Skip to content

Commit af4b8aa

Browse files
MatteoPologrutoMatteoPologruto
committed
Update release workflows to add macOS arm64 support
1 parent 806b624 commit af4b8aa

File tree

3 files changed

+287
-101
lines changed

3 files changed

+287
-101
lines changed

‎.github/workflows/publish-go-tester-task.yml

Lines changed: 101 additions & 51 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,9 @@
11
# Source: https://github.com/arduino/tooling-project-assets/blob/main/workflow-templates/publish-go-tester-task.md
22
name: Publish Tester Build
33

4-
# See: https://docs.github.com/en/free-pro-team@latest/actions/reference/events-that-trigger-workflows
4+
# See: https://docs.github.com/actions/using-workflows/events-that-trigger-workflows
55
on:
6+
create:
67
push:
78
paths:
89
- ".github/workflows/publish-go-tester-task.ya?ml"
@@ -23,89 +24,138 @@ on:
2324
repository_dispatch:
2425

2526
env:
27+
# As defined by the Taskfile's PROJECT_NAME variable
28+
PROJECT_NAME: serial-discovery
2629
# As defined by the Taskfile's DIST_DIR variable
2730
DIST_DIR: dist
28-
BUILDS_ARTIFACT: build-artifacts
2931

3032
jobs:
31-
build:
33+
run-determination:
3234
runs-on: ubuntu-latest
33-
35+
outputs:
36+
result: ${{ steps.determination.outputs.result }}
3437
steps:
35-
- name: Checkout repository
36-
uses: actions/checkout@v3
37-
with:
38-
fetch-depth: 0
38+
- name: Determine if the rest of the workflow should run
39+
id: determination
40+
run: |
41+
RELEASE_BRANCH_REGEX="refs/heads/v[0-9]+.[0-9]+.x"
42+
TAG_REGEX="refs/tags/.*"
43+
# The `create` event trigger doesn't support `branches` filters, so it's necessary to use Bash instead.
44+
if [[
45+
("${{ github.event_name }}" != "create" ||
46+
"${{ github.ref }}" =~ $RELEASE_BRANCH_REGEX) &&
47+
! "${{ github.ref }}" =~ $TAG_REGEX
48+
]]; then
49+
# Run the other jobs.
50+
RESULT="true"
51+
else
52+
# There is no need to run the other jobs.
53+
RESULT="false"
54+
fi
3955
40-
- name: Install Task
41-
uses: arduino/setup-task@v1
42-
with:
43-
repo-token: ${{ secrets.GITHUB_TOKEN }}
44-
version: 3.x
56+
echo "result=$RESULT" >> $GITHUB_OUTPUT
4557
46-
- name: Build
58+
package-name-prefix:
59+
needs: run-determination
60+
if: needs.run-determination.outputs.result == 'true'
61+
runs-on: ubuntu-latest
62+
outputs:
63+
prefix: ${{ steps.calculation.outputs.prefix }}
64+
steps:
65+
- name: package name prefix calculation
66+
id: calculation
4767
run: |
4868
PACKAGE_NAME_PREFIX="test"
4969
if [ "${{ github.event_name }}" = "pull_request" ]; then
5070
PACKAGE_NAME_PREFIX="$PACKAGE_NAME_PREFIX-${{ github.event.number }}"
5171
fi
5272
PACKAGE_NAME_PREFIX="$PACKAGE_NAME_PREFIX-${{ github.sha }}-"
53-
export PACKAGE_NAME_PREFIX
54-
task dist:all
5573
56-
# Transfer builds to artifacts job
57-
- name: Upload combined builds artifact
58-
uses: actions/upload-artifact@v3
59-
with:
60-
path: ${{ env.DIST_DIR }}
61-
name: ${{ env.BUILDS_ARTIFACT }}
74+
echo "prefix=$PACKAGE_NAME_PREFIX" >> $GITHUB_OUTPUT
6275
63-
artifacts:
64-
name: ${{ matrix.artifact.name }} artifact
65-
needs: build
76+
build:
77+
needs: package-name-prefix
78+
name: Build ${{ matrix.os.name }}
6679
runs-on: ubuntu-latest
6780

