeDITool.zip SafeDITool && popd | |
| rm codesign/SafeDITool | |
| echo "${{ secrets.NOTARY_P8 }}" > codesign/AuthKey_${{ secrets.NOTARY_KEY_ID }}.p8 | |
| xcrun notarytool submit codesign/SafeDITool.zip --key codesign/AuthKey_${{ secrets.NOTARY_KEY_ID }}.p8 --key-id ${{ secrets.NOTARY_KEY_ID }} --issuer ${{ secrets.NOTARY_ISSUER_ID }} --wait | |
| - name: Unzip notarized tool | |
| run: pushd codesign && unzip SafeDITool.zip && popd | |
| - name: Upload SafeDITool artifact | |
| uses: actions/upload-artifact@v7 | |
| with: | |
| name: SafeDITool-macos-${{ matrix.architecture }} | |
| path: codesign/SafeDITool | |
| - name: Cleanup | |
| if: always() | |
| run: | | |
| security delete-keychain build.keychain | |
| rm -rf codesign | |
| build-linux-x86_64: | |
| name: Build Linux x86_64 | |
| runs-on: ubuntu-latest | |
| container: swift:6.3 | |
| permissions: | |
| contents: read | |
| steps: | |
| - name: Checkout Repo | |
| uses: actions/checkout@v6 | |
| with: | |
| ref: ${{ github.ref_name }} | |
| - name: Stamp version | |
| run: sed -i 's|"0.0.0-development"|"${{ inputs.version }}"|' Sources/SafeDITool/SafeDITool.swift | |
| - name: Build SafeDITool | |
| run: swift build -c release --product SafeDITool --static-swift-stdlib -Xswiftc -Osize | |
| - name: Strip binary | |
| run: strip -s .build/release/SafeDITool | |
| - name: Smoke test | |
| run: .build/release/SafeDITool --version | |
| - name: Upload SafeDITool artifact | |
| uses: actions/upload-artifact@v7 | |
| with: | |
| name: SafeDITool-linux-x86_64 | |
| path: .build/release/SafeDITool | |
| build-linux-arm64: | |
| name: Build Linux arm64 | |
| runs-on: ubuntu-24.04-arm | |
| container: swift:6.3 | |
| permissions: | |
| contents: read | |
| steps: | |
| - name: Checkout Repo | |
| uses: actions/checkout@v6 | |
| with: | |
| ref: ${{ github.ref_name }} | |
| - name: Stamp version | |
| run: sed -i 's|"0.0.0-development"|"${{ inputs.version }}"|' Sources/SafeDITool/SafeDITool.swift | |
| - name: Build SafeDITool | |
| run: swift build -c release --product SafeDITool --static-swift-stdlib -Xswiftc -Osize | |
| - name: Strip binary | |
| run: strip -s .build/release/SafeDITool | |
| - name: Smoke test | |
| run: .build/release/SafeDITool --version | |
| - name: Upload SafeDITool artifact | |
| uses: actions/upload-artifact@v7 | |
| with: | |
| name: SafeDITool-linux-arm64 | |
| path: .build/release/SafeDITool | |
| assemble-and-publish: | |
| name: Assemble Artifact Bundle and Publish | |
| needs: [build-macos, build-linux-x86_64, build-linux-arm64] | |
| runs-on: macos-26 | |
| permissions: | |
| contents: write | |
| steps: | |
| - name: Checkout Repo | |
| uses: actions/checkout@v6 | |
| with: | |
| ref: ${{ github.ref_name }} | |
| token: ${{ secrets.RELEASE_UPLOADER }} | |
| - name: Select Xcode Version | |
| run: sudo xcode-select --switch /Applications/Xcode_26.4.app/Contents/Developer | |
| - name: Download all artifacts | |
| uses: actions/download-artifact@v4 | |
| with: | |
| path: artifacts | |
| - name: Assemble artifact bundle | |
| run: | | |
| mkdir -p SafeDITool.artifactbundle/SafeDITool-macos-arm64/bin | |
| mkdir -p SafeDITool.artifactbundle/SafeDITool-macos-x86_64/bin | |
| mkdir -p SafeDITool.artifactbundle/SafeDITool-linux-x86_64/bin | |
| mkdir -p SafeDITool.artifactbundle/SafeDITool-linux-arm64/bin | |
| cp artifacts/SafeDITool-macos-arm64/SafeDITool SafeDITool.artifactbundle/SafeDITool-macos-arm64/bin/SafeDITool | |
| cp artifacts/SafeDITool-macos-x86_64/SafeDITool SafeDITool.artifactbundle/SafeDITool-macos-x86_64/bin/SafeDITool | |
