monal-im · tmolitor-stud-tu · Jan 23, 2025 · Jan 19, 2025 · Jan 19, 2025 · Jan 19, 2025
diff --git a/.github/workflows/beta.build-push.yml b/.github/workflows/beta.build-push.yml
@@ -9,6 +9,8 @@ on:
 
   workflow_dispatch:
 
+permissions: {}
+
 # A workflow run is made up of one or more jobs that can run sequentially or in parallel
 jobs:
   # This workflow contains a single job called "build"
@@ -27,6 +29,9 @@ jobs:
       EXPORT_OPTIONS_CATALYST_APPSTORE: "../scripts/exportOptions/Stable_Catalyst_ExportOptions.plist"
       EXPORT_OPTIONS_CATALYST_APP_EXPORT: "../scripts/exportOptions/Beta_Catalyst_ExportOptions.plist"
       EXPORT_OPTIONS_IOS: "../scripts/exportOptions/Beta_iOS_ExportOptions.plist"
+    permissions:
+      actions: write # needed to upload artifacts
+      contents: write # needed for git push
     # Steps represent a sequence of tasks that will be executed as part of the job
     steps:
       - uses: actions/checkout@v4
@@ -250,6 +255,8 @@ jobs:
       APP_NAME: "Monal"
       APP_DIR: "Monal.app"
       BUILD_TYPE: "Beta"
+    permissions:
+      contents: write # needed for git push in updateLocalization
     # Steps represent a sequence of tasks that will be executed as part of the job
     steps:
       - uses: actions/checkout@v4

diff --git a/.github/workflows/create-stable-pr.yml b/.github/workflows/create-stable-pr.yml
@@ -5,9 +5,13 @@ on:
     branches: [ beta ]
   workflow_dispatch:
 
+permissions: {}
+
 jobs:
   create-pull-request:
     runs-on: ubuntu-latest
+    permissions:
+      pull-requests: write
     steps:
       - name: Checkout Beta Branch
         uses: actions/checkout@v4

diff --git a/.github/workflows/develop-push.yml b/.github/workflows/develop-push.yml
@@ -9,6 +9,8 @@ on:
 
   workflow_dispatch:
 
+permissions: {}
+
 # A workflow run is made up of one or more jobs that can run sequentially or in parallel
 jobs:
   # This workflow contains a single job called "build"
@@ -27,6 +29,8 @@ jobs:
       ALPHA_UPLOAD_SECRET: ${{ secrets.ALPHA_UPLOAD_SECRET }}
       EXPORT_OPTIONS_CATALYST_APP_EXPORT: "../scripts/exportOptions/Alpha_Catalyst_ExportOptions.plist"
       EXPORT_OPTIONS_IOS: "../scripts/exportOptions/Alpha_iOS_ExportOptions.plist"
+    permissions:
+      actions: write # needed to upload artifacts
     # Steps represent a sequence of tasks that will be executed as part of the job
     steps:
       - uses: actions/checkout@v4

diff --git a/.github/workflows/pr-semver-title.yml b/.github/workflows/pr-semver-title.yml
@@ -13,6 +13,8 @@ on:
         required: true
         type: number
 
+permissions: {}
+
 jobs:
   check-pr-semver-title:
     runs-on: ubuntu-latest

diff --git a/.github/workflows/publish-quicksy-release.yml b/.github/workflows/publish-quicksy-release.yml
@@ -2,6 +2,7 @@ name: Publish Quicksy release
 on:
   repository_dispatch:
     types: [quicksy_release]
+permissions: {}
 jobs:
   extractChangelog:
     runs-on: self-hosted

diff --git a/.github/workflows/publish-stable-release.yml b/.github/workflows/publish-stable-release.yml
@@ -2,6 +2,7 @@ name: Publish release
 on:
   repository_dispatch:
     types: [monal_release]
+permissions: {}
 jobs:
   extractChangelog:
     runs-on: self-hosted
@@ -34,6 +35,8 @@ jobs:
     name: Promote draft release to live release
     runs-on: ubuntu-latest
     needs: [extractChangelog]
+    permissions:
+      contents: write
     steps:
       - name: Promote draft release to live release
         run: |

diff --git a/.github/workflows/quicksy.build-push.yml b/.github/workflows/quicksy.build-push.yml
@@ -9,6 +9,8 @@ on:
 
   workflow_dispatch:
 
