fix: sidebar should not sync btw workspaces (#108) #221
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Build & Release | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.ref }} | |
| cancel-in-progress: true | |
| on: | |
| push: | |
| release: | |
| types: | |
| - created | |
| jobs: | |
| build: | |
| name: Build macOS App | |
| runs-on: self-hosted | |
| permissions: | |
| contents: write | |
| packages: write | |
| actions: write | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@v6 | |
| - name: Setup Xcode | |
| uses: maxim-lobanov/setup-xcode@v1 | |
| with: | |
| xcode-version: latest-stable | |
| - name: Install create-dmg | |
| run: npm install --global create-dmg | |
| - name: Set up Python | |
| uses: actions/setup-python@v6 | |
| with: | |
| python-version: "3.x" | |
| - name: Install Python dependencies | |
| run: pip install markdown | |
| - name: Import code signing certificate | |
| uses: apple-actions/import-codesign-certs@v7 | |
| with: | |
| p12-file-base64: ${{ secrets.BUILD_CERTIFICATE_BASE64 }} | |
| p12-password: ${{ secrets.P12_PASSWORD }} | |
| - name: Install provisioning profile | |
| env: | |
| MACOS_PROVISIONING_PROFILE_BASE64: ${{ secrets.MACOS_PROVISIONING_PROFILE_BASE64 }} | |
| run: | | |
| if [ -z "$MACOS_PROVISIONING_PROFILE_BASE64" ]; then | |
| echo "::error::MACOS_PROVISIONING_PROFILE_BASE64 is required." | |
| exit 1 | |
| fi | |
| PROFILE_PATH="$RUNNER_TEMP/RxCode.provisionprofile" | |
| PROFILE_PLIST="$RUNNER_TEMP/RxCode-profile.plist" | |
| PROFILE_DIR="$HOME/Library/MobileDevice/Provisioning Profiles" | |
| mkdir -p "$PROFILE_DIR" | |
| printf '%s' "$MACOS_PROVISIONING_PROFILE_BASE64" | base64 -D > "$PROFILE_PATH" | |
| openssl cms -inform DER -verify -noverify -in "$PROFILE_PATH" -out "$PROFILE_PLIST" | |
| PROFILE_UUID=$(/usr/libexec/PlistBuddy -c "Print UUID" "$PROFILE_PLIST") | |
| PROFILE_NAME=$(/usr/libexec/PlistBuddy -c "Print Name" "$PROFILE_PLIST") | |
| cp "$PROFILE_PATH" "$PROFILE_DIR/$PROFILE_UUID.provisionprofile" | |
| echo "MACOS_PROFILE_UUID=$PROFILE_UUID" >> "$GITHUB_ENV" | |
| echo "MACOS_PROFILE_SPECIFIER=$PROFILE_NAME" >> "$GITHUB_ENV" | |
| - name: Write Firebase config | |
| env: | |
| FIREBASE_MACOS_B64: ${{ secrets.FIREBASE_MACOS_B64 }} | |
| run: ./scripts/ci/write-firebase-config.sh | |
| - name: Bump version (release only) | |
| if: github.event_name == 'release' | |
| run: | | |
| # Strip leading 'v' from release tag (v1.2.3 -> 1.2.3) — Apple's | |
| # MARKETING_VERSION must be numeric. | |
| RELEASE_VERSION="${GITHUB_REF_NAME#v}" | |
| echo "RELEASE_VERSION=${RELEASE_VERSION}" >> "$GITHUB_ENV" | |
| ./scripts/ci/update-version.sh "${RELEASE_VERSION}" | |
| - name: Build archive | |
| run: | | |
| gem install xcpretty | |
| # CURRENT_PROJECT_VERSION is overridden per-build so every CI build | |
| # has a unique build number (github.run_number), without committing | |
| # churn to project.pbxproj. | |
| # The provisioning profile is scoped to the RxCode target's Release | |
| # build settings in project.pbxproj (PROVISIONING_PROFILE_SPECIFIER), | |
| # NOT passed on the command line. A command-line PROVISIONING_PROFILE* | |
| # applies to every target in the graph — including SPM package targets | |
| # that don't support provisioning profiles — which fails the archive. | |
| # CODE_SIGN_STYLE/IDENTITY stay global: Manual signing needs no team | |
| # and library targets sign with the identity but need no profile. | |
| set -o pipefail | |
| xcodebuild -destination platform=macOS \ | |
