From ec83b92c0826c5fb7179e6861d183b7bd7c91087 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Sergio=20G=C3=B3mez=20Bachiller?= Date: Mon, 19 Oct 2026 16:09:46 +0200 Subject: [PATCH] ci(macos): la entrega vuelve a publicar el paquete de macOS Implements #2021: La entrega vuelve a publicar el paquete de macOS - Revierte f785fe37; firma ad hoc y hardened runtime desactivado (ID-548) - El calentador semanal recupera la entrada de macos-14 --- .github/workflows/build.yml | 40 ++++++++++++++++++- .github/workflows/warm-release-cache.yml | 2 +- ...n-apple-silicon-como-tercera-plataforma.md | 3 +- 3 files changed, 41 insertions(+), 4 deletions(-) diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 30635fb9..5e2d2047 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -242,9 +242,40 @@ jobs: if-no-files-found: error retention-days: 1 + # El .dmg de Apple Silicon compila su propia .dylib, como el instalador de Windows (ADR-0040). + macos: + name: DMG de macOS + runs-on: macos-14 + timeout-minutes: 90 + steps: + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + ref: ${{ inputs.ref }} + + - uses: ./.github/actions/setup-runner + with: + rust: release + node: true + java: graalvm + save-cache: false + + - name: Libreria nativa + run: just native + + - name: Empaqueta la .app y el .dmg + run: just bundle + + - name: Sube el .dmg + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + with: + name: bundle-macos + path: rfirma-app/src-tauri/target/aarch64-apple-darwin/release/bundle/dmg/*.dmg + if-no-files-found: error + retention-days: 1 + collect-packages: name: Reune y verifica paquetes - needs: [native-bridge, test-native, flatpak, bundle, windows] + needs: [native-bridge, test-native, flatpak, bundle, windows, macos] if: | always() && !cancelled() && @@ -252,6 +283,7 @@ jobs: needs.test-native.result == 'success' && needs.flatpak.result == 'success' && needs.windows.result == 'success' && + needs.macos.result == 'success' && (needs.bundle.result == 'success' || needs.bundle.result == 'skipped') runs-on: ubuntu-latest timeout-minutes: 10 @@ -285,6 +317,12 @@ jobs: name: bundle-windows path: ${{ runner.temp }}/paquetes + - name: Descarga el .dmg de macOS + uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 + with: + name: bundle-macos + path: ${{ runner.temp }}/paquetes + - name: Descarga bundles nativos (.deb y .rpm) if: needs.native-bridge.outputs.native-packages == 'true' uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 diff --git a/.github/workflows/warm-release-cache.yml b/.github/workflows/warm-release-cache.yml index d358adc1..1ceca735 100644 --- a/.github/workflows/warm-release-cache.yml +++ b/.github/workflows/warm-release-cache.yml @@ -55,7 +55,7 @@ jobs: strategy: fail-fast: false matrix: - include: ${{ fromJSON(github.event.schedule == '37 2 * * *' && '[{"runner":"ubuntu-24.04","timeout":60,"apt":"tauri","java":"none","native":false,"recipe":"build-rust"}]' || github.event_name == 'schedule' && '[{"runner":"windows-latest","timeout":90,"apt":"none","java":"graalvm","native":true,"recipe":"bundle"}]' || '[{"runner":"ubuntu-24.04","timeout":60,"apt":"tauri","java":"none","native":false,"recipe":"build-rust"},{"runner":"windows-latest","timeout":90,"apt":"none","java":"graalvm","native":true,"recipe":"bundle"}]') }} + include: ${{ fromJSON(github.event.schedule == '37 2 * * *' && '[{"runner":"ubuntu-24.04","timeout":60,"apt":"tauri","java":"none","native":false,"recipe":"build-rust"}]' || github.event_name == 'schedule' && '[{"runner":"windows-latest","timeout":90,"apt":"none","java":"graalvm","native":true,"recipe":"bundle"},{"runner":"macos-14","timeout":90,"apt":"none","java":"graalvm","native":true,"recipe":"bundle"}]' || '[{"runner":"ubuntu-24.04","timeout":60,"apt":"tauri","java":"none","native":false,"recipe":"build-rust"},{"runner":"windows-latest","timeout":90,"apt":"none","java":"graalvm","native":true,"recipe":"bundle"},{"runner":"macos-14","timeout":90,"apt":"none","java":"graalvm","native":true,"recipe":"bundle"}]') }} runs-on: ${{ matrix.runner }} timeout-minutes: ${{ matrix.timeout }} defaults: diff --git a/docs/adr/0040-macos-en-apple-silicon-como-tercera-plataforma.md b/docs/adr/0040-macos-en-apple-silicon-como-tercera-plataforma.md index 1fb9ae15..6d35e360 100644 --- a/docs/adr/0040-macos-en-apple-silicon-como-tercera-plataforma.md +++ b/docs/adr/0040-macos-en-apple-silicon-como-tercera-plataforma.md @@ -144,8 +144,7 @@ dependencia en todas las plataformas para algo que en Linux y Windows ya resuelv - El CI tiene un job `macos` en `platforms.yml` que compila la `.dylib`, pasa `rustfmt`, `clippy` y `just test-macos`. Corre en un PR solo si toca algo que solo compila macOS o que cambia cómo se compila allí, o lleva `ci-macos` o `ci-full`, y en `main` en la nocturna (ADR-0014). -- El `.dmg` no se publica en la entrega: `build.yml` no lo construye mientras los adaptadores de - firma estén pendientes, porque un paquete que no puede firmar no sirve a quien lo descarga. + La entrega (`build.yml`) construye el `.dmg` con firma ad hoc y el *hardened runtime* desactivado. - `lib.rs` genera el contexto de Tauri una sola vez en `run` y `event_loop.rs` lo construye: en macOS `generate_context!()` define el `Info.plist` embebido, y llamarla dos veces falla al enlazar. - Los códigos con que macOS rechaza un certificado de sede no reconocido (ADR-0039) se añaden a