| cp artifacts/SafeDITool-linux-x86_64/SafeDITool SafeDITool.artifactbundle/SafeDITool-linux-x86_64/bin/SafeDITool | |
| cp artifacts/SafeDITool-linux-arm64/SafeDITool SafeDITool.artifactbundle/SafeDITool-linux-arm64/bin/SafeDITool | |
| chmod +x SafeDITool.artifactbundle/*/bin/SafeDITool | |
| cat > SafeDITool.artifactbundle/info.json << 'INFOJSON' | |
| { | |
| "schemaVersion": "1.0", | |
| "artifacts": { | |
| "SafeDITool": { | |
| "version": "${{ inputs.version }}", | |
| "type": "executable", | |
| "variants": [ | |
| { | |
| "path": "SafeDITool-macos-arm64/bin/SafeDITool", | |
| "supportedTriples": ["arm64-apple-macosx"] | |
| }, | |
| { | |
| "path": "SafeDITool-macos-x86_64/bin/SafeDITool", | |
| "supportedTriples": ["x86_64-apple-macosx"] | |
| }, | |
| { | |
| "path": "SafeDITool-linux-x86_64/bin/SafeDITool", | |
| "supportedTriples": ["x86_64-unknown-linux-gnu", "amd64-unknown-linux-gnu"] | |
| }, | |
| { | |
| "path": "SafeDITool-linux-arm64/bin/SafeDITool", | |
| "supportedTriples": ["aarch64-unknown-linux-gnu", "arm64-unknown-linux-gnu"] | |
| } | |
| ] | |
| } | |
| } | |
| } | |
| INFOJSON | |
| - name: Zip artifact bundle | |
| run: zip -9 -r SafeDITool.artifactbundle.zip SafeDITool.artifactbundle/ | |
| - name: Compute checksum | |
| id: checksum | |
| run: | | |
| CHECKSUM=$(swift package compute-checksum SafeDITool.artifactbundle.zip) | |
| echo "checksum=$CHECKSUM" >> "$GITHUB_OUTPUT" | |
| echo "Computed checksum: $CHECKSUM" | |
| - name: Update Package.swift | |
| run: ./Scripts/update-version.sh "${{ inputs.version }}" "${{ steps.checksum.outputs.checksum }}" | |
| - name: Show changes | |
| run: | | |
| echo "=== Package.swift changes ===" | |
| git diff Package.swift | |
| echo "=== Checksum: ${{ steps.checksum.outputs.checksum }} ===" | |
| - name: Upload artifact bundle | |
| uses: actions/upload-artifact@v7 | |
| with: | |
| name: SafeDITool-artifactbundle | |
| path: SafeDITool.artifactbundle.zip | |
| - name: Commit | |
| run: | | |
| git config user.name "github-actions[bot]" | |
| git config user.email "github-actions[bot]@users.noreply.github.com" | |
| git add Package.swift Plugins/Shared.swift | |
| git commit -m "Release ${{ inputs.version }}" | |
| - name: Upload release commit patch (dry run) | |
| if: inputs.dry-run | |
| run: git format-patch -1 HEAD -o /tmp/patch | |
| - name: Upload release commit patch artifact (dry run) | |
| if: inputs.dry-run | |
| uses: actions/upload-artifact@v7 | |
| with: | |
| name: release-commit | |
| path: /tmp/patch/*.patch | |
| - name: Prepare release assets | |
| run: | | |
| cp artifacts/SafeDITool-macos-arm64/SafeDITool SafeDITool-macos-arm64 | |
| cp artifacts/SafeDITool-macos-x86_64/SafeDITool SafeDITool-macos-x86_64 | |
| cp artifacts/SafeDITool-linux-x86_64/SafeDITool SafeDITool-linux-x86_64 | |
| cp artifacts/SafeDITool-linux-arm64/SafeDITool SafeDITool-linux-arm64 | |
| - name: Tag and push | |
| if: ${{ !inputs.dry-run }} | |
| run: | | |
| git tag "${{ inputs.version }}" | |
| git push origin "${{ github.ref_name }}" --tags | |
| - name: Create GitHub Release | |
| if: ${{ !inputs.dry-run }} | |
| env: | |
| GH_TOKEN: ${{ secrets.RELEASE_UPLOADER }} | |
| run: | | |
| gh release create "${{ inputs.version }}" \ | |
| --title "${{ inputs.version }}" \ | |
| --generate-notes \ | |
| ${{ inputs.prerelease && '--prerelease' || '' }} \ | |
| SafeDITool.artifactbundle.zip \ | |
| SafeDITool-macos-arm64 \ | |
| SafeDITool-macos-x86_64 \ | |
| SafeDITool-linux-x86_64 \ | |
| SafeDITool-linux-arm64 |