6881
strategy:
6982
matrix:
70-
artifact:
71-
- path: "*checksums.txt"
72-
name: checksums
73-
- path: "*Linux_32bit.tar.gz"
83+
os:
84+
- task: Windows_32bit
85+
path: "*Windows_32bit.zip"
86+
name: Windows_X86-32
87+
- task: Windows_64bit
88+
path: "*Windows_64bit.zip"
89+
name: Windows_X86-64
90+
- task: Linux_32bit
91+
path: "*Linux_32bit.tar.gz"
7492
name: Linux_X86-32
75-
- path: "*Linux_64bit.tar.gz"
93+
- task: Linux_64bit
94+
path: "*Linux_64bit.tar.gz"
7695
name: Linux_X86-64
77-
- path: "*Linux_ARM64.tar.gz"
78-
name: Linux_ARM64
79-
- path: "*Linux_ARMv6.tar.gz"
96+
- task: Linux_ARMv6
97+
path: "*Linux_ARMv6.tar.gz"
8098
name: Linux_ARMv6
81-
- path: "*Linux_ARMv7.tar.gz"
99+
- task: Linux_ARMv7
100+
path: "*Linux_ARMv7.tar.gz"
82101
name: Linux_ARMv7
83-
- path: "*macOS_64bit.tar.gz"
102+
- task: Linux_ARM64
103+
path: "*Linux_ARM64.tar.gz"
104+
name: Linux_ARM64
105+
- task: macOS_64bit
106+
path: "*macOS_64bit.tar.gz"
84107
name: macOS_64
85-
- path: "*Windows_32bit.zip"
86-
name: Windows_X86-32
87-
- path: "*Windows_64bit.zip"
88-
name: Windows_X86-64
108+
- task: macOS_ARM64
109+
path: "*macOS_ARM64.tar.gz"
110+
name: macOS_ARM64
89111

90112
steps:
91-
- name: Download combined builds artifact
92-
uses: actions/download-artifact@v3
113+
- name: Checkout repository
114+
uses: actions/checkout@v3
115+
116+
- name: Install Task
117+
uses: arduino/setup-task@v1
93118
with:
94-
name: ${{ env.BUILDS_ARTIFACT }}
95-
path: ${{ env.BUILDS_ARTIFACT }}
119+
repo-token: ${{ secrets.GITHUB_TOKEN }}
120+
version: 3.x
121+
122+
- name: Build
123+
run: |
124+
PACKAGE_NAME_PREFIX=${{ needs.package-name-prefix.outputs.prefix }}
125+
export PACKAGE_NAME_PREFIX
126+
task dist:${{ matrix.os.task }}
96127
97-
- name: Upload individual build artifact
128+
# Transfer builds to artifacts job
129+
- name: Upload build artifact
98130
uses: actions/upload-artifact@v3
99131
with:
100-
path: ${{ env.BUILDS_ARTIFACT }}/${{ matrix.artifact.path }}
101-
name: ${{ matrix.artifact.name }}
132+
path: ${{ env.DIST_DIR }}/${{ matrix.os.path }}
133+
name: ${{ matrix.os.name }}
102134

103-
clean:
104-
needs: artifacts
135+
checksums:
136+
needs:
137+
- build
138+
- package-name-prefix
105139
runs-on: ubuntu-latest
106140

107141
steps:
108-
- name: Remove unneeded combined builds artifact
109-
uses: geekyeggo/delete-artifact@v2
142+
- name: Download build artifacts
143+
uses: actions/download-artifact@v3
144+
145+
- name: Create checksum file
146+
run: |
147+
TAG="${{ needs.package-name-prefix.outputs.prefix }}git-snapshot"
148+
declare -a artifacts=($(ls -d */))
149+
for artifact in ${artifacts[@]}
150+
do
151+
cd $artifact
152+
checksum=$(sha256sum ${{ env.PROJECT_NAME }}_${TAG}*)
153+
cd ..
154+
echo $checksum >> ${TAG}-checksums.txt
155+
done
156+
157+
- name: Upload checksum artifact
158+
uses: actions/upload-artifact@v3
110159
with:
111-
name: ${{ env.BUILDS_ARTIFACT }}
160+
path: ./*checksums.txt
161+
name: checksums

‎.github/workflows/release-go-task.yml

Lines changed: 156 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -19,13 +19,28 @@ jobs:
1919
create-release-artifacts:
2020
runs-on: ubuntu-latest
2121

