Fix Homebrew tap publishing: master→main, fine-grained PAT diagnosis, manual dispatch #125
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| push: | |
| branches: ['**'] | |
| tags: ['v*'] | |
| pull_request: | |
| env: | |
| FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true | |
| jobs: | |
| build-and-test: | |
| runs-on: macos-15 | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Cache SPM dependencies | |
| uses: actions/cache@v4 | |
| with: | |
| path: .build | |
| key: ${{ runner.os }}-spm-${{ hashFiles('Package.resolved') }} | |
| restore-keys: | | |
| ${{ runner.os }}-spm- | |
| - name: Build | |
| run: swift build | |
| - name: Test | |
| run: swift run HeardTests | |
| release: | |
| runs-on: macos-15 | |
| if: startsWith(github.ref, 'refs/tags/v') | |
| needs: build-and-test | |
| permissions: | |
| contents: write | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Cache SPM dependencies | |
| uses: actions/cache@v4 | |
| with: | |
| path: .build | |
| key: ${{ runner.os }}-spm-${{ hashFiles('Package.resolved') }} | |
| restore-keys: | | |
| ${{ runner.os }}-spm- | |
| # Import the Developer ID Application certificate into a temporary keychain. | |
| # security set-key-partition-list is required so codesign can access the key | |
| # non-interactively (without it, codesign hangs waiting for a UI password prompt). | |
| - name: Import Developer ID certificate | |
| env: | |
| APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }} | |
| APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }} | |
| run: | | |
| KEYCHAIN_PWD="$(openssl rand -hex 16)" | |
| echo "KEYCHAIN_PWD=$KEYCHAIN_PWD" >> "$GITHUB_ENV" | |
| security create-keychain -p "$KEYCHAIN_PWD" build.keychain | |
| security default-keychain -s build.keychain | |
| security unlock-keychain -p "$KEYCHAIN_PWD" build.keychain | |
| echo "$APPLE_CERTIFICATE" | base64 --decode > cert.p12 | |
| security import cert.p12 -k build.keychain -P "$APPLE_CERTIFICATE_PASSWORD" -T /usr/bin/codesign | |
| security set-key-partition-list -S apple-tool:,apple:,codesign: -s -k "$KEYCHAIN_PWD" build.keychain | |
| rm -f cert.p12 | |
| - name: Build and notarize DMG | |
| env: | |
| APPLE_DEVELOPER_ID: ${{ secrets.APPLE_DEVELOPER_ID }} | |
| APPLE_API_KEY: ${{ secrets.APPLE_API_KEY }} | |
| APPLE_API_KEY_ID: ${{ secrets.APPLE_API_KEY_ID }} | |
| APPLE_API_ISSUER_ID: ${{ secrets.APPLE_API_ISSUER_ID }} | |
| run: | | |
| mkdir -p ~/.apple | |
| echo "$APPLE_API_KEY" | base64 --decode > ~/.apple/AuthKey.p8 | |
| ./scripts/dmg.sh \ | |
| --sign "$APPLE_DEVELOPER_ID" \ | |
| --api-key-path ~/.apple/AuthKey.p8 \ | |
| --api-key-id "$APPLE_API_KEY_ID" \ | |
| --api-issuer-id "$APPLE_API_ISSUER_ID" \ | |
| --output dist | |
| rm -f ~/.apple/AuthKey.p8 | |
| - name: Collect release metadata | |
| id: meta | |
| run: | | |
| VERSION="${GITHUB_REF_NAME#v}" | |
| DMG="dist/Heard-${VERSION}.dmg" | |
| SHA256=$(shasum -a 256 "$DMG" | awk '{print $1}') | |
| echo "version=${VERSION}" >> "$GITHUB_OUTPUT" | |
| echo "sha256=${SHA256}" >> "$GITHUB_OUTPUT" | |
| echo "dmg=${DMG}" >> "$GITHUB_OUTPUT" | |
| - name: Upload DMG to GitHub Release | |
| uses: softprops/action-gh-release@v2 | |
| with: | |
| files: ${{ steps.meta.outputs.dmg }} | |
| generate_release_notes: true | |
| token: ${{ secrets.GITHUB_TOKEN }} | |
| - name: Update Homebrew cask | |
| run: | | |
| VERSION="${{ steps.meta.outputs.version }}" | |
| SHA256="${{ steps.meta.outputs.sha256 }}" | |
| sed -i '' \ | |
| -e "s/version \"[^\"]*\"/version \"${VERSION}\"/" \ | |
| -e "s/sha256 \"[^\"]*\"/sha256 \"${SHA256}\"/" \ | |
| Casks/heard.rb | |
| # Push the cask update back to main. The release commit is already at main HEAD | |
| # (release.sh pushed it before the tag), so this is always a fast-forward. | |
| # [skip ci] prevents this commit from re-triggering the workflow. | |
| - name: Commit and push cask update | |
| env: | |
| GH_PAT: ${{ secrets.GH_PAT }} | |
| run: | | |
| git config user.name "github-actions[bot]" | |
| git config user.email "github-actions[bot]@users.noreply.github.com" | |
| git add Casks/heard.rb | |
| git commit -m "Update Homebrew cask to v${{ steps.meta.outputs.version }} [skip ci]" | |
| git remote set-url origin "https://execsumo:${GH_PAT}@github.com/execsumo/Heard.git" | |
| git push origin HEAD:refs/heads/main | |
| # Clone the Homebrew tap repo, copy the updated cask, and push so that | |
| # `brew upgrade --cask heard` picks up the new version automatically. | |
| - name: Push cask to Homebrew tap | |
| env: | |
| GH_PAT: ${{ secrets.GH_PAT }} | |
| run: | | |
| VERSION="${{ steps.meta.outputs.version }}" | |
| git clone "https://execsumo:${GH_PAT}@github.com/execsumo/homebrew-heard.git" homebrew-tap | |
| mkdir -p homebrew-tap/Casks | |
| cp Casks/heard.rb homebrew-tap/Casks/heard.rb | |
| cd homebrew-tap | |
| git config user.name "github-actions[bot]" | |
| git config user.email "github-actions[bot]@users.noreply.github.com" | |
| git add Casks/heard.rb | |
| git commit -m "Update heard to v${VERSION}" | |
| git push origin HEAD:refs/heads/main |