dist-build-mac.yaml

# This workflow will build a PyOxidizer binary for Mac OS when a tag is pushed

name: Build OSX binary

env:
  PYOXIDIZER_DOWNLOAD: https://github.com/indygreg/PyOxidizer/releases/download/pyoxidizer%2F0.18.0/pyoxidizer-0.18.0-macos-universal.zip

on:
  workflow_dispatch: {}
  push:
    tags:
      - '*'
  release:
    types: [published]

jobs:
  build:
    runs-on: macos-12
    steps:
    - uses: actions/checkout@v3
    - name: Set up Python
      uses: actions/setup-python@v4
      with:
        python-version: '3.9'
    - name: Setup XCode
      uses: maxim-lobanov/setup-xcode@v1
      with:
        xcode-version: latest-stable
    - name: Setup PyOxidizer and build
      working-directory: json/
      run: |
        wget ${PYOXIDIZER_DOWNLOAD}
        unzip pyoxidizer-0.18.0-macos-universal.zip
        sudo chmod +x ./macos-universal/pyoxidizer
        ./macos-universal/pyoxidizer build exe --release
        cp `find build/ -name "gefyra-json"` ../gefyra-json
        cat pyproject.toml | grep version -m 1 | awk '{ print "APP_VERSION="substr($3, 2, length($3) -2)}' >> $GITHUB_ENV
    - name: Codesign app bundle
      # Extract the secrets we defined earlier as environment variables
      env: 
        MACOS_CERTIFICATE: ${{ secrets.PROD_MACOS_CERTIFICATE }}
        MACOS_CERTIFICATE_PWD: ${{ secrets.PROD_MACOS_CERTIFICATE_PWD }}
        MACOS_CERTIFICATE_NAME: ${{ secrets.PROD_MACOS_CERTIFICATE_NAME }}
        MACOS_CI_KEYCHAIN_PWD: ${{ secrets.PROD_MACOS_CI_KEYCHAIN_PWD }}
      run: |
        # Turn our base64-encoded certificate back to a regular .p12 file
        
        echo $MACOS_CERTIFICATE | base64 --decode > certificate.p12

        # We need to create a new keychain, otherwise using the certificate will prompt
        # with a UI dialog asking for the certificate password, which we can't
        # use in a headless CI environment
        
        security create-keychain -p "$MACOS_CI_KEYCHAIN_PWD" build.keychain 
        security default-keychain -s build.keychain
        security unlock-keychain -p "$MACOS_CI_KEYCHAIN_PWD" build.keychain
        security import certificate.p12 -k build.keychain -P "$MACOS_CERTIFICATE_PWD" -T /usr/bin/codesign
        security set-key-partition-list -S apple-tool:,apple:,codesign: -s -k "$MACOS_CI_KEYCHAIN_PWD" build.keychain

        # We finally codesign our app bundle, specifying the Hardened runtime option
        
        /usr/bin/codesign --force -s "$MACOS_CERTIFICATE_NAME" --options runtime ./gefyra-json -v
    - name: Upload Artifact
      uses: actions/upload-artifact@v3
      with:
        name: gefyra-${{ env.APP_VERSION }}-darwin-universal
        path: |
          gefyra-json
          LICENSE
          README.md
        retention-days: 5
    - name: Sanity check
      run: |
        brew install docker
        colima start
        ./gefyra-json '{"action": "help"}'
    - name: Create release zip
      if: ${{ github.event.release && github.event.action == 'published' }}
      run: zip gefyra-${{ env.APP_VERSION }}-darwin-universal.zip "gefyra-json" "LICENSE" "README.md"
    - name: Attach files to release
      uses: softprops/action-gh-release@v1
      if: ${{ github.event.release && github.event.action == 'published' }}
      with:
        files: gefyra-${{ env.APP_VERSION }}-darwin-universal.zip