104 lines
4.0 KiB
YAML
104 lines
4.0 KiB
YAML
name: custom release
|
|
|
|
permissions:
|
|
contents: write
|
|
releases: write
|
|
|
|
on:
|
|
push:
|
|
branches:
|
|
- felix/release-automation
|
|
paths:
|
|
- ".gitea/workflows/custom-release.yml"
|
|
- "patches/**"
|
|
- "scripts/update-custom-release.sh"
|
|
workflow_dispatch:
|
|
inputs:
|
|
upstream_tag:
|
|
description: "Optional upstream Syncthing tag, for example v2.1.0"
|
|
required: false
|
|
suffix:
|
|
description: "Optional custom release suffix, for example stignore.6"
|
|
required: false
|
|
schedule:
|
|
- cron: "17 04 * * *"
|
|
|
|
jobs:
|
|
build-custom-release:
|
|
runs-on: ffmini_macos_arm64
|
|
steps:
|
|
- name: Check out repository
|
|
uses: actions/checkout@v4
|
|
with:
|
|
fetch-depth: 0
|
|
|
|
- name: Set up Go
|
|
uses: actions/setup-go@v5
|
|
with:
|
|
go-version-file: go.mod
|
|
cache: false
|
|
|
|
- name: Configure Git author
|
|
run: |
|
|
git config user.name "Gitea Actions"
|
|
git config user.email "actions@git.felixfoertsch.de"
|
|
|
|
- name: Set up tea
|
|
run: |
|
|
go install code.gitea.io/tea@v0.14.1
|
|
echo "$(go env GOPATH)/bin" >> "$GITHUB_PATH"
|
|
"$(go env GOPATH)/bin/tea" logins delete actions >/dev/null 2>&1 || true
|
|
"$(go env GOPATH)/bin/tea" logins add --name actions --url https://git.felixfoertsch.de --token "$GITEA_TOKEN" --no-version-check
|
|
env:
|
|
GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}
|
|
|
|
- name: Import Developer ID certificate
|
|
run: |
|
|
set -euo pipefail
|
|
keychain_path="$RUNNER_TEMP/syncthing-release-signing.keychain-db"
|
|
keychain_password="$(openssl rand -hex 24)"
|
|
certificate_path="$RUNNER_TEMP/developer-id-application.p12"
|
|
|
|
if [ -z "$DEVELOPER_ID_APPLICATION_P12_BASE64" ]; then
|
|
echo "DEVELOPER_ID_APPLICATION_P12_BASE64 secret is required" >&2
|
|
exit 1
|
|
fi
|
|
if [ -z "$DEVELOPER_ID_APPLICATION_P12_PASSWORD" ]; then
|
|
echo "DEVELOPER_ID_APPLICATION_P12_PASSWORD secret is required" >&2
|
|
exit 1
|
|
fi
|
|
|
|
printf '%s' "$DEVELOPER_ID_APPLICATION_P12_BASE64" | base64 -D > "$certificate_path"
|
|
security create-keychain -p "$keychain_password" "$keychain_path"
|
|
security set-keychain-settings -lut 21600 "$keychain_path"
|
|
security unlock-keychain -p "$keychain_password" "$keychain_path"
|
|
security import "$certificate_path" -k "$keychain_path" -P "$DEVELOPER_ID_APPLICATION_P12_PASSWORD" -T /usr/bin/codesign -T /usr/bin/security
|
|
security list-keychains -d user -s "$keychain_path" $(security list-keychains -d user | sed 's/[ "]//g')
|
|
security set-key-partition-list -S apple-tool:,apple:,codesign: -s -k "$keychain_password" "$keychain_path"
|
|
|
|
echo "CUSTOM_RELEASE_KEYCHAIN_PATH=$keychain_path" >> "$GITHUB_ENV"
|
|
env:
|
|
DEVELOPER_ID_APPLICATION_P12_BASE64: ${{ secrets.DEVELOPER_ID_APPLICATION_P12_BASE64 }}
|
|
DEVELOPER_ID_APPLICATION_P12_PASSWORD: ${{ secrets.DEVELOPER_ID_APPLICATION_P12_PASSWORD }}
|
|
|
|
- name: Build patched Syncthing release
|
|
run: ./scripts/update-custom-release.sh
|
|
env:
|
|
CUSTOM_RELEASE_UPSTREAM_TAG: ${{ github.event.inputs.upstream_tag }}
|
|
CUSTOM_RELEASE_SUFFIX: ${{ github.event.inputs.suffix }}
|
|
CUSTOM_RELEASE_PUSH: "1"
|
|
CUSTOM_RELEASE_PUSH_BRANCH: "0"
|
|
CUSTOM_RELEASE_REMOTE: origin
|
|
CUSTOM_RELEASE_BUILDS: "darwin/arm64/zip/1 linux/amd64/tar/0 linux/arm64/tar/0"
|
|
CUSTOM_RELEASE_CODESIGN_IDENTITY: "Developer ID Application: Felix Foertsch (NG5W75WE8U)"
|
|
CUSTOM_RELEASE_CODESIGN_TEAM_ID: "NG5W75WE8U"
|
|
CUSTOM_RELEASE_CREATE_GITEA_RELEASE: "1"
|
|
CUSTOM_RELEASE_TEA_REPO: felixfoertsch/syncthing
|
|
|
|
- name: Delete temporary keychain
|
|
if: always()
|
|
run: |
|
|
if [ -n "${CUSTOM_RELEASE_KEYCHAIN_PATH:-}" ]; then
|
|
security delete-keychain "$CUSTOM_RELEASE_KEYCHAIN_PATH" || true
|
|
fi
|