hammer-editor/.github/workflows/publish-mac-app-store.yml
renovate[bot] 72f47d6df7
Update actions/checkout action to v7 (#634)
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2026-06-22 14:15:41 -07:00

101 lines
4.3 KiB
YAML

name: Publish — Mac App Store
on:
workflow_dispatch:
workflow_call:
jobs:
publish-mac-app-store:
runs-on: macos-latest
steps:
- name: Checkout code
uses: actions/checkout@v7
- name: set up JDK 21
uses: actions/setup-java@v5
with:
java-version: '21'
distribution: 'temurin'
cache: gradle
- uses: ruby/setup-ruby@6aaa311d81eba98ae12eaffbcb63296ace0efcde # v1.307.0
with:
ruby-version: '3.4.8'
bundler-cache: true
- name: Grant Permission to Execute
run: chmod +x gradlew desktop/scripts/build-appstore.sh
- name: Install bundle
run: |
bundle config path vendor/bundle
bundle install --jobs 4 --retry 3
- name: Set up signing keychain
env:
CERT_P12_BASE64: ${{ secrets.MAC_DISTRIBUTION_CERT_P12_BASE64 }}
INSTALLER_P12_BASE64: ${{ secrets.MAC_INSTALLER_CERT_P12_BASE64 }}
CERT_PASSWORD: ${{ secrets.MAC_DISTRIBUTION_CERT_PASSWORD }}
run: |
KEYCHAIN_PATH="$RUNNER_TEMP/app-signing.keychain-db"
KEYCHAIN_PASSWORD="$(uuidgen)"
echo "KEYCHAIN_PATH=$KEYCHAIN_PATH" >> $GITHUB_ENV
echo "KEYCHAIN_PASSWORD=$KEYCHAIN_PASSWORD" >> $GITHUB_ENV
security create-keychain -p "$KEYCHAIN_PASSWORD" "$KEYCHAIN_PATH"
security set-keychain-settings -lut 21600 "$KEYCHAIN_PATH"
security unlock-keychain -p "$KEYCHAIN_PASSWORD" "$KEYCHAIN_PATH"
# The leaf signing certs chain through Apple's WWDR intermediate. Without
# it in the keychain, `find-identity -v` (valid-only) silently hides them.
curl -fsSL https://www.apple.com/certificateauthority/AppleWWDRCAG3.cer \
-o "$RUNNER_TEMP/AppleWWDRCAG3.cer"
security import "$RUNNER_TEMP/AppleWWDRCAG3.cer" -k "$KEYCHAIN_PATH"
# Two separate single-identity .p12 files: macOS `security import`
# only ingests one identity from a combined multi-key .p12, so the
# Application and Installer certs are imported from their own files.
echo -n "$CERT_P12_BASE64" | base64 --decode -o "$RUNNER_TEMP/cert.p12"
security import "$RUNNER_TEMP/cert.p12" -P "$CERT_PASSWORD" -A -t cert -f pkcs12 -k "$KEYCHAIN_PATH"
echo -n "$INSTALLER_P12_BASE64" | base64 --decode -o "$RUNNER_TEMP/installer.p12"
security import "$RUNNER_TEMP/installer.p12" -P "$CERT_PASSWORD" -A -t cert -f pkcs12 -k "$KEYCHAIN_PATH"
security set-key-partition-list -S apple-tool:,apple: -k "$KEYCHAIN_PASSWORD" "$KEYCHAIN_PATH"
security list-keychain -d user -s "$KEYCHAIN_PATH" $(security list-keychains -d user | tr -d '"' | xargs)
- name: Place provisioning profiles
env:
EMBEDDED_PROFILE_B64: ${{ secrets.MAC_EMBEDDED_PROVISIONING_PROFILE_BASE64 }}
RUNTIME_PROFILE_B64: ${{ secrets.MAC_RUNTIME_PROVISIONING_PROFILE_BASE64 }}
run: |
echo -n "$EMBEDDED_PROFILE_B64" | base64 --decode -o desktop/embedded.provisionprofile
echo -n "$RUNTIME_PROFILE_B64" | base64 --decode -o desktop/runtime.provisionprofile
- name: Place App Store Connect API key
env:
API_KEY_P8: ${{ secrets.MAC_APP_STORE_CONNECT_API_KEY_P8 }}
run: |
mkdir -p desktop/secrets
printf '%s' "$API_KEY_P8" > desktop/secrets/AuthKey_F8BSZ7LC8Q.p8
- name: Publish to App Store 🍎
# Builds, uploads, waits for processing, submits for review, and
# auto-releases on approval. Waiting for build processing can hold the
# runner for several minutes before the submit step.
run: bundle exec fastlane mac desktop_release
- name: Upload Gradle problems report on failure
if: failure()
uses: actions/upload-artifact@v7
with:
name: gradle-problems-report-macos
path: build/reports/problems/problems-report.html
if-no-files-found: ignore
- name: Clean up signing material
if: always()
run: |
if [ -n "${KEYCHAIN_PATH:-}" ] && [ -f "$KEYCHAIN_PATH" ]; then
security delete-keychain "$KEYCHAIN_PATH" || true
fi
rm -f desktop/embedded.provisionprofile desktop/runtime.provisionprofile
rm -rf desktop/secrets