1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
name: Release
# Builds prebuilt binaries for every tagged version and attaches them to the
# GitHub Release, so users without a Rust toolchain can install in one step.
on:
push:
tags:
permissions:
contents: write
jobs:
build:
name: ${{ matrix.target }}
runs-on: ${{ matrix.os }}
strategy:
fail-fast: false
matrix:
include:
- os: ubuntu-latest
target: x86_64-unknown-linux-gnu
# Both macOS targets build on the Apple Silicon runner: the macOS SDK
# is universal, so it cross-compiles x86_64 reliably. The dedicated
# Intel runner (macos-13) is being deprecated and queues for hours.
- os: macos-14
target: aarch64-apple-darwin
- os: macos-14
target: x86_64-apple-darwin
- os: windows-latest
target: x86_64-pc-windows-msvc
steps:
- uses: actions/checkout@v7
- uses: dtolnay/rust-toolchain@stable
with:
targets: ${{ matrix.target }}
- uses: Swatinem/rust-cache@v2
with:
key: ${{ matrix.target }}
- name: Build
run: cargo build --release --target ${{ matrix.target }} --bin sessionwiki
# macOS ties a folder-access grant (Documents, Desktop, ...) to the
# binary's path plus its code requirement. An ad-hoc signature's
# requirement is its cdhash, so every release looked like a new program
# and asked again. One stable identity keeps the requirement the same
# across releases. rcodesign signs with a PEM key; no keychain or trust
# setup. An unsigned release would reset every user's grants, so a
# missing key fails the build instead of shipping ad-hoc.
- name: Sign (macOS)
if: runner.os == 'macOS'
shell: bash
env:
SIGNING_KEY_PEM: ${{ secrets.MACOS_SIGNING_KEY_PEM }}
SIGNING_CERT_PEM: ${{ secrets.MACOS_SIGNING_CERT_PEM }}
run: |
set -euo pipefail
if [ -z "$SIGNING_KEY_PEM" ] || [ -z "$SIGNING_CERT_PEM" ]; then
echo "::error::MACOS_SIGNING_KEY_PEM / MACOS_SIGNING_CERT_PEM are not set"
exit 1
fi
v=0.29.0
a=apple-codesign-$v-macos-universal
curl -fsSL -o "$a.tar.gz" "https://github.com/indygreg/apple-platform-rs/releases/download/apple-codesign%2F$v/$a.tar.gz"
echo "d98372d5524226ccf9dc0eda03d4e4f5826182dabb2fc3f2bd303ed9113a748d $a.tar.gz" | shasum -a 256 -c -
tar xzf "$a.tar.gz"
umask 077
printf '%s\n' "$SIGNING_KEY_PEM" > "$RUNNER_TEMP/key.pem"
printf '%s\n' "$SIGNING_CERT_PEM" > "$RUNNER_TEMP/cert.pem"
bin=target/${{ matrix.target }}/release/sessionwiki
"./$a/rcodesign" sign --pem-source "$RUNNER_TEMP/key.pem" --pem-source "$RUNNER_TEMP/cert.pem" \
--binary-identifier com.youdie006.sessionwiki "$bin"
rm -f "$RUNNER_TEMP/key.pem" "$RUNNER_TEMP/cert.pem"
codesign --verify "$bin"
req=$(codesign -d -r- "$bin" 2>&1)
echo "$req"
echo "$req" | grep -q 'identifier "com.youdie006.sessionwiki" and certificate root'
- name: Package (unix)
if: runner.os != 'Windows'
shell: bash
run: |
bin=target/${{ matrix.target }}/release/sessionwiki
dist=sessionwiki-${{ github.ref_name }}-${{ matrix.target }}
mkdir "$dist"
cp "$bin" "$dist/"
cp README.md LICENSE "$dist/"
tar czf "$dist.tar.gz" "$dist"
shasum -a 256 "$dist.tar.gz" > "$dist.tar.gz.sha256"
- name: Package (windows)
if: runner.os == 'Windows'
shell: bash
run: |
bin=target/${{ matrix.target }}/release/sessionwiki.exe
dist=sessionwiki-${{ github.ref_name }}-${{ matrix.target }}
mkdir "$dist"
cp "$bin" "$dist/"
cp README.md LICENSE "$dist/"
7z a "$dist.zip" "$dist" >/dev/null
certutil -hashfile "$dist.zip" SHA256 | sed -n 2p > "$dist.zip.sha256"
- name: Build the release notes
shell: bash
run: |
# The release was published with an EMPTY body while CHANGELOG.md
# carried the notes, so every version looked the same on GitHub: a
# version number and nothing else. Every matrix leg writes the same
# file, so whichever uploads first sets the same body.
TAG="${{ github.ref_name }}"
sh scripts/release-notes.sh "$TAG" > RELEASE_NOTES.md
if [ ! -s RELEASE_NOTES.md ]; then
echo "CHANGELOG.md has no section for $TAG" >&2
exit 1
fi
- name: Upload to release
uses: softprops/action-gh-release@v3
with:
body_path: RELEASE_NOTES.md
files: |
sessionwiki-*.tar.gz
sessionwiki-*.tar.gz.sha256
sessionwiki-*.zip
sessionwiki-*.zip.sha256
fail_on_unmatched_files: false