mirror of
https://github.com/pepaskopec-blip/Graduately.git
synced 2026-10-27 15:14:35 +00:00
58e3a75f21
The GTK Mac build stays; CI now also publishes maturita-macos-swift. Co-authored-by: Cursor <cursoragent@cursor.com>
364 lines
12 KiB
YAML
364 lines
12 KiB
YAML
name: Build
|
|
|
|
# Packages are published to the `builds` branch instead of to a GitHub
|
|
# Release, so everything the installers and the in-app updater fetch comes
|
|
# straight from the repository and always matches what is on main.
|
|
on:
|
|
push:
|
|
branches:
|
|
- main
|
|
# Nothing to rebuild when only documentation changed.
|
|
paths-ignore:
|
|
- "README.md"
|
|
- "LICENSE"
|
|
- ".gitignore"
|
|
workflow_dispatch:
|
|
|
|
permissions:
|
|
contents: write
|
|
|
|
jobs:
|
|
linux:
|
|
name: Linux AppImage
|
|
runs-on: ubuntu-22.04
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
|
|
- name: Install dependencies
|
|
run: |
|
|
sudo apt-get update
|
|
sudo apt-get install -y \
|
|
build-essential pkg-config curl \
|
|
libgtk-4-dev librsvg2-dev \
|
|
desktop-file-utils \
|
|
appstream
|
|
|
|
- name: Build AppImage
|
|
env:
|
|
COMMIT: ${{ github.sha }}
|
|
run: |
|
|
chmod +x scripts/bundle-linux.sh
|
|
./scripts/bundle-linux.sh
|
|
|
|
- name: Upload artifact
|
|
uses: actions/upload-artifact@v4
|
|
with:
|
|
name: maturita-linux
|
|
path: dist/maturita-linux-*.AppImage
|
|
|
|
windows:
|
|
name: Windows zip
|
|
runs-on: windows-latest
|
|
defaults:
|
|
run:
|
|
shell: msys2 {0}
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
|
|
- uses: msys2/setup-msys2@v2
|
|
with:
|
|
msystem: UCRT64
|
|
update: true
|
|
install: >-
|
|
make
|
|
zip
|
|
mingw-w64-ucrt-x86_64-gcc
|
|
mingw-w64-ucrt-x86_64-gtk4
|
|
mingw-w64-ucrt-x86_64-pkg-config
|
|
mingw-w64-ucrt-x86_64-make
|
|
|
|
- name: Build and bundle
|
|
env:
|
|
COMMIT: ${{ github.sha }}
|
|
run: |
|
|
make bundle
|
|
cd dist
|
|
zip -qry ../maturita-windows-x64.zip .
|
|
cd ..
|
|
mkdir -p dist-out
|
|
mv maturita-windows-x64.zip dist-out/
|
|
|
|
- name: Upload artifact
|
|
uses: actions/upload-artifact@v4
|
|
with:
|
|
name: maturita-windows
|
|
path: dist-out/maturita-windows-x64.zip
|
|
|
|
macos:
|
|
name: macOS app
|
|
runs-on: macos-14
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
|
|
- name: Install dependencies
|
|
run: |
|
|
brew install gtk4 pkg-config
|
|
|
|
# Developer ID lives in repo secrets. Without it the bundle is only
|
|
# ad-hoc signed and Gatekeeper still blocks downloaded copies.
|
|
# Do not use `secrets` in `if:` — GitHub rejects the whole workflow.
|
|
- name: Import Developer ID certificate
|
|
env:
|
|
MACOS_CERTIFICATE: ${{ secrets.MACOS_CERTIFICATE }}
|
|
MACOS_CERTIFICATE_PASSWORD: ${{ secrets.MACOS_CERTIFICATE_PASSWORD }}
|
|
run: |
|
|
set -euo pipefail
|
|
if [ -z "${MACOS_CERTIFICATE:-}" ]; then
|
|
echo "No Developer ID certificate; the bundle will be ad-hoc signed."
