feat(actions): reusable macOS release composites - #1
Conversation
Ship configure-signing, build, export-and-package, notarize-and-validate, and sparkle-release for callers outside thaw-app via thaw-app/org-ci/...@sha.
|
Warning Review limit reached
Next review available in: 46 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Organization UI Review profile: ASSERTIVE Plan: Pro Plus Run ID: 📒 Files selected for processing (3)
📝 WalkthroughWalkthroughAdds documented, SHA-pinned macOS release actions for signing, archiving, DMG packaging, notarization, validation, and Sparkle publication, plus an ActionLint workflow covering action and workflow changes. ChangesmacOS release pipeline
Estimated code review effort: 5 (Critical) | ~120 minutes Sequence Diagram(s)sequenceDiagram
participant Workflow
participant ConfigureSigning
participant Build
participant ExportAndPackage
participant NotarizeAndValidate
participant SparkleRelease
Workflow->>ConfigureSigning: configure signing credentials
Workflow->>Build: archive macOS app
Workflow->>ExportAndPackage: export archive and create signed DMG
Workflow->>NotarizeAndValidate: submit and validate DMG
Workflow->>SparkleRelease: generate and publish Sparkle release
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
There was a problem hiding this comment.
Pull request overview
Adds a set of reusable, parameterized composite GitHub Actions to standardize the macOS Developer ID release pipeline across thaw-app (and external consumer repos), with updated documentation on org-qualified, SHA-pinned usage.
Changes:
- Document org-qualified
uses: thaw-app/org-ci/...@<sha>patterns and action catalog inREADME.md. - Add composite actions for signing setup, Xcode archive build, DMG export/packaging, notarization/validation, and Sparkle release/appcast publishing.
- Default DMG packaging art to
thaw-app/brand-assetswith override inputs.
Reviewed changes
Copilot reviewed 6 out of 6 changed files in this pull request and generated 4 comments.
Show a summary per file
| File | Description |
|---|---|
| README.md | Documents how consumer repos should reference these actions and summarizes available composites. |
| actions/configure-signing/action.yml | Composite for keychain setup, certificate import, and notarytool credential provisioning. |
| actions/build/action.yml | Composite for xcodebuild archive with SwiftPM caching. |
| actions/export-and-package/action.yml | Composite for exporting an archive and creating a signed DMG (optionally fetching brand assets). |
| actions/notarize-and-validate/action.yml | Composite for notarytool submission, stapling, and Gatekeeper validation. |
| actions/sparkle-release/action.yml | Composite for Sparkle ZIP packaging, appcast generation/signing, delta prep, and optional gh-pages publish. |
Comments suppressed due to low confidence (1)
actions/notarize-and-validate/action.yml:40
- This step depends on
jqbeing available on the runner to parse notarytool JSON. That assumption holds on GitHub-hosted macOS runners, but it will fail on self-hosted/minimal images. Usingpython3avoids the extra dependency and keepsset -euo pipefailbehavior.
status=$(echo "$submission" | jq -r '.status')
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| --wait) | ||
| echo "$submission" | ||
|
|
||
| submission_id=$(echo "$submission" | jq -r '.id') |
| uses: thaw-app/org-ci/actions/sparkle-release@<sha> | ||
| ``` | ||
|
|
||
| `export-and-package` defaults to fetching DMG art from the public org repo [`thaw-app/brand-assets`](https://github.com/thaw-app/brand-assets). Override `brand-assets-repository` / `dmg-background` if needed. |
Harden keychain search-list handling for bash 3.2, scrub Sparkle private keys with umask/trap, retry gh-pages pushes, and tighten the build/notarize contracts (workspace support, hardened runtime, env inputs, shared keychain-path).
… Add PlistBuddy cannot Add keys to a missing file; Clear dict first so the export step works after rm -f.
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 5
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/actionlint.yml:
- Around line 17-22: Pin the executable dependencies in the workflow: replace
actions/checkout@v7 with a reviewed full commit SHA and set persist-credentials
to false, then remove the mutable curl-piped actionlint bootstrap from the
“Download actionlint” step and use a released, checksum-verified actionlint
binary or a full-SHA-pinned actionlint action instead.
In `@actions/configure-signing/action.yml`:
- Around line 39-60: Harden the keychain setup around the cert.p12 creation and
security create-keychain commands: remove any existing keychain at the selected
keychain path before creating it, and register a trap immediately after creating
the temporary certificate so it is deleted on success or any subsequent failure.
Preserve the existing import and partition-list flow while ensuring cleanup runs
under set -euo pipefail.
In `@actions/export-and-package/action.yml`:
- Around line 22-29: Update the default value of brand-assets-ref to an
immutable, reviewed tag or commit SHA instead of the floating main branch, while
preserving the existing input description and optional-input behavior.
- Around line 111-121: Update the create-dmg invocation in the packaging step to
tolerate transient hdiutil/Finder “Resource busy” failures by using the
supported --hdiutil-retries option or an equivalent retry loop with backoff.
Ensure the command only fails after the configured retries are exhausted so set
-euo pipefail does not abort codesign on a transient error.
In `@actions/notarize-and-validate/action.yml`:
- Around line 46-55: Update the notarization handling around the notarytool log
invocation and status check so a log-fetch failure cannot bypass the
status-based outcome reporting. Ensure the status from submission is evaluated
and the descriptive “Notarization failed with status” path runs before or
independently of fetching logs, while preserving log retrieval for accepted
submissions.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: d84eb365-e0f2-43cd-a040-469390e86c9d
📒 Files selected for processing (7)
.github/workflows/actionlint.ymlREADME.mdactions/build/action.ymlactions/configure-signing/action.ymlactions/export-and-package/action.ymlactions/notarize-and-validate/action.ymlactions/sparkle-release/action.yml
Delete stale keychains and trap-clean cert.p12; evaluate notary status before log fetch; pin brand-assets-ref and pass --hdiutil-retries.
Summary
actions/thaw-app(e.g.stonerl/Thaw):export-and-packagelinks packaging art to publicthaw-app/brand-assetsby defaultTest plan
action.ymlparsesSummary by CodeRabbit
New Features
Chores