Build and Package Dev #6
Workflow file for this run
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
name: Build and Package Dev | |
on: | |
workflow_dispatch: # manually triggered | |
inputs: | |
platform: | |
description: 'OS/Arch' | |
required: true | |
default: 'windows' | |
type: choice | |
options: | |
- 'windows' | |
- 'linux' | |
- 'macos' | |
permissions: | |
contents: write | |
defaults: | |
run: | |
shell: bash | |
env: | |
RELEASE: ${{ github.run_number }} | |
CGO_ENABLED: 0 | |
jobs: | |
build_windows: | |
if: inputs.platform == 'windows' | |
name: "Build Windows" | |
runs-on: windows-latest | |
steps: | |
- name: Checkout code | |
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 | |
- name: Set up Go | |
uses: WillAbides/setup-go-faster@a0ff5217a7d2567ed6ff1aa2b7d8f9d58173b2c9 # v1.14.0 | |
with: | |
go-version-file: 'go.mod' | |
- name: Read version | |
run: | | |
echo "VERSION=$(cat VERSION)" >> $GITHUB_ENV | |
- name: Copy syso files | |
run: | | |
cp -r ci/pkg/windows/syso/* . | |
- name: Build AMD64 | |
run: >- | |
env | |
GOARCH=amd64 | |
GOOS=windows | |
go build -a -v -trimpath -mod=readonly -modcacherw | |
-ldflags="-H=windowsgui -s -w -X main.version=${VERSION}" | |
-o bin/pinnacle-windows-amd64.exe | |
. | |
- name: Build ARM64 | |
run: >- | |
env | |
GOARCH=arm64 | |
GOOS=windows | |
go build -a -v -trimpath -mod=readonly -modcacherw | |
-ldflags="-H=windowsgui -s -w -X main.version=${VERSION}" | |
-o bin/pinnacle-windows-arm64.exe | |
. | |
- name: Authenticate with Google Cloud | |
uses: google-github-actions/auth@6fc4af4b145ae7821d527454aa9bd537d1f2dc5f # v2.1.7 | |
with: | |
credentials_json: ${{ secrets.GCP_CREDENTIALS }} | |
- name: Set up Google Cloud SDK | |
uses: google-github-actions/setup-gcloud@6189d56e4096ee891640bb02ac264be376592d6a # v2.1.2 | |
- name: Download jsign | |
run: ./ci/scripts/download-jsign.sh | |
- name: Decode certificate | |
run: | | |
echo "${{ secrets.CERTFILE_BASE64 }}" | base64 --decode > pinnacle-certificate.pem | |
- name: Sign AMD64 | |
env: | |
GCP_KEYSTORE: ${{ secrets.GCP_KEYSTORE }} | |
GCP_KEY_ALIAS: ${{ secrets.GCP_KEY_ALIAS }} | |
run: ./ci/scripts/sign.sh "bin/pinnacle-windows-amd64.exe" | |
- name: Sign ARM64 | |
env: | |
GCP_KEYSTORE: ${{ secrets.GCP_KEYSTORE }} | |
GCP_KEY_ALIAS: ${{ secrets.GCP_KEY_ALIAS }} | |
run: ./ci/scripts/sign.sh "bin/pinnacle-windows-arm64.exe" | |
- name: Upload artifact | |
uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882 # v4.4.3 | |
with: | |
name: windows-binaries | |
path: bin | |
retention-days: 1 | |
if-no-files-found: error | |
build_linux: | |
if: inputs.platform == 'linux' | |
name: "Build Linux" | |
runs-on: ubuntu-latest | |
steps: | |
- name: Checkout code | |
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 | |
- name: Install dependencies | |
run: >- | |
sudo apt-get update | |
- name: Set up Go | |
uses: WillAbides/setup-go-faster@a0ff5217a7d2567ed6ff1aa2b7d8f9d58173b2c9 # v1.14.0 | |
with: | |
go-version-file: 'go.mod' | |
- name: Read version | |
run: | | |
echo "VERSION=$(cat VERSION)" >> $GITHUB_ENV | |
- name: Build AMD64 | |
run: >- | |
env | |
GOARCH=amd64 | |
GOOS=linux | |
go build -a -v -trimpath -buildmode=pie -mod=readonly -modcacherw | |
-ldflags="-s -w -X main.version=${VERSION}" | |
-o bin/pinnacle-linux-amd64 | |
. | |
- name: Build ARM64 | |
run: >- | |
env | |
