mirror of
https://github.com/nolen777/eagle0.git
synced 2026-07-28 20:55:44 +00:00
adminandGitHub
c092002677
* Route CI LFS through Gitea * Add fresh Gitea LFS verification mode * Expose fresh LFS verification failures * Avoid duplicate Gitea LFS auth headers
553 lines
24 KiB
YAML
553 lines
24 KiB
YAML
name: Mac Build
|
|
|
|
on:
|
|
push:
|
|
branches: [ "main" ]
|
|
paths:
|
|
- ".github/workflows/mac_build.yml"
|
|
- "src/main/csharp/net/eagle0/clients/unity/**"
|
|
- "src/main/protobuf/net/eagle0/common/**"
|
|
- "src/main/protobuf/net/eagle0/shardok/**"
|
|
- "src/main/protobuf/net/eagle0/eagle/api/**"
|
|
- "src/main/protobuf/net/eagle0/eagle/common/**"
|
|
- "src/main/protobuf/net/eagle0/eagle/views/**"
|
|
- "src/main/go/net/eagle0/build/mac_build_handler/**"
|
|
- "scripts/build_protos.sh"
|
|
- "scripts/build_mac_plugin.sh"
|
|
- "scripts/build_sparkle_plugin.sh"
|
|
- "scripts/inject_sparkle.sh"
|
|
- "scripts/codesign_mac_app.sh"
|
|
- "scripts/notarize_submit.sh"
|
|
- "scripts/notarize_wait.sh"
|
|
- "ci/github_actions/build_mac.sh"
|
|
- "ci/github_actions/build_unity_mac.sh"
|
|
- "ci/github_actions/ensure_bazel_installed.sh"
|
|
- ".github/actions/setup-bazel/**"
|
|
- "ci/github_actions/detect_addressables_changes.sh"
|
|
- "ci/github_actions/upload_addressables.sh"
|
|
- "ci/github_actions/ensure_unity_installed.sh"
|
|
- "src/main/csharp/net/eagle0/clients/unity/eagle0/ProjectSettings/ProjectVersion.txt"
|
|
- ".bazelrc"
|
|
- "ci/mac/**"
|
|
- "src/main/objc/net/eagle0/clients/unity/sparkle/**"
|
|
pull_request:
|
|
# On PRs, only build Mac when Mac-specific files change. Shared C#/proto
|
|
# changes are covered by the Windows build — if it passes, Mac will too.
|
|
paths:
|
|
- ".github/workflows/mac_build.yml"
|
|
- "src/main/go/net/eagle0/build/mac_build_handler/**"
|
|
- "scripts/build_mac_plugin.sh"
|
|
- "scripts/build_sparkle_plugin.sh"
|
|
- "src/main/csharp/net/eagle0/clients/unity/eagle0/Assets/Editor/BuildScript.cs"
|
|
- "src/main/csharp/net/eagle0/clients/unity/eagle0/Assets/Eagle/SparkleInitializer.cs"
|
|
- "src/main/csharp/net/eagle0/clients/unity/eagle0/Assets/Eagle/SparkleUpdater.cs"
|
|
- "src/main/csharp/net/eagle0/clients/unity/eagle0/Assets/common/UpdateNotification/UpdateNotificationManager.cs"
|
|
- "src/main/csharp/net/eagle0/clients/unity/eagle0/Assets/common/WindowFocusManager.cs"
|
|
- "src/main/objc/net/eagle0/clients/unity/sparkle/**"
|
|
- "scripts/inject_sparkle.sh"
|
|
- "scripts/codesign_mac_app.sh"
|
|
- "scripts/notarize_submit.sh"
|
|
- "scripts/notarize_wait.sh"
|
|
- "ci/github_actions/build_mac.sh"
|
|
- "ci/github_actions/build_unity_mac.sh"
|
|
- "ci/github_actions/ensure_unity_installed.sh"
|
|
- "ci/github_actions/ensure_bazel_installed.sh"
|
|
- ".github/actions/setup-bazel/**"
|
|
- "ci/github_actions/detect_addressables_changes.sh"
|
|
- "src/main/csharp/net/eagle0/clients/unity/eagle0/ProjectSettings/ProjectVersion.txt"
|
|
- "src/main/csharp/net/eagle0/clients/unity/eagle0/ProjectSettings/ProjectSettings.asset"