+permissions: {}
+
 # A workflow run is made up of one or more jobs that can run sequentially or in parallel
 jobs:
   # This workflow contains a single job called "build"
@@ -20,6 +22,9 @@ jobs:
       BUILD_SCHEME: "Quicksy"
       BUILD_TYPE: "AppStore-Quicksy"
       EXPORT_OPTIONS_IOS: "../scripts/exportOptions/Quicksy_Stable_iOS_ExportOptions.plist"
+    permissions:
+      actions: write # needed to upload artifacts
+      contents: write # needed for git push
     # Steps represent a sequence of tasks that will be executed as part of the job
     steps:
       - uses: actions/checkout@v4

diff --git a/.github/workflows/stable.build-push.yml b/.github/workflows/stable.build-push.yml
@@ -9,6 +9,8 @@ on:
 
   workflow_dispatch:
 
+permissions: {}
+
 # A workflow run is made up of one or more jobs that can run sequentially or in parallel
 jobs:
   # This workflow contains a single job called "build"
@@ -23,6 +25,9 @@ jobs:
       EXPORT_OPTIONS_CATALYST_APPSTORE: "../scripts/exportOptions/Stable_Catalyst_ExportOptions.plist"
       EXPORT_OPTIONS_CATALYST_APP_EXPORT: "../scripts/exportOptions/Beta_Catalyst_ExportOptions.plist"
       EXPORT_OPTIONS_IOS: "../scripts/exportOptions/Stable_iOS_ExportOptions.plist"
+    permissions:
+      actions: write # needed to upload artifacts
+      contents: write # needed for git push
     # Steps represent a sequence of tasks that will be executed as part of the job
     steps:
       - uses: actions/checkout@v4

diff --git a/.github/workflows/update-translations.yml b/.github/workflows/update-translations.yml
@@ -5,6 +5,8 @@ name: update-translations
 on:
   workflow_dispatch:
 
+permissions: {}
+
 # A workflow run is made up of one or more jobs that can run sequentially or in parallel
 jobs:
   # This workflow contains a single job called "build"
@@ -18,6 +20,8 @@ jobs:
       EXPORT_OPTIONS_CATALYST_APPSTORE: "../scripts/exportOptions/Stable_Catalyst_ExportOptions.plist"
       EXPORT_OPTIONS_CATALYST_APP_EXPORT: "../scripts/exportOptions/Beta_Catalyst_ExportOptions.plist"
       EXPORT_OPTIONS_IOS: "../scripts/exportOptions/Beta_iOS_ExportOptions.plist"
+    permissions:
+      contents: write # needed for git push in updateLocalization
     # Steps represent a sequence of tasks that will be executed as part of the job
     steps:
       - uses: actions/checkout@v4

diff --git a/scripts/build.sh b/scripts/build.sh
@@ -4,12 +4,13 @@ function exportMacOS {
     local EXPORT_OPTIONS_CATALYST="$1"
     local BUILD_TYPE="$2"
 
-    xcodebuild -exportArchive \
+    NSUnbufferedIO=YES xcodebuild -exportArchive \
         -archivePath "build/macos_$APP_NAME.xcarchive" \
         -exportPath "build/app" \
         -exportOptionsPlist "$EXPORT_OPTIONS_CATALYST" \
         -allowProvisioningUpdates \
-        -configuration $BUILD_TYPE
+        -configuration $BUILD_TYPE \
+        2>&1 | xcbeautify
 
     echo "build dir:"
     ls -l "build"
@@ -18,6 +19,9 @@ function exportMacOS {
 # Abort on Error
 set -e
 
