diff --git a/.github/workflows/dist-build-mac.yaml b/.github/workflows/dist-build-mac.yaml index 6beed41..53eccec 100644 --- a/.github/workflows/dist-build-mac.yaml +++ b/.github/workflows/dist-build-mac.yaml @@ -9,77 +9,77 @@ on: workflow_dispatch: {} push: tags: - - '*' + - "*" branches: - - 'windows-port' + - "windows-port" release: types: [published] jobs: build: - runs-on: macos-10.15 + runs-on: macos-latest steps: - - uses: actions/checkout@v2 - - name: Set up Python - uses: actions/setup-python@v2 - with: - python-version: '3.9' - - name: Setup XCode - uses: maxim-lobanov/setup-xcode@v1 - with: - xcode-version: latest-stable - - name: Setup PyOxidizer and build - run: | - wget ${PYOXIDIZER_DOWNLOAD} - unzip PyOxidizer-0.20.0-exe-macos-universal.zip - sudo chmod +x ./pyoxidizer - ./pyoxidizer build exe --release - cp `find build/ -name "deck"` ./deck - cat pyproject.toml | grep version -m 1 | awk '{ print "APP_VERSION="substr($3, 2, length($3) -2)}' >> $GITHUB_ENV - - name: Codesign executable - env: - MACOS_DEVELOPER_HASH: ${{ secrets.MACOS_DEVELOPER_HASH }} - MACOS_APP_HASH: ${{ secrets.MACOS_APP_HASH }} - MACOS_CERTIFICATE: ${{ secrets.MACOS_CERTIFICATE }} - MACOS_KEYCHAIN_PASS: ${{ secrets.MACOS_KEYCHAIN_PASS }} - MACOS_CERTIFICATE_PWD: ${{ secrets.MACOS_CERTIFICATE_PWD }} - run: | - echo $MACOS_CERTIFICATE | base64 --decode > certificate.p12 - security create-keychain -p $MACOS_KEYCHAIN_PASS build.keychain - security default-keychain -s build.keychain - security unlock-keychain -p $MACOS_KEYCHAIN_PASS build.keychain - security import certificate.p12 -k build.keychain -P $MACOS_CERTIFICATE_PWD -T /usr/bin/codesign - security set-key-partition-list -S apple-tool:,apple:,codesign: -s -k $MACOS_KEYCHAIN_PASS build.keychain - - echo " - - - - com.apple.security.cs.allow-jit - - com.apple.security.cs.allow-unsigned-executable-memory - - com.apple.security.cs.disable-library-validation - - - " > entitlements.plist - - echo "Now running codesign" - /usr/bin/codesign --deep --force --options=runtime --entitlements ./entitlements.plist --sign $MACOS_APP_HASH --timestamp ./deck - - name: Upload Artifact - uses: actions/upload-artifact@v2 - with: - name: deck-${{ env.APP_VERSION }}-darwin-universal - path: | - deck - LICENSE - README.md - retention-days: 5 - - name: Create release zip - if: ${{ github.event.release && github.event.action == 'published' }} - run: zip deck-${{ env.APP_VERSION }}-darwin-universal.zip "deck" "LICENSE" "README.md" - - name: Attach files to release - uses: softprops/action-gh-release@v1 - if: ${{ github.event.release && github.event.action == 'published' }} - with: - files: deck-${{ env.APP_VERSION }}-darwin-universal.zip \ No newline at end of file + - uses: actions/checkout@v2 + - name: Set up Python + uses: actions/setup-python@v2 + with: + python-version: "3.9" + - name: Setup XCode + uses: maxim-lobanov/setup-xcode@v1 + with: + xcode-version: latest-stable + - name: Setup PyOxidizer and build + run: | + wget ${PYOXIDIZER_DOWNLOAD} + unzip PyOxidizer-0.20.0-exe-macos-universal.zip + sudo chmod +x ./pyoxidizer + ./pyoxidizer build exe --release + cp `find build/ -name "deck"` ./deck + cat pyproject.toml | grep version -m 1 | awk '{ print "APP_VERSION="substr($3, 2, length($3) -2)}' >> $GITHUB_ENV + - name: Codesign executable + env: + MACOS_DEVELOPER_HASH: ${{ secrets.MACOS_DEVELOPER_HASH }} + MACOS_APP_HASH: ${{ secrets.MACOS_APP_HASH }} + MACOS_CERTIFICATE: ${{ secrets.MACOS_CERTIFICATE }} + MACOS_KEYCHAIN_PASS: ${{ secrets.MACOS_KEYCHAIN_PASS }} + MACOS_CERTIFICATE_PWD: ${{ secrets.MACOS_CERTIFICATE_PWD }} + run: | + echo $MACOS_CERTIFICATE | base64 --decode > certificate.p12 + security create-keychain -p $MACOS_KEYCHAIN_PASS build.keychain + security default-keychain -s build.keychain + security unlock-keychain -p $MACOS_KEYCHAIN_PASS build.keychain + security import certificate.p12 -k build.keychain -P $MACOS_CERTIFICATE_PWD -T /usr/bin/codesign + security set-key-partition-list -S apple-tool:,apple:,codesign: -s -k $MACOS_KEYCHAIN_PASS build.keychain + + echo " + + + + com.apple.security.cs.allow-jit + + com.apple.security.cs.allow-unsigned-executable-memory + + com.apple.security.cs.disable-library-validation + + + " > entitlements.plist + + echo "Now running codesign" + /usr/bin/codesign --deep --force --options=runtime --entitlements ./entitlements.plist --sign $MACOS_APP_HASH --timestamp ./deck + - name: Upload Artifact + uses: actions/upload-artifact@v2 + with: + name: deck-${{ env.APP_VERSION }}-darwin-universal + path: | + deck + LICENSE + README.md + retention-days: 5 + - name: Create release zip + if: ${{ github.event.release && github.event.action == 'published' }} + run: zip deck-${{ env.APP_VERSION }}-darwin-universal.zip "deck" "LICENSE" "README.md" + - name: Attach files to release + uses: softprops/action-gh-release@v1 + if: ${{ github.event.release && github.event.action == 'published' }} + with: + files: deck-${{ env.APP_VERSION }}-darwin-universal.zip