22+
strategy:
23+
matrix:
24+
os:
25+
- Windows_32bit
26+
- Windows_64bit
27+
- Linux_32bit
28+
- Linux_64bit
29+
- Linux_ARMv6
30+
- Linux_ARMv7
31+
- Linux_ARM64
32+
- macOS_64bit
33+
- macOS_ARM64
34+
2235
steps:
2336
- name: Checkout repository
2437
uses: actions/checkout@v3
2538
with:
2639
fetch-depth: 0
2740

2841
- name: Create changelog
42+
# Avoid creating the same changelog for each os
43+
if: matrix.os == 'Windows_32bit'
2944
uses: arduino/create-changelog@v1
3045
with:
3146
tag-regex: '^v[0-9]+\.[0-9]+\.[0-9]+.*$'
@@ -40,16 +55,153 @@ jobs:
4055
version: 3.x
4156

4257
- name: Build
43-
run: task dist:all
58+
run: task dist:${{ matrix.os }}
59+
60+
- name: Upload artifacts
61+
uses: actions/upload-artifact@v3
62+
with:
63+
if-no-files-found: error
64+
name: ${{ env.ARTIFACT_NAME }}
65+
path: ${{ env.DIST_DIR }}
66+
67+
notarize-macos:
68+
name: Notarize ${{ matrix.artifact.name }}
69+
runs-on: macos-latest
70+
needs: create-release-artifacts
71+
outputs:
72+
checksum-darwin_amd64: ${{ steps.re-package.outputs.checksum-darwin_amd64 }}
73+
checksum-darwin_arm64: ${{ steps.re-package.outputs.checksum-darwin_arm64 }}
74+
75+
env:
76+
GON_CONFIG_PATH: gon.config.hcl
77+
78+
strategy:
79+
matrix:
80+
artifact:
81+
- name: darwin_amd64
82+
path: "macOS_64bit.tar.gz"
83+
- name: darwin_arm64
84+
path: "macOS_ARM64.tar.gz"
85+
86+
steps:
87+
- name: Checkout repository
88+
uses: actions/checkout@v3
89+
90+
- name: Download artifacts
91+
uses: actions/download-artifact@v3
92+
with:
93+
name: ${{ env.ARTIFACT_NAME }}
94+
path: ${{ env.DIST_DIR }}
95+
96+
- name: Import Code-Signing Certificates
97+
env:
98+
KEYCHAIN: "sign.keychain"
99+
INSTALLER_CERT_MAC_PATH: "/tmp/ArduinoCerts2020.p12"
100+
# Arbitrary password for a keychain that exists only for the duration of the job, so not secret
101+
KEYCHAIN_PASSWORD: keychainpassword
102+
run: |
103+
echo "${{ secrets.INSTALLER_CERT_MAC_P12 }}" | base64 --decode > "${{ env.INSTALLER_CERT_MAC_PATH }}"
104+
security create-keychain -p "${{ env.KEYCHAIN_PASSWORD }}" "${{ env.KEYCHAIN }}"
105+
security default-keychain -s "${{ env.KEYCHAIN }}"
106+
security unlock-keychain -p "${{ env.KEYCHAIN_PASSWORD }}" "${{ env.KEYCHAIN }}"
107+
security import \
108+
"${{ env.INSTALLER_CERT_MAC_PATH }}" \
109+
-k "${{ env.KEYCHAIN }}" \
110+
-f pkcs12 \
111+
-A \
112+
-T "/usr/bin/codesign" \
113+
-P "${{ secrets.INSTALLER_CERT_MAC_PASSWORD }}"
114+
security set-key-partition-list \
115+
-S apple-tool:,apple: \
116+
-s \
117+
-k "${{ env.KEYCHAIN_PASSWORD }}" \
118+
"${{ env.KEYCHAIN }}"
119+
120+
- name: Install gon for code signing and app notarization
121+
run: |
122+
wget -q https://github.com/mitchellh/gon/releases/download/v0.2.3/gon_macos.zip
123+
unzip gon_macos.zip -d /usr/local/bin
124+
125+
- name: Write gon config to file
126+
# gon does not allow env variables in config file (https://github.com/mitchellh/gon/issues/20)
127+
run: |
128+
cat > "${{ env.GON_CONFIG_PATH }}" <<EOF
129+
# See: https://github.com/mitchellh/gon#configuration-file
130+