GOARCH=arm64 | |
GOOS=linux | |
go build -a -v -trimpath -buildmode=pie -mod=readonly -modcacherw | |
-ldflags="-s -w -X main.version=${VERSION}" | |
-o bin/pinnacle-linux-arm64 | |
. | |
- name: Upload artifact | |
uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882 # v4.4.3 | |
with: | |
name: linux-binaries | |
path: bin | |
retention-days: 1 | |
if-no-files-found: error | |
build_macos: | |
if: inputs.platform == 'macos' | |
name: "Build MacOS" | |
runs-on: macos-latest | |
steps: | |
- name: Checkout code | |
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 | |
- name: Set up Go | |
uses: WillAbides/setup-go-faster@a0ff5217a7d2567ed6ff1aa2b7d8f9d58173b2c9 # v1.14.0 | |
with: | |
go-version-file: 'go.mod' | |
- name: Read version | |
run: | | |
echo "VERSION=$(cat VERSION)" >> $GITHUB_ENV | |
- name: Build AMD64 | |
run: >- | |
env | |
GOARCH=amd64 | |
GOOS=darwin | |
go build -a -v -trimpath -buildmode=pie -mod=readonly -modcacherw | |
-ldflags="-s -w -X main.version=${VERSION}" | |
-o bin/pinnacle-darwin-amd64 | |
. | |
- name: Build ARM64 | |
run: >- | |
env | |
GOARCH=arm64 | |
GOOS=darwin | |
go build -a -v -trimpath -buildmode=pie -mod=readonly -modcacherw | |
-ldflags="-s -w -X main.version=${VERSION}" | |
-o bin/pinnacle-darwin-arm64 | |
. | |
- name: Upload artifact | |
uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882 # v4.4.3 | |
with: | |
name: macos-binaries | |
path: bin | |
retention-days: 1 | |
if-no-files-found: error | |
package_windows: | |
if: inputs.platform == 'windows' | |
name: "Package Windows" | |
runs-on: windows-latest | |
needs: [ build_windows ] | |
steps: | |
- name: Checkout .iss files | |
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 | |
with: | |
sparse-checkout: | | |
ci/pkg/windows | |
ci/scripts | |
VERSION | |
- name: Download binaries | |
uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8 | |
with: | |
name: windows-binaries | |
path: bin | |
- name: Read version | |
run: | | |
echo "VERSION=$(cat VERSION)" >> $GITHUB_ENV | |
- name: Package AMD64 with InnoSetup | |
run: | | |
AMD_ISS=ci/pkg/windows/iss/PackagePinnacle-amd64.iss | |
sed -i "s/#define MyAppVersion \"1.0.0\"/#define MyAppVersion \"${VERSION}\"/" "$AMD_ISS" | |
iscc.exe "$AMD_ISS" | |
- name: Package ARM64 with InnoSetup | |
run: | | |
ARM_ISS=ci/pkg/windows/iss/PackagePinnacle-arm64.iss | |
sed -i "s/#define MyAppVersion \"1.0.0\"/#define MyAppVersion \"${VERSION}\"/" "$ARM_ISS" | |
iscc.exe "$ARM_ISS" | |
- name: Authenticate with Google Cloud | |
uses: google-github-actions/auth@6fc4af4b145ae7821d527454aa9bd537d1f2dc5f # v2.1.7 | |
with: | |
credentials_json: ${{ secrets.GCP_CREDENTIALS }} | |
- name: Set up Google Cloud SDK | |
uses: google-github-actions/setup-gcloud@6189d56e4096ee891640bb02ac264be376592d6a # v2.1.2 | |
- name: Download jsign | |
run: ./ci/scripts/download-jsign.sh | |
- name: Decode certificate | |
run: | | |
echo "${{ secrets.CERTFILE_BASE64 }}" | base64 --decode > pinnacle-certificate.pem | |
- name: Sign AMD64 | |
env: | |
GCP_KEYSTORE: ${{ secrets.GCP_KEYSTORE }} | |
GCP_KEY_ALIAS: ${{ secrets.GCP_KEY_ALIAS }} | |
run: ./ci/scripts/sign.sh "build/out/AlpineClientSetup-${VERSION}-x86_64.exe" | |
- name: Sign ARM64 | |
env: | |
GCP_KEYSTORE: ${{ secrets.GCP_KEYSTORE }} | |
GCP_KEY_ALIAS: ${{ secrets.GCP_KEY_ALIAS }} | |
run: ./ci/scripts/sign.sh "build/out/AlpineClientSetup-${VERSION}-ARM64.exe" | |