|
|
exit 0
|
|
fi
|
|
cert="$RUNNER_TEMP/certificate.p12"
|
|
keychain="$RUNNER_TEMP/signing.keychain-db"
|
|
pass="$(openssl rand -base64 32)"
|
|
echo "$MACOS_CERTIFICATE" | base64 --decode > "$cert"
|
|
security create-keychain -p "$pass" "$keychain"
|
|
security set-keychain-settings -lut 21600 "$keychain"
|
|
security unlock-keychain -p "$pass" "$keychain"
|
|
security import "$cert" -k "$keychain" \
|
|
-P "$MACOS_CERTIFICATE_PASSWORD" \
|
|
-T /usr/bin/codesign -T /usr/bin/security
|
|
security set-key-partition-list -S apple-tool:,apple: -s \
|
|
-k "$pass" "$keychain"
|
|
security list-keychains -d user -s "$keychain" \
|
|
$(security list-keychains -d user | tr -d '"')
|
|
rm -f "$cert"
|
|
|
|
- name: Build .app zip
|
|
env:
|
|
COMMIT: ${{ github.sha }}
|
|
MACOS_SIGN_IDENTITY: ${{ secrets.MACOS_SIGN_IDENTITY }}
|
|
APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
|
|
APPLE_ID: ${{ secrets.APPLE_ID }}
|
|
APPLE_APP_SPECIFIC_PASSWORD: ${{ secrets.APPLE_APP_SPECIFIC_PASSWORD }}
|
|
APPLE_API_KEY: ${{ secrets.APPLE_API_KEY }}
|
|
APPLE_API_KEY_ID: ${{ secrets.APPLE_API_KEY_ID }}
|
|
APPLE_API_ISSUER: ${{ secrets.APPLE_API_ISSUER }}
|
|
run: |
|
|
chmod +x scripts/bundle-macos.sh
|
|
./scripts/bundle-macos.sh
|
|
|
|
- name: Upload artifact
|
|
uses: actions/upload-artifact@v4
|
|
with:
|
|
name: maturita-macos
|
|
path: dist/maturita-macos-*.zip
|
|
|
|
android:
|
|
name: Android APK
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
|
|
- uses: actions/setup-java@v4
|
|
with:
|
|
distribution: temurin
|
|
java-version: 17
|
|
|
|
# v3 defaults to the retired `tools` package, which sdkmanager no longer
|
|
# serves. Request only packages that still exist.
|
|
- uses: android-actions/setup-android@v3
|
|
with:
|
|
packages: platform-tools
|
|
|
|
- name: Install Android SDK platform
|
|
run: |
|
|
set -euo pipefail
|
|
sdkmanager --install "build-tools;36.0.0"
|
|
if ! sdkmanager --install "platforms;android-37.0"; then
|
|
sdkmanager --install "platforms;android-37"
|
|
fi
|
|
if [ -d "$ANDROID_HOME/platforms/android-37.0" ] && [ ! -e "$ANDROID_HOME/platforms/android-37" ]; then
|
|
ln -sfn android-37.0 "$ANDROID_HOME/platforms/android-37"
|
|
fi
|
|
ls "$ANDROID_HOME/platforms"
|
|
|
|
- uses: gradle/actions/setup-gradle@v4
|
|
with:
|
|
build-root-directory: android
|
|
|
|
- name: Extract content and build APK
|
|
env:
|
|
COMMIT: ${{ github.sha }}
|
|
run: |
|
|
python3 scripts/extract-android-content.py
|
|
chmod +x android/gradlew
|
|
cd android
|
|
./gradlew :app:assembleRelease --no-daemon
|
|
mkdir -p ../dist-android
|
|
cp app/build/outputs/apk/release/app-release.apk \
|
|
../dist-android/maturita-android.apk
|
|
|
|
- name: Upload artifact
|
|
uses: actions/upload-artifact@v4
|
|
with:
|
|
name: maturita-android
|
|
path: dist-android/maturita-android.apk
|
|
|
|
ios:
|
|
name: iOS IPA
|
|
# The app targets iOS 26; this image ships Xcode 26 as the default.
|
|
runs-on: macos-26
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
|
|
- name: Extract content and build IPA
|
|
env:
|
|
COMMIT: ${{ github.sha }}
|
|
DEVELOPER_DIR: /Applications/Xcode.app/Contents/Developer
|
|
run: |
|
|
chmod +x scripts/bundle-ios.sh
|
|
./scripts/bundle-ios.sh
|
|
|
|
- name: Upload artifact
|
|
uses: actions/upload-artifact@v4
|
|
with:
|
|
name: maturita-ios
|
|
path: dist-ios/maturita-ios.ipa
|
|
|
|
macos-swift:
|
|
name: macOS Swift app
|
|
runs-on: macos-26
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
|
|
- name: Import Developer ID certificate
|
|
env:
|
|
MACOS_CERTIFICATE: ${{ secrets.MACOS_CERTIFICATE }}
|
|
MACOS_CERTIFICATE_PASSWORD: ${{ secrets.MACOS_CERTIFICATE_PASSWORD }}
|
|
run: |
|
|
set -euo pipefail
|
|
if [ -z "${MACOS_CERTIFICATE:-}" ]; then
|
|
echo "No Developer ID certificate; the bundle will be ad-hoc signed."
|
|
exit 0
|
|
fi
|
|
cert="$RUNNER_TEMP/certificate.p12"
|
|
keychain="$RUNNER_TEMP/signing.keychain-db"
|
|
pass="$(openssl rand -base64 32)"
|
|
echo "$MACOS_CERTIFICATE" | base64 --decode > "$cert"
|
|
security create-keychain -p "$pass" "$keychain"
|
|
security set-keychain-settings -lut 21600 "$keychain"
|
|
security unlock-keychain -p "$pass" "$keychain"
|
|
security import "$cert" -k "$keychain" \
|
|
-P "$MACOS_CERTIFICATE_PASSWORD" \
|
|
-T /usr/bin/codesign -T /usr/bin/security
|
|
security set-key-partition-list -S apple-tool:,apple: -s \
|
|
-k "$pass" "$keychain"
|
|
security list-keychains -d user -s "$keychain" \
|
|
$(security list-keychains -d user | tr -d '"')
|
|
rm -f "$cert"
|
|
|
|
- name: Build Swift .app zip
|
|
env:
|
|
COMMIT: ${{ github.sha }}
|
|
DEVELOPER_DIR: /Applications/Xcode.app/Contents/Developer
|
|
MACOS_SIGN_IDENTITY: ${{ secrets.MACOS_SIGN_IDENTITY }}
|
|
APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
|
|
APPLE_ID: ${{ secrets.APPLE_ID }}
|
|
APPLE_APP_SPECIFIC_PASSWORD: ${{ secrets.APPLE_APP_SPECIFIC_PASSWORD }}
|
|
APPLE_API_KEY: ${{ secrets.APPLE_API_KEY }}
|
|
APPLE_API_KEY_ID: ${{ secrets.APPLE_API_KEY_ID }}
|
|
APPLE_API_ISSUER: ${{ secrets.APPLE_API_ISSUER }}
|
|
run: |
|
|
chmod +x scripts/bundle-macos-swift.sh
|
|
./scripts/bundle-macos-swift.sh
|
|
|
|
- name: Upload artifact
|
|
uses: actions/upload-artifact@v4
|
|
with:
|
|
name: maturita-macos-swift
|
|
path: dist/maturita-macos-swift-*.zip
|
|
|
|
publish:
|
|
name: Publish to builds branch
|
|
needs: [linux, windows, macos, android, ios, macos-swift]