|
|
- ".bazelrc"
|
|
- "ci/mac/**"
|
|
workflow_dispatch:
|
|
inputs:
|
|
skip_signing:
|
|
description: 'Skip code signing, notarization, and deploy (build only)'
|
|
required: false
|
|
default: 'false'
|
|
type: boolean
|
|
|
|
permissions:
|
|
contents: read
|
|
actions: write # Required to delete artifacts after deploy
|
|
|
|
env:
|
|
# Runner-specific build directory to allow parallel builds on multiple runners
|
|
EAGLE0_BUILD_DIR: /tmp/eagle0-${{ github.run_id }}
|
|
# Runner-specific keychain to avoid conflicts when multiple runners sign simultaneously
|
|
KEYCHAIN_NAME: build-${{ github.run_id }}.keychain
|
|
|
|
jobs:
|
|
build-mac:
|
|
runs-on: [self-hosted, macOS, unity-mac]
|
|
concurrency:
|
|
group: ${{ github.workflow }}-build-${{ github.head_ref || github.run_id }}
|
|
cancel-in-progress: ${{ github.event_name == 'pull_request' }}
|
|
outputs:
|
|
should_deploy: ${{ steps.check-deploy.outputs.should_deploy }}
|
|
addressables_changed: ${{ steps.addressables.outputs.changed }}
|
|
|
|
steps:
|
|
- name: Prune stale PR refs
|
|
run: |
|
|
# Self-hosted runners persist .git between runs. When a PR is updated,
|
|
# old local refs (refs/remotes/pull/*/merge) may point to commits whose
|
|
# objects were never fetched or have been pruned. Remove these stale refs
|
|
# before checkout to prevent "missing object" errors.
|
|
if [ -d ".git" ]; then
|
|
echo "Pruning stale PR refs..."
|
|
git for-each-ref --format='%(refname)' refs/remotes/pull/ 2>/dev/null | \
|
|
xargs -r git update-ref -d 2>/dev/null || true
|
|
fi
|
|
|
|
- name: Ensure Git LFS available for checkout
|
|
run: |
|
|
COMMON_PATHS="/opt/homebrew/bin:/usr/local/bin:/usr/bin:/bin:/usr/sbin:/sbin"
|
|
export PATH="${COMMON_PATHS}:${PATH}"
|
|
for path in /opt/homebrew/bin /usr/local/bin; do
|
|
if [ -d "$path" ]; then
|
|
echo "$path" >> "$GITHUB_PATH"
|
|
fi
|
|
done
|
|
if ! command -v git-lfs >/dev/null 2>&1; then
|
|
brew install git-lfs
|
|
fi
|
|
git-lfs --version
|
|
|
|
- uses: actions/checkout@v7
|
|
env:
|
|
GIT_LFS_SKIP_SMUDGE: 1
|
|
with:
|
|
persist-credentials: false
|
|
lfs: false # Fetch LFS after checkout to avoid stale ref issues
|
|
clean: false # Library/ persists between runs on self-hosted runners
|
|
fetch-depth: 0 # For version numbering from git history
|
|
|
|
- name: Clean stale files
|
|
run: |
|
|
git clean -ffd
|
|
LIBRARY_DIR="src/main/csharp/net/eagle0/clients/unity/eagle0/Library"
|
|
VERSION_CACHE="$LIBRARY_DIR/.last_unity_version"
|
|
PROJECT_VERSION_FILE="src/main/csharp/net/eagle0/clients/unity/eagle0/ProjectSettings/ProjectVersion.txt"
|
|
CURRENT_VERSION=$(grep "m_EditorVersion:" "$PROJECT_VERSION_FILE" | head -1 | sed 's/m_EditorVersion: //')
|
|
|
|
# Nuke Library/ when Unity version changes to avoid import loops
|
|
if [ -f "$VERSION_CACHE" ]; then
|
|
CACHED_VERSION=$(cat "$VERSION_CACHE")
|
|
if [ "$CACHED_VERSION" != "$CURRENT_VERSION" ]; then
|
|
echo "Unity version changed ($CACHED_VERSION -> $CURRENT_VERSION) -- clearing Library/"
|
|
rm -rf "$LIBRARY_DIR"