source = ["${{ env.DIST_DIR }}/${{ env.PROJECT_NAME }}_osx_${{ matrix.artifact.name }}/${{ env.PROJECT_NAME }}"]
131+
bundle_id = "cc.arduino.${{ env.PROJECT_NAME }}"
132+
133+
sign {
134+
application_identity = "Developer ID Application: ARDUINO SA (7KT7ZWMCJT)"
135+
}
136+
137+
# Ask Gon for zip output to force notarization process to take place.
138+
# The CI will ignore the zip output, using the signed binary only.
139+
zip {
140+
output_path = "unused.zip"
141+
}
142+
EOF
143+
144+
- name: Sign and notarize binary
145+
env:
146+
AC_USERNAME: ${{ secrets.AC_USERNAME }}
147+
AC_PASSWORD: ${{ secrets.AC_PASSWORD }}
148+
run: |
149+
gon "${{ env.GON_CONFIG_PATH }}"
150+
151+
- name: Re-package binary
152+
id: re-package
153+
working-directory: ${{ env.DIST_DIR }}
154+
# Repackage the signed binary replaced in place by Gon (ignoring the output zip file)
155+
run: |
156+
# GitHub's upload/download-artifact actions don't preserve file permissions,
157+
# so we need to add execution permission back until the action is made to do this.
158+
chmod +x "${{ env.PROJECT_NAME }}_osx_${{ matrix.artifact.name }}/${{ env.PROJECT_NAME }}"
159+
TAG="${GITHUB_REF/refs\/tags\//}"
160+
PACKAGE_FILENAME="${{ env.PROJECT_NAME }}_${TAG}_${{ matrix.artifact.path }}"
161+
tar -czvf "$PACKAGE_FILENAME" \
162+
-C "${{ env.PROJECT_NAME }}_osx_${{ matrix.artifact.name }}/" "${{ env.PROJECT_NAME }}" \
163+
-C ../../ LICENSE.txt
164+
echo "PACKAGE_FILENAME=$PACKAGE_FILENAME" >> $GITHUB_ENV
165+
166+
- name: Upload artifact
167+
uses: actions/upload-artifact@v3
168+
with:
169+
if-no-files-found: error
170+
name: ${{ env.ARTIFACT_NAME }}
171+
path: ${{ env.DIST_DIR }}/${{ env.PACKAGE_FILENAME }}
172+
173+
create-release:
174+
runs-on: ubuntu-latest
175+
needs: notarize-macos
176+
177+
steps:
178+
- name: Download artifact
179+
uses: actions/download-artifact@v3
180+
with:
181+
name: ${{ env.ARTIFACT_NAME }}
182+
path: ${{ env.DIST_DIR }}
183+
184+
- name: Create checksum file
185+
working-directory: ${{ env.DIST_DIR}}
186+
run: |
187+
TAG="${GITHUB_REF/refs\/tags\//}"
188+
sha256sum ${{ env.PROJECT_NAME }}_${TAG}* > ${TAG}-checksums.txt
44189
45190
- name: Identify Prerelease
46191
# This is a workaround while waiting for create-release action
47192
# to implement auto pre-release based on tag
48193
id: prerelease
49194
run: |
50-
wget -q -P /tmp https://github.com/fsaintjacques/semver-tool/archive/3.0.0.zip
51-
unzip -p /tmp/3.0.0.zip semver-tool-3.0.0/src/semver >/tmp/semver && chmod +x /tmp/semver
52-
if [[ "$(/tmp/semver get prerel "${GITHUB_REF/refs\/tags\//}")" ]]; then echo "::set-output name=IS_PRE::true"; fi
195+
wget -q -P /tmp https://github.com/fsaintjacques/semver-tool/archive/3.2.0.zip
196+
unzip -p /tmp/3.2.0.zip semver-tool-3.2.0/src/semver >/tmp/semver && chmod +x /tmp/semver
197+
if [[
198+
"$(
199+
/tmp/semver get prerel \
200+
"${GITHUB_REF/refs\/tags\//}"
201+
)"
202+
]]; then
203+
echo "IS_PRE=true" >> $GITHUB_OUTPUT
204+
fi
53205
54206
- name: Create Github Release and upload artifacts
55207
uses: ncipollo/release-action@v1

0 commit comments

Comments
 (0)