+# Needed for xcbeautify
+set -o pipefail
+
 cd Monal
 
 security unlock-keychain -p $(cat /Users/ci/keychain.txt) login.keychain
@@ -47,7 +51,7 @@ if [ "$BUILD_SCHEME" != "Quicksy" ]; then
     echo "***************************"
     echo "*     Archiving macOS     *"
     echo "***************************"
-    xcrun xcodebuild \
+    NSUnbufferedIO=YES xcrun xcodebuild \
         -workspace "Monal.xcworkspace" \
         -scheme "$BUILD_SCHEME" \
         -sdk macosx \
@@ -57,7 +61,8 @@ if [ "$BUILD_SCHEME" != "Quicksy" ]; then
         -allowProvisioningUpdates \
         archive \
         BUILD_LIBRARIES_FOR_DISTRIBUTION=YES \
-        SUPPORTS_MACCATALYST=YES
+        SUPPORTS_MACCATALYST=YES \
+        2>&1 | xcbeautify
 
     echo ""
     echo "****************************"
@@ -97,29 +102,31 @@ echo ""
 echo "*************************"
 echo "*     Archiving iOS     *"
 echo "*************************"
-xcrun xcodebuild \
+NSUnbufferedIO=YES xcrun xcodebuild \
     -workspace "Monal.xcworkspace" \
     -scheme "$BUILD_SCHEME" \
     -sdk iphoneos \
     -configuration $BUILD_TYPE \
     -archivePath "build/ios_$APP_NAME.xcarchive" \
     -allowProvisioningUpdates \
-    archive
+    archive \
+    2>&1 | xcbeautify
 
 echo ""
 echo "*************************"
 echo "*     Exporting iOS     *"
 echo "*************************"
 # see: https://gist.github.com/cocoaNib/502900f24846eb17bb29
 # and: https://forums.developer.apple.com/thread/100065
-xcodebuild \
+NSUnbufferedIO=YES xcodebuild \
     -exportArchive \
     -archivePath "build/ios_$APP_NAME.xcarchive" \
     -exportPath "build/ipa" \
     -exportOptionsPlist $EXPORT_OPTIONS_IOS \
     -configuration $BUILD_TYPE \
     -allowProvisioningUpdates \
-    -allowProvisioningDeviceRegistration
+    -allowProvisioningDeviceRegistration \
+    2>&1 | xcbeautify
 
 echo "build dir:"
 find build
diff --git a/scripts/updateLocalization.sh b/scripts/updateLocalization.sh
@@ -2,6 +2,9 @@
 
 set -e
 
+# Needed for xcbeautify
+set -o pipefail
+
 cd "$(dirname "$0")"
 cd ../Monal
 
@@ -116,7 +119,7 @@ dummy="DON'T TRANSLATE: $(head /dev/urandom | LC_ALL=C tr -dc A-Za-z0-9 | head -
 x=$((1))
 while [[ $x -lt 16 ]]; do
     echo "STARTING RUN $x..."
-    while ! xcrun xcodebuild -workspace "Monal.xcworkspace" -scheme "Monal" -sdk iphoneos -configuration "Beta" -allowProvisioningUpdates -exportLocalizations -localizationPath localization.tmp -exportLanguage base SWIFT_EMIT_LOC_STRINGS="$compile_swift"; do
+    while ! NSUnbufferedIO=YES xcrun xcodebuild -workspace "Monal.xcworkspace" -scheme "Monal" -sdk iphoneos -configuration "Beta" -allowProvisioningUpdates -exportLocalizations -localizationPath localization.tmp -exportLanguage base SWIFT_EMIT_LOC_STRINGS="$compile_swift" 2>&1 | xcbeautify; do
         echo "ERROR, TRYING AGAIN..."
     done
     echo "RUN $x SUCCEEDED, EXTRACTING STRINGS FROM XLIFF!"