|
|
fi
|
|
fi
|
|
|
|
# Only clear Bee/ when C# files were added/deleted/renamed (structural
|
|
# changes that stale the DAG). Content-only modifications are handled by
|
|
# Bee's incremental compilation. See persist_library.sh for background.
|
|
BEE_DIR="$LIBRARY_DIR/Bee"
|
|
SHA_FILE="$LIBRARY_DIR/.last_built_sha"
|
|
if [ -f "$SHA_FILE" ] && [ -d "$BEE_DIR" ]; then
|
|
LAST_SHA=$(cat "$SHA_FILE")
|
|
if git diff --diff-filter=ADR --name-only "$LAST_SHA" HEAD -- '*.cs' '*.csproj' '*.asmdef' 2>/dev/null | grep -q .; then
|
|
echo "C# files added/deleted/renamed since $LAST_SHA — clearing Bee/"
|
|
rm -rf "$BEE_DIR"
|
|
else
|
|
echo "No structural C# changes since $LAST_SHA — keeping Bee/"
|
|
fi
|
|
else
|
|
echo "No previous build SHA or no Bee/ — clearing Bee/ as safe default"
|
|
rm -rf "$BEE_DIR"
|
|
fi
|
|
|
|
- name: Fetch LFS files
|
|
env:
|
|
GITEA_LFS_TOKEN: ${{ secrets.GITEA_LFS_TOKEN }}
|
|
GITEA_LFS_USERNAME: ${{ secrets.GITEA_LFS_USERNAME }}
|
|
GITHUB_TOKEN: ${{ github.token }}
|
|
run: ./ci/github_actions/fetch_lfs.sh
|
|
|
|
- name: Ensure Unity version installed
|
|
run: ./ci/github_actions/ensure_unity_installed.sh mac
|
|
|
|
- name: Ensure .NET SDK installed
|
|
uses: actions/setup-dotnet@v6
|
|
with:
|
|
dotnet-version: '8.0.x'
|
|
|
|
- name: Ensure Bazel installed
|
|
uses: ./.github/actions/setup-bazel
|
|
|
|
- name: Sync Bazel Xcode config
|
|
run: ./scripts/sync_bazel_xcode.sh
|
|
|
|
- name: Detect Addressables changes
|
|
id: addressables
|
|
if: success()
|
|
shell: bash
|
|
run: |
|
|
set -euo pipefail
|
|
|
|
if [[ "${{ github.event_name }}" == "pull_request" ]]; then
|
|
BASE_SHA="${{ github.event.pull_request.base.sha }}"
|
|
else
|
|
BASE_SHA="${{ github.event.before }}"
|
|
fi
|
|
|
|
./ci/github_actions/detect_addressables_changes.sh "$BASE_SHA" "${{ github.sha }}"
|
|
|
|
- name: Build Mac Unity
|
|
run: ./ci/github_actions/build_unity_mac.sh "${{ env.EAGLE0_BUILD_DIR }}/eagle0MAC" "${{ steps.addressables.outputs.changed }}" "${{ steps.addressables.outputs.changed }}"
|
|
|
|
- name: Save build SHA for Bee/ cache invalidation
|
|
if: success()
|
|
run: |
|
|
mkdir -p src/main/csharp/net/eagle0/clients/unity/eagle0/Library
|
|
git rev-parse HEAD > src/main/csharp/net/eagle0/clients/unity/eagle0/Library/.last_built_sha
|
|
|
|
- name: Save Unity version for Library/ cache invalidation
|
|
if: success()
|
|
run: |
|
|
mkdir -p src/main/csharp/net/eagle0/clients/unity/eagle0/Library
|
|
grep "m_EditorVersion:" src/main/csharp/net/eagle0/clients/unity/eagle0/ProjectSettings/ProjectVersion.txt | head -1 | sed 's/m_EditorVersion: //' > src/main/csharp/net/eagle0/clients/unity/eagle0/Library/.last_unity_version