|
|
# One broken platform must not freeze the others: publish whatever was
|
|
# built and keep the previous package for anything that failed.
|
|
if: ${{ !cancelled() && contains(needs.*.result, 'success') }}
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
|
|
- name: Start from the previous builds branch
|
|
run: |
|
|
mkdir -p staged
|
|
if git fetch --depth 1 origin builds 2>/dev/null; then
|
|
git archive FETCH_HEAD | tar -x -C staged
|
|
rm -f staged/VERSION
|
|
fi
|
|
|
|
- name: Download artifacts
|
|
uses: actions/download-artifact@v4
|
|
with:
|
|
path: fresh
|
|
merge-multiple: true
|
|
|
|
- name: Collect installers
|
|
run: |
|
|
set -euo pipefail
|
|
cp -f fresh/* staged/ 2>/dev/null || true
|
|
chmod +x installers/pack-installer-zips.sh
|
|
./installers/pack-installer-zips.sh
|
|
cp installers/maturita-installer-linux.sh staged/
|
|
cp installers/maturita-installer-windows.cmd staged/
|
|
cp installers/maturita-installer-*.zip staged/
|
|
# The updaters download this to see whether they are behind.
|
|
echo "${{ github.sha }}" > staged/VERSION
|
|
# Per-platform markers name the commit whose package is really
|
|
# here, so a platform that failed this run is not offered as new.
|
|
[ -f fresh/maturita-android.apk ] && echo "${{ github.sha }}" > staged/VERSION-android
|
|
[ -f fresh/maturita-ios.ipa ] && echo "${{ github.sha }}" > staged/VERSION-ios
|
|
ls fresh/maturita-macos-swift-*.zip >/dev/null 2>&1 && echo "${{ github.sha }}" > staged/VERSION-macos-swift
|
|
ls fresh staged
|
|
|
|
# The branch is rewritten from scratch every time rather than added to,
|
|
# so the repository keeps one copy of the packages instead of a new
|
|
# ~70 MB set per commit. The same commit is then mirrored to Forgejo
|
|
# when FORGEJO_TOKEN is set (git.dvorakmortonxd.dev).
|
|
- name: Push to builds branch
|
|
env:
|
|
FORGEJO_TOKEN: ${{ secrets.FORGEJO_TOKEN }}
|
|
FORGEJO_USER: ${{ secrets.FORGEJO_USER }}
|
|
run: |
|
|
git config user.name "github-actions[bot]"
|
|
git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
|
|
rm -rf .git/index.lock
|
|
git checkout --orphan builds
|
|
git rm -rf --cached . >/dev/null
|
|
find . -maxdepth 1 ! -name . ! -name .git ! -name staged \
|
|
-exec rm -rf {} +
|
|
mv staged/* .
|
|
rmdir staged
|
|
ls -la
|
|
git add -A
|
|
git commit -q -m "Build from ${{ github.sha }}"
|
|
git push -f origin builds
|
|
if [ -z "${FORGEJO_TOKEN:-}" ]; then
|
|
echo "No FORGEJO_TOKEN; skipping Forgejo builds publish."
|
|
exit 0
|
|
fi
|
|
user="${FORGEJO_USER:-oauth2}"
|
|
git push -f \
|
|
"https://${user}:${FORGEJO_TOKEN}@git.dvorakmortonxd.dev/edu/maturita.c.git" \
|
|
HEAD:refs/heads/builds
|
|
|
|
forgejo-main:
|
|
name: Mirror main to Forgejo
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
|
|
# Same rule as the macOS cert step: never put `secrets` in `if:`.
|
|
- name: Push main
|
|
env:
|
|
FORGEJO_TOKEN: ${{ secrets.FORGEJO_TOKEN }}
|
|
FORGEJO_USER: ${{ secrets.FORGEJO_USER }}
|
|
run: |
|
|
set -euo pipefail
|
|
if [ -z "${FORGEJO_TOKEN:-}" ]; then
|
|
echo "No FORGEJO_TOKEN; skipping Forgejo main mirror."
|
|
exit 0
|
|
fi
|
|
user="${FORGEJO_USER:-oauth2}"
|
|
git push \
|
|
"https://${user}:${FORGEJO_TOKEN}@git.dvorakmortonxd.dev/edu/maturita.c.git" \
|
|
HEAD:refs/heads/main
|