| -project RxCode.xcodeproj \ | |
| -scheme RxCode \ | |
| -configuration Release \ | |
| -archivePath output/output.xcarchive \ | |
| -allowProvisioningUpdates \ | |
| CODE_SIGN_IDENTITY="${{ secrets.SIGNING_CERTIFICATE_NAME }}" \ | |
| CODE_SIGN_STYLE=Manual \ | |
| OTHER_CODE_SIGN_FLAGS="--options=runtime --timestamp" \ | |
| CURRENT_PROJECT_VERSION=${{ github.run_number }} \ | |
| archive 2>&1 | tee xcodebuild-archive.log | xcpretty || { | |
| status=${PIPESTATUS[0]} | |
| echo "::group::Full xcodebuild output (archive failed)" | |
| cat xcodebuild-archive.log | |
| echo "::endgroup::" | |
| exit "$status" | |
| } | |
| - name: Sign Sparkle | |
| run: ./scripts/ci/sign-sparkle.sh | |
| env: | |
| SIGNING_CERTIFICATE_NAME: ${{ secrets.SIGNING_CERTIFICATE_NAME }} | |
| - name: Notarize | |
| run: ./scripts/ci/notary.sh | |
| env: | |
| APPLE_ID: ${{ secrets.APPLE_ID }} | |
| APPLE_ID_PWD: ${{ secrets.APPLE_ID_PWD }} | |
| APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }} | |
| - name: Generate appcast | |
| run: ./scripts/ci/generate-appcast.sh | |
| env: | |
| SPARKLE_KEY: ${{ secrets.SPARKLE_KEY }} | |
| VERSION: ${{ github.ref_name }} | |
| BUILD_NUMBER: ${{ github.run_number }} | |
| RELEASE_NOTE: ${{ github.event.release.body }} | |
| # Upload artifact for Pull Requests (1 day retention) | |
| - name: Upload artifact for PR | |
| if: github.event_name == 'pull_request' | |
| uses: actions/upload-artifact@v7 | |
| with: | |
| name: RxCode-PR-${{ github.event.pull_request.number }} | |
| path: RxCode.dmg | |
| retention-days: 1 | |
| # Upload to release for release events | |
| - name: Upload DMG to Release | |
| if: github.event_name == 'release' | |
| uses: softprops/action-gh-release@v3 | |
| with: | |
| files: RxCode.dmg | |
| token: ${{ secrets.GITHUB_TOKEN }} | |
| # Upload appcast as an artifact for the deploy job | |
| - name: Upload appcast for deploy job | |
| if: github.event_name == 'release' | |
| uses: actions/upload-artifact@v7 | |
| with: | |
| name: appcast-${{ github.sha }} | |
| path: appcast.xml | |
| retention-days: 1 | |
| - name: Upload release notes for deploy job | |
| if: github.event_name == 'release' | |
| uses: actions/upload-artifact@v7 | |
| with: | |
| name: release_notes-${{ github.sha }} | |
| path: release_notes.html | |
| retention-days: 1 | |
| deploy: | |
| name: Deploy to GitHub Pages | |
| needs: build | |
| if: github.event_name == 'release' | |
| runs-on: ubuntu-latest | |
| permissions: | |
| pages: write | |
| id-token: write | |
| environment: | |
| name: github-pages | |
| url: ${{ steps.deployment.outputs.page_url }} | |
| steps: | |
| - name: Download appcast from build job | |
| uses: actions/download-artifact@v8 | |
| with: | |
| name: appcast-${{ github.sha }} | |
| - name: Download release notes from build job | |
| uses: actions/download-artifact@v8 | |
| with: | |
| name: release_notes-${{ github.sha }} | |
| - name: Prepare pages directory | |
| run: | | |
| mkdir -p pages | |
| cp appcast.xml pages/ | |
| cp release_notes.html pages/ | |
| # Pin custom domain — without this, deploy-pages strips the CNAME | |
| # GitHub wrote when the domain was set in Settings → Pages. | |
| echo "update.code.rxlab.app" > pages/CNAME | |
| - name: Setup Pages | |
| uses: actions/configure-pages@v6 | |
| - name: Upload pages artifact | |
| uses: actions/upload-pages-artifact@v5 | |
| with: | |
| path: "pages" | |
| - name: Deploy to GitHub Pages | |
| id: deployment | |
| uses: actions/deploy-pages@v5 |