- name: Upload artifact | |
uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882 # v4.4.3 | |
with: | |
name: windows-installers | |
path: build/out | |
retention-days: 1 | |
if-no-files-found: error | |
package_linux: | |
if: inputs.platform == 'linux' | |
name: "Package Linux" | |
runs-on: ubuntu-latest | |
needs: [ build_linux ] | |
steps: | |
- name: Checkout ci/pkg files | |
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 | |
with: | |
sparse-checkout: | | |
ci/pkg/linux | |
ci/scripts | |
VERSION | |
- name: Download binaries | |
uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8 | |
with: | |
name: linux-binaries | |
path: bin | |
- name: Install dependencies | |
run: >- | |
sudo apt-get update && | |
sudo apt-get install -y | |
rpm | |
debhelper | |
devscripts | |
dpkg-dev | |
libfuse2 | |
- name: Read version | |
run: | | |
echo "VERSION=$(cat VERSION)" >> $GITHUB_ENV | |
- name: Download AppImageTool | |
run: ./ci/scripts/download-appimagetool.sh | |
- name: Prepare for packaging | |
run: | | |
# Edit version in spec/control files | |
sed -i "s/^Version:.*/Version: ${VERSION}/" ci/pkg/linux/rpm/SPECS/pinnacle.spec | |
sed -i "s/^Release:.*/Release: ${RELEASE}/" ci/pkg/linux/rpm/SPECS/pinnacle.spec | |
sed -i "s/^Version:.*/Version: ${VERSION}-${RELEASE}/" ci/pkg/linux/deb/DEBIAN/control | |
# Set up rpmbuild/debbuild/appimage file tree | |
mkdir -p ~/rpmbuild/{BUILD,RPMS,SOURCES,SPECS,SRPMS} | |
mkdir -p ~/debbuild/alpine-client/{DEBIAN,usr/bin,usr/share/applications,usr/share/pixmaps} | |
mkdir -p ~/appbuild/AlpineClient.AppDir/usr/{bin,share/{icons/hicolor/scalable/apps,licenses/alpine-client}} | |
# Copy resources | |
cp -r ci/pkg/linux/rpm/* ~/rpmbuild/ | |
cp -r ci/pkg/linux/deb/* ~/debbuild/alpine-client/ | |
cp -r ci/pkg/linux/appimage/* ~/appbuild/AlpineClient.AppDir/ | |
# Copy binaries | |
cp bin/pinnacle-linux-amd64 ~/rpmbuild/SOURCES/ | |
cp bin/pinnacle-linux-amd64 ~/debbuild/alpine-client/usr/bin/alpine-client | |
cp bin/pinnacle-linux-amd64 ~/appbuild/AlpineClient.AppDir/usr/bin/alpine-client | |
# Make binaries executable | |
chmod +x ~/rpmbuild/SOURCES/pinnacle-linux-amd64 | |
chmod +x ~/debbuild/alpine-client/usr/bin/alpine-client | |
chmod +x ~/appbuild/AlpineClient.AppDir/usr/bin/alpine-client | |
chmod +x ~/appbuild/AlpineClient.AppDir/AppRun | |
# Create output folder | |
mkdir -p build/out | |
- name: Package AMD64 RPM | |
run: >- | |
rpmbuild -bb | |
~/rpmbuild/SPECS/pinnacle.spec | |
--define "_rpmdir build/out" | |
--target=x86_64 | |
- name: Package AMD64 DEB | |
run: >- | |
dpkg-deb -Zgzip | |
--build ~/debbuild/alpine-client | |
"build/out/alpine-client_${VERSION}-${RELEASE}_amd64.deb" | |
- name: Package AMD64 AppImage | |
run: >- | |
./appimagetool-x86_64.AppImage ~/appbuild/AlpineClient.AppDir | |
"build/out/Alpine_Client-${VERSION}-x86_64.AppImage" | |
- name: Swap AMD64 binary for ARM64 | |
run: | | |
# Remove amd64 binaries | |
rm -f ~/rpmbuild/SOURCES/pinnacle-darwin-amd64 | |
rm -f ~/debbuild/alpine-client/usr/bin/alpine-client | |
# Edit arch & binary name in spec/control files | |
sed -i -e 's/linux-amd64/linux-arm64/g' -e 's/x86_64/aarch64/g' ~/rpmbuild/SPECS/pinnacle.spec | |
sed -i 's/amd64/arm64/g' ~/debbuild/alpine-client/DEBIAN/control | |
# Copy arm64 binaries | |
cp bin/pinnacle-linux-arm64 ~/rpmbuild/SOURCES/ | |