|
|
|
|
- name: Check if should deploy
|
|
id: check-deploy
|
|
run: |
|
|
if [[ "${{ github.event_name }}" == "workflow_dispatch" && "${{ github.event.inputs.skip_signing }}" == "true" ]]; then
|
|
echo "should_deploy=false" >> $GITHUB_OUTPUT
|
|
elif [[ "${{ github.event_name }}" == "push" && "${{ github.ref }}" == "refs/heads/main" ]]; then
|
|
echo "should_deploy=true" >> $GITHUB_OUTPUT
|
|
elif [[ "${{ github.event_name }}" == "workflow_dispatch" ]]; then
|
|
echo "should_deploy=true" >> $GITHUB_OUTPUT
|
|
else
|
|
echo "should_deploy=false" >> $GITHUB_OUTPUT
|
|
fi
|
|
|
|
- name: Zip unsigned app for deploy
|
|
if: success() && steps.check-deploy.outputs.should_deploy == 'true'
|
|
run: |
|
|
cd ${{ env.EAGLE0_BUILD_DIR }}/eagle0MAC
|
|
ditto -c -k --keepParent eagle0.app eagle0.app.zip
|
|
|
|
- name: Upload unsigned app
|
|
if: success() && steps.check-deploy.outputs.should_deploy == 'true'
|
|
uses: actions/upload-artifact@v7
|
|
with:
|
|
name: unsigned-mac-app-${{ github.run_id }}
|
|
path: ${{ env.EAGLE0_BUILD_DIR }}/eagle0MAC/eagle0.app.zip
|
|
retention-days: 1
|
|
|
|
- name: Upload Mac Addressables for deploy
|
|
if: success() && steps.check-deploy.outputs.should_deploy == 'true' && steps.addressables.outputs.changed == 'true'
|
|
uses: actions/upload-artifact@v7
|
|
with:
|
|
name: mac-addressables-${{ github.run_id }}
|
|
path: src/main/csharp/net/eagle0/clients/unity/eagle0/ServerData/StandaloneOSX
|
|
if-no-files-found: ignore
|
|
retention-days: 1
|
|
|
|
- name: Archive Build Log
|
|
if: success() || failure()
|
|
uses: actions/upload-artifact@v7
|
|
with:
|
|
name: editor_mac.log
|
|
path: ${{ env.EAGLE0_BUILD_DIR }}/editor_mac.log
|
|
retention-days: 3
|
|
- name: Archive Addressables build reports
|
|
if: (success() || failure()) && steps.addressables.outputs.changed == 'true'
|
|
uses: actions/upload-artifact@v7
|
|
with:
|
|
name: mac-addressables-build-reports
|
|
path: src/main/csharp/net/eagle0/clients/unity/eagle0/Library/com.unity.addressables/BuildReports
|
|
if-no-files-found: ignore
|
|
retention-days: 3
|
|
- name: Cleanup build directory
|
|
if: always()
|
|
run: rm -rf "${{ env.EAGLE0_BUILD_DIR }}"
|
|
|
|
deploy-mac:
|
|
needs: build-mac
|
|
if: needs.build-mac.outputs.should_deploy == 'true'
|
|
runs-on: [self-hosted, macOS, notarize]
|
|
outputs:
|
|
deployed_version: ${{ steps.deploy-mac.outputs.deployed_version }}
|
|
deployed_unity_major_minor: ${{ steps.deploy-mac.outputs.deployed_unity_major_minor }}
|
|
concurrency:
|
|
group: mac-deploy-${{ github.ref }}
