groundcontrol/.github/workflows/macos.yml at master · Robiotec/groundcontrol · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
name: MacOS

on:
  push:
    branches:
      - master
      - 'Stable*'
    tags:
      - 'v*'
    paths-ignore:
      - 'docs/**'
  pull_request:
  merge_group:
  workflow_dispatch:
    inputs:
      build_type:
        description: 'Build type'
        required: false
        default: 'Release'
        type: choice
        options:
          - Release
          - Debug

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: ${{ github.ref != 'refs/heads/master' }}

permissions:
  contents: read
  actions: read

jobs:
  changes:
    uses: ./.github/workflows/_detect-changes.yml
    with:
      platform: macos

  build:
    needs: changes
    if: needs.changes.outputs.should_build == 'true'
    runs-on: macos-15
    timeout-minutes: 120

    # id-token/attestations scoped here: only the attestation upload step needs them.
    permissions:
      contents: read
      actions: read
      id-token: write
      attestations: write

    strategy:
      fail-fast: false
      matrix:
        build_type: ['${{ inputs.build_type || ''Release'' }}']

    defaults:
      run:
        shell: bash

    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@v2
        with:
          egress-policy: audit

      - name: Checkout repo
        uses: actions/checkout@v7
        with:
          fetch-depth: ${{ github.event_name == 'pull_request' && 1 || 0 }}
          persist-credentials: false

      - name: Build Setup
        id: setup
        uses: ./.github/actions/build-setup
        with:
          qt-host: mac
          qt-arch: clang_64
          build-type: ${{ matrix.build_type }}

      - name: Install Dependencies
        uses: ./.github/actions/install-dependencies

      - name: CMake configure
        uses: ./.github/actions/cmake-configure
        with:
          build-dir: ${{ runner.temp }}/build
          build-type: ${{ matrix.build_type }}
          extra-args: -DQGC_MACOS_SIGN_WITH_IDENTITY=${{ github.event_name != 'pull_request' && 'ON' || 'OFF' }}

      - name: Build
        uses: ./.github/actions/cmake-build
        with:
          build-dir: ${{ runner.temp }}/build
          build-type: ${{ matrix.build_type }}

      - name: Verify dev build executable
        uses: ./.github/actions/verify-executable
        with:
          binary-path: ${{ runner.temp }}/build/${{ matrix.build_type }}/QGroundControl.app/Contents/MacOS/QGroundControl
          build-dir: ${{ runner.temp }}/build

      - name: Import Code Signing Certificate
        if: github.event_name != 'pull_request'
        uses: apple-actions/import-codesign-certs@v7
        with:
          p12-file-base64: ${{ secrets.MACOS_CERT_P12_BASE64 }}
          p12-password: ${{ secrets.MACOS_CERT_P12_PASSWORD }}

      # PRs configure with QGC_MACOS_SIGN_WITH_IDENTITY=OFF, so the signing env vars are unused there — leaving them resolved-but-empty is harmless and lets us avoid duplicating the install step.
      - name: Create app bundle
        uses: ./.github/actions/cmake-install
        with:
          build-dir: ${{ runner.temp }}/build
          build-type: ${{ matrix.build_type }}
        env:
          QGC_MACOS_SIGNING_IDENTITY: ${{ secrets.MACOS_SIGNING_IDENTITY }}
          QGC_MACOS_NOTARIZATION_USERNAME: ${{ secrets.MACOS_NOTARIZATION_USERNAME }}
          QGC_MACOS_NOTARIZATION_PASSWORD: ${{ secrets.MACOS_NOTARIZATION_PASSWORD }}
          QGC_MACOS_NOTARIZATION_TEAM_ID: ${{ secrets.MACOS_NOTARIZATION_TEAM_ID }}

      - name: Mount DMG
        working-directory: ${{ runner.temp }}/build
        run: |
          if ! hdiutil attach QGroundControl.dmg; then
            echo "::error::Failed to mount DMG"
            ls -la QGroundControl.dmg 2>/dev/null || echo "DMG file not found"
            exit 1
          fi

      - name: Verify DMG executable
        uses: ./.github/actions/verify-executable
        with:
          binary-path: /Volumes/QGroundControl/QGroundControl.app/Contents/MacOS/QGroundControl

      - name: Attest and Upload
        if: matrix.build_type == 'Release'
        uses: ./.github/actions/attest-and-upload
        with:
          artifact-name: QGroundControl.dmg
          package-name: QGroundControl
          aws-role-arn: ${{ secrets.AWS_ROLE_ARN }}
          aws-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
          aws-distribution-id: ${{ secrets.AWS_DISTRIBUTION_ID }}