cp bin/pinnacle-linux-arm64 ~/debbuild/alpine-client/usr/bin/alpine-client | |
# Make binaries executable | |
chmod +x ~/rpmbuild/SOURCES/pinnacle-linux-arm64 | |
chmod +x ~/debbuild/alpine-client/usr/bin/alpine-client | |
- name: Package ARM64 RPM | |
run: >- | |
rpmbuild -bb | |
~/rpmbuild/SPECS/pinnacle.spec | |
--define "_rpmdir build/out" | |
--target=aarch64 | |
- name: Package ARM64 DEB | |
run: >- | |
dpkg-deb -Zgzip | |
--build ~/debbuild/alpine-client | |
"build/out/alpine-client_${VERSION}-${RELEASE}_arm64.deb" | |
- name: Tidy artifacts | |
run: | | |
if [ -d "build/out/x86_64" ]; then | |
cp -r build/out/x86_64/* build/out/ | |
fi | |
if [ -d "build/out/aarch64" ]; then | |
cp -r build/out/aarch64/* build/out/ | |
fi | |
rm -rf build/out/x86_64 | |
rm -rf build/out/aarch64 | |
- name: Upload artifact | |
uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882 # v4.4.3 | |
with: | |
name: linux-installers | |
path: build/out | |
retention-days: 1 | |
if-no-files-found: error | |
package_macos: | |
if: inputs.platform == 'macos' | |
name: "Package MacOS" | |
runs-on: macos-latest | |
needs: [ build_macos ] | |
steps: | |
- name: Checkout ci/pkg/darwin | |
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 | |
with: | |
sparse-checkout: | | |
ci/pkg/darwin | |
VERSION | |
- name: Download binaries | |
uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8 | |
with: | |
name: macos-binaries | |
path: bin | |
- name: Read version | |
run: | | |
echo "VERSION=$(cat VERSION)" >> $GITHUB_ENV | |
- name: Write signing keys | |
env: | |
APPLICATION_CERT_P12: ${{ secrets.APPLE_BINARY_CERT_DATA }} | |
INSTALLER_CERT_P12: ${{ secrets.APPLE_CERT_DATA }} | |
run: | | |
echo "$APPLICATION_CERT_P12" | base64 -d -o application_cert.p12 | |
echo "$INSTALLER_CERT_P12" | base64 -d -o installer_cert.p12 | |
- name: Create output directory | |
run: mkdir -p build/out | |
- name: Write App Store Connect API key | |
env: | |
APP_STORE_CONNECT_KEY: ${{ secrets.APP_STORE_CONNECT_KEY }} | |
run: echo "$APP_STORE_CONNECT_KEY" > app_store_connect_key.json | |
- name: Set up AMD64 environment | |
run: | | |
AMD64_DIR="ci/pkg/darwin/x86_64" | |
mkdir -p "${AMD64_DIR}" | |
cp -r "ci/pkg/darwin/Alpine Client.app" "${AMD64_DIR}/" | |
APP="${AMD64_DIR}/Alpine Client.app/Contents" | |
mkdir -p "${APP}/MacOS" | |
sed -i '' "s/<string>1.0.0<\/string>/<string>${{ env.VERSION }}<\/string>/" "${APP}/Info.plist" | |
cp bin/pinnacle-darwin-amd64 "${APP}/MacOS/pinnacle-darwin-amd64" | |
chmod +x "${APP}/MacOS/pinnacle-darwin-amd64" | |
echo "AMD64_APP=${APP}" >> $GITHUB_ENV | |
echo "AMD64_DIR=${AMD64_DIR}" >> $GITHUB_ENV | |
- name: Sign AMD64 Binary | |
uses: indygreg/apple-code-sign-action@44d0985b7f4363198e80b6fea63ac3e9dd3e9957 # v1.1 | |
with: | |
input_path: "${{ env.AMD64_APP }}/MacOS/pinnacle-darwin-amd64" | |
p12_file: application_cert.p12 | |
p12_password: ${{ secrets.APPLE_BINARY_CERT_PASSWORD }} | |
sign: true | |
sign_args: "--code-signature-flags=runtime" | |
- name: Sign AMD64 App Bundle | |
uses: indygreg/apple-code-sign-action@44d0985b7f4363198e80b6fea63ac3e9dd3e9957 # v1.1 | |
with: | |
input_path: "${{ env.AMD64_DIR }}/Alpine Client.app" | |
p12_file: application_cert.p12 | |
p12_password: ${{ secrets.APPLE_BINARY_CERT_PASSWORD }} | |
sign: true | |
sign_args: "--code-signature-flags=runtime" | |
- name: Package AMD64 | |
run: >- | |
pkgbuild | |