|
|
cancel-in-progress: false
|
|
|
|
steps:
|
|
- name: Ensure Git LFS available for checkout
|
|
run: |
|
|
COMMON_PATHS="/opt/homebrew/bin:/usr/local/bin:/usr/bin:/bin:/usr/sbin:/sbin"
|
|
export PATH="${COMMON_PATHS}:${PATH}"
|
|
for path in /opt/homebrew/bin /usr/local/bin; do
|
|
if [ -d "$path" ]; then
|
|
echo "$path" >> "$GITHUB_PATH"
|
|
fi
|
|
done
|
|
if ! command -v git-lfs >/dev/null 2>&1; then
|
|
brew install git-lfs
|
|
fi
|
|
git-lfs --version
|
|
|
|
- uses: actions/checkout@v7
|
|
env:
|
|
GIT_LFS_SKIP_SMUDGE: 1
|
|
with:
|
|
persist-credentials: false
|
|
fetch-depth: 0 # For version numbering
|
|
|
|
- name: Check if run is still latest main
|
|
id: check-latest
|
|
run: |
|
|
if [[ "${{ github.event_name }}" == "push" && "${{ github.ref }}" == "refs/heads/main" ]]; then
|
|
LATEST_SHA=$(curl -fsSL \
|
|
-H "Authorization: Bearer ${{ github.token }}" \
|
|
-H "Accept: application/vnd.github+json" \
|
|
"https://api.github.com/repos/${{ github.repository }}/commits/main" \
|
|
| python3 -c 'import json, sys; print(json.load(sys.stdin)["sha"])')
|
|
if [[ "$LATEST_SHA" != "${{ github.sha }}" ]]; then
|
|
echo "Skipping deploy because ${{ github.sha }} is no longer latest main ($LATEST_SHA is latest)"
|
|
echo "should_deploy=false" >> "$GITHUB_OUTPUT"
|
|
exit 0
|
|
fi
|
|
fi
|
|
echo "should_deploy=true" >> "$GITHUB_OUTPUT"
|
|
|
|
- name: Clean download directory
|
|
if: steps.check-latest.outputs.should_deploy == 'true'
|
|
run: rm -rf ${{ env.EAGLE0_BUILD_DIR }}/eagle0MAC
|
|
|
|
- name: Download unsigned app
|
|
if: steps.check-latest.outputs.should_deploy == 'true'
|
|
uses: actions/download-artifact@v8
|
|
with:
|
|
name: unsigned-mac-app-${{ github.run_id }}
|
|
path: ${{ env.EAGLE0_BUILD_DIR }}/eagle0MAC
|
|
|
|
- name: Unzip unsigned app
|
|
if: steps.check-latest.outputs.should_deploy == 'true'
|
|
run: |
|
|
cd ${{ env.EAGLE0_BUILD_DIR }}/eagle0MAC
|
|
ditto -x -k eagle0.app.zip .
|
|
rm eagle0.app.zip
|
|
ls -la ${{ env.EAGLE0_BUILD_DIR }}/eagle0MAC/eagle0.app/
|
|
|
|
- name: Clean Addressables directory
|
|
if: steps.check-latest.outputs.should_deploy == 'true' && needs.build-mac.outputs.addressables_changed == 'true'
|
|
run: rm -rf src/main/csharp/net/eagle0/clients/unity/eagle0/ServerData/StandaloneOSX
|
|
|
|
- name: Download Mac Addressables
|
|
if: steps.check-latest.outputs.should_deploy == 'true' && needs.build-mac.outputs.addressables_changed == 'true'
|
|
uses: actions/download-artifact@v8
|
|
continue-on-error: true
|
|
with:
|
|
name: mac-addressables-${{ github.run_id }}
|
|