--root "${{ env.AMD64_DIR }}" | |
--identifier com.alpineclient.pinnacle | |
--version "${{ env.VERSION }}" | |
--install-location /Applications | |
"build/out/AlpineClientSetup-${{ env.VERSION }}-x86_64.pkg" | |
- name: Sign AMD64 Package | |
uses: indygreg/apple-code-sign-action@44d0985b7f4363198e80b6fea63ac3e9dd3e9957 # v1.1 | |
with: | |
input_path: "build/out/AlpineClientSetup-${{ env.VERSION }}-x86_64.pkg" | |
p12_file: installer_cert.p12 | |
p12_password: ${{ secrets.APPLE_CERT_PASSWORD }} | |
sign: true | |
sign_args: "--code-signature-flags=runtime" | |
- name: Notarize Signed AMD64 Package | |
uses: indygreg/apple-code-sign-action@44d0985b7f4363198e80b6fea63ac3e9dd3e9957 # v1.1 | |
with: | |
input_path: "build/out/AlpineClientSetup-${{ env.VERSION }}-x86_64.pkg" | |
sign: false | |
notarize: true | |
staple: true | |
app_store_connect_api_key_json_file: app_store_connect_key.json | |
- name: Set up ARM64 environment | |
run: | | |
ARM64_DIR="ci/pkg/darwin/arm64" | |
mkdir -p "${ARM64_DIR}" | |
cp -r "ci/pkg/darwin/Alpine Client.app" "${ARM64_DIR}/" | |
APP="${ARM64_DIR}/Alpine Client.app/Contents" | |
mkdir -p "${APP}/MacOS" | |
sed -i '' "s/<string>1.0.0<\/string>/<string>${{ env.VERSION }}<\/string>/" "${APP}/Info.plist" | |
sed -i '' 's/amd64/arm64/g' "${APP}/Info.plist" | |
cp bin/pinnacle-darwin-arm64 "${APP}/MacOS/pinnacle-darwin-arm64" | |
chmod +x "${APP}/MacOS/pinnacle-darwin-arm64" | |
echo "ARM64_APP=${APP}" >> $GITHUB_ENV | |
echo "ARM64_DIR=${ARM64_DIR}" >> $GITHUB_ENV | |
- name: Sign ARM64 Binary | |
uses: indygreg/apple-code-sign-action@44d0985b7f4363198e80b6fea63ac3e9dd3e9957 # v1.1 | |
with: | |
input_path: "${{ env.ARM64_APP }}/MacOS/pinnacle-darwin-arm64" | |
p12_file: application_cert.p12 | |
p12_password: ${{ secrets.APPLE_BINARY_CERT_PASSWORD }} | |
sign: true | |
sign_args: "--code-signature-flags=runtime" | |
- name: Sign ARM64 App Bundle | |
uses: indygreg/apple-code-sign-action@44d0985b7f4363198e80b6fea63ac3e9dd3e9957 # v1.1 | |
with: | |
input_path: "${{ env.ARM64_DIR }}/Alpine Client.app" | |
p12_file: application_cert.p12 | |
p12_password: ${{ secrets.APPLE_BINARY_CERT_PASSWORD }} | |
sign: true | |
sign_args: "--code-signature-flags=runtime" | |
- name: Package ARM64 | |
run: >- | |
pkgbuild | |
--root "${{ env.ARM64_DIR }}" | |
--identifier com.alpineclient.pinnacle | |
--version "${{ env.VERSION }}" | |
--install-location /Applications | |
"build/out/AlpineClientSetup-${{ env.VERSION }}-ARM64.pkg" | |
- name: Sign ARM64 Package | |
uses: indygreg/apple-code-sign-action@44d0985b7f4363198e80b6fea63ac3e9dd3e9957 # v1.1 | |
with: | |
input_path: "build/out/AlpineClientSetup-${{ env.VERSION }}-ARM64.pkg" | |
p12_file: installer_cert.p12 | |
p12_password: ${{ secrets.APPLE_CERT_PASSWORD }} | |
sign: true | |
sign_args: "--code-signature-flags=runtime" | |
- name: Notarize Signed ARM64 Package | |
uses: indygreg/apple-code-sign-action@44d0985b7f4363198e80b6fea63ac3e9dd3e9957 # v1.1 | |
with: | |
input_path: "build/out/AlpineClientSetup-${{ env.VERSION }}-ARM64.pkg" | |
sign: false | |
notarize: true | |
staple: true | |
app_store_connect_api_key_json_file: app_store_connect_key.json | |
- name: Upload artifact | |
uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882 # v4.4.3 | |
with: | |
name: macos-installers | |
path: build/out | |
retention-days: 1 | |
if-no-files-found: error |