path: src/main/csharp/net/eagle0/clients/unity/eagle0/ServerData/StandaloneOSX
|
|
|
|
- name: Upload Addressables to CDN
|
|
if: steps.check-latest.outputs.should_deploy == 'true' && needs.build-mac.outputs.addressables_changed == 'true'
|
|
env:
|
|
ACCESS_KEY_ID: ${{ secrets.ACCESS_KEY_ID }}
|
|
SECRET_KEY: ${{ secrets.SECRET_KEY }}
|
|
run: ./ci/github_actions/upload_addressables.sh StandaloneOSX
|
|
|
|
- name: Inject Sparkle Framework
|
|
if: steps.check-latest.outputs.should_deploy == 'true'
|
|
env:
|
|
SPARKLE_EDDSA_PUBLIC_KEY: ${{ secrets.SPARKLE_EDDSA_PUBLIC_KEY }}
|
|
run: |
|
|
chmod +x ./scripts/inject_sparkle.sh
|
|
./scripts/inject_sparkle.sh "${{ env.EAGLE0_BUILD_DIR }}/eagle0MAC/eagle0.app"
|
|
|
|
- name: Import Code Signing Certificate
|
|
if: steps.check-latest.outputs.should_deploy == 'true'
|
|
env:
|
|
MACOS_CERTIFICATE: ${{ secrets.MACOS_CERTIFICATE }}
|
|
MACOS_CERTIFICATE_PWD: ${{ secrets.MACOS_CERTIFICATE_PWD }}
|
|
run: |
|
|
# Generate random keychain password (only used within this workflow run)
|
|
KEYCHAIN_PASSWORD=$(openssl rand -base64 32)
|
|
echo "KEYCHAIN_PASSWORD=$KEYCHAIN_PASSWORD" >> $GITHUB_ENV
|
|
|
|
# Decode certificate
|
|
echo "$MACOS_CERTIFICATE" | base64 --decode > certificate.p12
|
|
|
|
# Delete any existing keychain from previous runs
|
|
security delete-keychain "$KEYCHAIN_NAME" 2>/dev/null || true
|
|
|
|
# Create temporary keychain
|
|
security create-keychain -p "$KEYCHAIN_PASSWORD" "$KEYCHAIN_NAME"
|
|
security default-keychain -s "$KEYCHAIN_NAME"
|
|
security unlock-keychain -p "$KEYCHAIN_PASSWORD" "$KEYCHAIN_NAME"
|
|
|
|
# Import certificate
|
|
echo "=== Importing certificate ==="
|
|
security import certificate.p12 -k "$KEYCHAIN_NAME" -P "$MACOS_CERTIFICATE_PWD" -T /usr/bin/codesign -T /usr/bin/security
|
|
|
|
# Allow codesign to access keychain
|
|
echo "=== Setting key partition list ==="
|
|
security set-key-partition-list -S apple-tool:,apple:,codesign: -s -k "$KEYCHAIN_PASSWORD" "$KEYCHAIN_NAME"
|
|
|
|
# Add keychain to search list (required for codesign to find certificates)
|
|
echo "=== Adding keychain to search list ==="
|
|
security list-keychains -d user -s "$KEYCHAIN_NAME" login.keychain
|
|
|
|
# Debug: Check what's in the keychain after import
|
|
echo "=== Debug: Identities in build keychain ==="
|
|
KEYCHAIN_PATH="$HOME/Library/Keychains/$KEYCHAIN_NAME-db"
|
|
security find-identity -v -p codesigning "$KEYCHAIN_PATH" || true
|
|
echo "=== Debug: All available identities ==="
|
|
security find-identity -v -p codesigning || true
|
|
|
|
# Clean up
|
|
rm certificate.p12
|
|
|
|
- name: Code Sign App
|
|
if: steps.check-latest.outputs.should_deploy == 'true'
|
|
env:
|
|
SIGNING_IDENTITY: ${{ secrets.SIGNING_IDENTITY }}
|
|
run: |
|
|
chmod +x ./scripts/codesign_mac_app.sh
|
|
./scripts/codesign_mac_app.sh "${{ env.EAGLE0_BUILD_DIR }}/eagle0MAC/eagle0.app" "ci/mac/eagle0.entitlements"
|
|
|
|
- name: Submit for Notarization
|
|
id: notarize-submit
|
|
if: steps.check-latest.outputs.should_deploy == 'true'
|
|
env:
|
|
APPLE_ID: ${{ secrets.APPLE_ID }}
|
|
APP_SPECIFIC_PASSWORD: ${{ secrets.APP_SPECIFIC_PASSWORD }}
|
|
TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
|
|
run: |
|
|
chmod +x ./scripts/notarize_submit.sh
|
|
./scripts/notarize_submit.sh "${{ env.EAGLE0_BUILD_DIR }}/eagle0MAC/eagle0.app" >> $GITHUB_OUTPUT
|
|
|
|
- name: Wait for Notarization and Staple
|
|
if: steps.check-latest.outputs.should_deploy == 'true'
|
|
env:
|
|
APPLE_ID: ${{ secrets.APPLE_ID }}
|
|
APP_SPECIFIC_PASSWORD: ${{ secrets.APP_SPECIFIC_PASSWORD }}
|
|
TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
|
|
run: |
|
|
chmod +x ./scripts/notarize_wait.sh
|
|
./scripts/notarize_wait.sh "${{ steps.notarize-submit.outputs.submission_id }}" "${{ env.EAGLE0_BUILD_DIR }}/eagle0MAC/eagle0.app"
|
|
|
|
- name: Cleanup Keychain
|
|
if: always()
|
|
run: |
|
|
security delete-keychain "$KEYCHAIN_NAME" 2>/dev/null || true
|
|
|
|
- name: Zip notarized app for artifact
|
|
if: steps.check-latest.outputs.should_deploy == 'true'
|
|
run: |
|
|
cd ${{ env.EAGLE0_BUILD_DIR }}/eagle0MAC
|
|
rm -f eagle0.app.zip
|
|
ditto -c -k --keepParent eagle0.app eagle0.app.zip
|
|
|
|
- name: Upload notarized app
|
|
if: steps.check-latest.outputs.should_deploy == 'true'
|
|
uses: actions/upload-artifact@v7
|
|
with:
|
|
name: notarized-mac-app-${{ github.run_id }}
|
|
path: ${{ env.EAGLE0_BUILD_DIR }}/eagle0MAC/eagle0.app.zip
|
|
retention-days: 1
|
|
|
|
- name: Ensure Bazel installed
|
|
if: steps.check-latest.outputs.should_deploy == 'true'
|
|
uses: ./.github/actions/setup-bazel
|
|
|
|
- name: Sync Bazel Xcode config
|
|
if: steps.check-latest.outputs.should_deploy == 'true'
|
|
run: ./scripts/sync_bazel_xcode.sh
|
|
|
|
- name: Deploy Mac Build
|
|
id: deploy-mac
|
|
if: steps.check-latest.outputs.should_deploy == 'true'
|
|
env:
|
|
ACCESS_KEY_ID: ${{ secrets.ACCESS_KEY_ID }}
|
|
SECRET_KEY: ${{ secrets.SECRET_KEY }}
|
|
SPARKLE_EDDSA_PRIVATE_KEY: ${{ secrets.SPARKLE_EDDSA_PRIVATE_KEY }}
|
|
run: |
|
|
# Write private key to temp file for signing
|
|
SPARKLE_PRIVATE_KEY_PATH="/tmp/sparkle_private_key"
|
|
echo "$SPARKLE_EDDSA_PRIVATE_KEY" > "$SPARKLE_PRIVATE_KEY_PATH"
|
|
chmod 600 "$SPARKLE_PRIVATE_KEY_PATH"
|
|
|
|
# Install dmgbuild in an isolated venv. Homebrew Python rejects system
|
|
# installs under PEP 668, and mac_build_handler shells out to dmgbuild.
|
|
DMGBUILD_VENV="${{ env.EAGLE0_BUILD_DIR }}/dmgbuild-venv"
|
|
python3 -m venv "$DMGBUILD_VENV"
|
|
"$DMGBUILD_VENV/bin/python" -m pip install --upgrade pip
|
|
"$DMGBUILD_VENV/bin/python" -m pip install dmgbuild
|
|
export PATH="$DMGBUILD_VENV/bin:$PATH"
|
|
|
|
# Background image for styled DMG
|
|
BACKGROUND_PATH="$(pwd)/ci/mac/dmg/background.png"
|
|
|
|
# Read version from the built app's Info.plist to ensure appcast matches the actual app
|
|
APP_PATH="${{ env.EAGLE0_BUILD_DIR }}/eagle0MAC/eagle0.app"
|
|
BUILD_NUMBER=$(/usr/libexec/PlistBuddy -c "Print :CFBundleVersion" "$APP_PATH/Contents/Info.plist")
|
|
VERSION=$(/usr/libexec/PlistBuddy -c "Print :CFBundleShortVersionString" "$APP_PATH/Contents/Info.plist")
|
|
|
|
bazel run //src/main/go/net/eagle0/build/mac_build_handler:mac_build_handler -- \
|
|
"${{ env.EAGLE0_BUILD_DIR }}/eagle0MAC/eagle0.app" \
|
|
"$VERSION" \
|
|
"$BUILD_NUMBER" \
|
|
"$BACKGROUND_PATH" \
|
|
"$SPARKLE_PRIVATE_KEY_PATH"
|
|
|
|
rm "$SPARKLE_PRIVATE_KEY_PATH"
|
|
|
|
echo "deployed_version=$VERSION" >> $GITHUB_OUTPUT
|
|
UNITY_VERSION=$(grep "m_EditorVersion:" src/main/csharp/net/eagle0/clients/unity/eagle0/ProjectSettings/ProjectVersion.txt | head -1 | sed 's/m_EditorVersion: //')
|
|
UNITY_MAJOR_MINOR=$(echo "$UNITY_VERSION" | sed -E 's/^([0-9]+)\.([0-9]+).*/\1.\2/')
|
|
echo "deployed_unity_major_minor=$UNITY_MAJOR_MINOR" >> $GITHUB_OUTPUT
|
|
|
|
# Artifact cleanup is handled by the cleanup job on ubuntu-latest
|
|
- name: Cleanup build directory
|
|
if: always()
|
|
run: rm -rf "${{ env.EAGLE0_BUILD_DIR }}"
|
|
|
|
notify-mac:
|
|
needs: deploy-mac
|
|
if: needs.deploy-mac.outputs.deployed_version != ''
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- name: Purge CDN cache and notify clients
|
|
env:
|
|
NOTIFY_SECRET: ${{ secrets.EAGLE_NOTIFY_SECRET }}
|
|
DO_CDN_PAT: ${{ secrets.DO_CDN_PAT }}
|
|
run: |
|
|
# Purge CDN cache so clients get the latest files immediately
|
|
curl -s -X DELETE "https://api.digitalocean.com/v2/cdn/endpoints/8c98df29-6f0c-4704-8e82-ca40a2b81aa8/cache" \
|
|
-H "Authorization: Bearer $DO_CDN_PAT" \
|
|
-H "Content-Type: application/json" \
|
|
-d '{"files": ["mac/*", "addressables/StandaloneOSX/${{ needs.deploy-mac.outputs.deployed_unity_major_minor }}/*"]}' \
|
|
--fail || echo "Warning: CDN purge failed (non-fatal)"
|
|
|
|
curl -X POST "https://admin.eagle0.net/notify-update?platform=mac&version=${{ needs.deploy-mac.outputs.deployed_version }}&required=false" \
|
|
-H "X-Notify-Secret: $NOTIFY_SECRET" \
|
|
--fail --silent --show-error || echo "Warning: Failed to notify clients (non-fatal)"
|
|
|
|
# Cleanup job runs regardless of success/failure to prevent artifact accumulation
|
|
cleanup:
|
|
needs: [build-mac, deploy-mac, notify-mac]
|
|
if: always()
|
|
runs-on: ubuntu-latest
|
|
|
|
steps:
|
|
- name: Delete this run's Mac app artifacts
|
|
env:
|
|
GH_TOKEN: ${{ github.token }}
|
|
run: |
|
|
# Delete this run's artifacts (names include run ID to avoid conflicts)
|
|
for artifact_name in unsigned-mac-app-${{ github.run_id }} notarized-mac-app-${{ github.run_id }} mac-addressables-${{ github.run_id }}; do
|
|
echo "Deleting artifact: $artifact_name"
|
|
artifact_id=$(gh api "repos/${{ github.repository }}/actions/runs/${{ github.run_id }}/artifacts" \
|
|
-q ".artifacts[] | select(.name == \"$artifact_name\") | .id")
|
|
if [ -n "$artifact_id" ]; then
|
|
echo "Deleting artifact ID: $artifact_id"
|
|
gh api -X DELETE "repos/${{ github.repository }}/actions/artifacts/$artifact_id" || true
|
|
fi
|
|
done
|
|
echo "Cleanup complete"
|