feat(release): add changelog extraction and Homebrew cask update to CI #2
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Release | |
| on: | |
| push: | |
| tags: ["v*"] | |
| branches: ["*-pipeline"] | |
| workflow_dispatch: | |
| jobs: | |
| build: | |
| runs-on: macos-14 | |
| timeout-minutes: 30 | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Build | |
| run: scripts/build_app.sh | |
| - name: Import signing certificate | |
| env: | |
| MACOS_CERTIFICATE: ${{ secrets.MACOS_CERTIFICATE }} | |
| MACOS_CERTIFICATE_PWD: ${{ secrets.MACOS_CERTIFICATE_PWD }} | |
| KEYCHAIN_PWD: ${{ secrets.KEYCHAIN_PWD }} | |
| run: | | |
| echo "$MACOS_CERTIFICATE" | base64 --decode > cert.p12 | |
| security create-keychain -p "$KEYCHAIN_PWD" build.keychain | |
| security default-keychain -s build.keychain | |
| security unlock-keychain -p "$KEYCHAIN_PWD" build.keychain | |
| security set-keychain-settings -t 3600 -l build.keychain | |
| security import cert.p12 -k build.keychain -P "$MACOS_CERTIFICATE_PWD" -T /usr/bin/codesign | |
| security set-key-partition-list -S apple-tool:,apple:,codesign: -s -k "$KEYCHAIN_PWD" build.keychain | |
| rm cert.p12 | |
| - name: Codesign | |
| env: | |
| IDENTITY: ${{ secrets.MACOS_SIGN_IDENTITY }} | |
| run: | | |
| codesign --force --timestamp --options runtime --sign "$IDENTITY" ClearDisk.app | |
| codesign -dvvv ClearDisk.app | |
| - name: Notarize & package | |
| env: | |
| NOTARY_KEY: ${{ secrets.NOTARY_KEY }} | |
| NOTARY_KEY_ID: ${{ secrets.NOTARY_KEY_ID }} | |
| NOTARY_ISSUER: ${{ secrets.NOTARY_ISSUER }} | |
| IDENTITY: ${{ secrets.MACOS_SIGN_IDENTITY }} | |
| run: | | |
| echo "$NOTARY_KEY" | base64 --decode > key.p8 | |
| VERSION=$(grep -m1 -E '^VERSION="[^"]+"' scripts/build_app.sh \ | |
| | sed -E 's/^VERSION="([^"]+)".*/\1/') | |
| DMG="ClearDisk-v${VERSION}.dmg" | |
| mkdir -p dmg-staging | |
| cp -R ClearDisk.app dmg-staging/ | |
| ln -s /Applications dmg-staging/Applications | |
| xattr -cr dmg-staging/ClearDisk.app | |
| hdiutil create -volname "ClearDisk" -srcfolder dmg-staging -ov -format UDZO "$DMG" | |
| codesign --force --timestamp --sign "$IDENTITY" "$DMG" | |
| xcrun notarytool submit "$DMG" \ | |
| --key key.p8 --key-id "$NOTARY_KEY_ID" --issuer "$NOTARY_ISSUER" --wait --timeout 20m | |
| xcrun stapler staple "$DMG" | |
| rm key.p8 | |
| spctl -a -t open --context context:primary-signature -vvv "$DMG" | |
| - name: Upload artifact | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: ClearDisk-dmg | |
| path: ClearDisk-v*.dmg | |
| - name: Extract release notes | |
| if: startsWith(github.ref, 'refs/tags/') | |
| run: | | |
| VERSION=$(grep -m1 -E '^VERSION="[^"]+"' scripts/build_app.sh \ | |
| | sed -E 's/^VERSION="([^"]+)".*/\1/') | |
| awk -v ver="$VERSION" ' | |
| $0 ~ "^## \\[" ver "\\]" { found = 1; next } | |
| found && /^## \[/ { exit } | |
| found { print } | |
| ' CHANGELOG.md | sed -e '/./,$!d' > release-notes.md | |
| cat >> release-notes.md << 'EOF' | |
| --- | |
| ### Install | |
| ```sh | |
| brew tap bysiber/cleardisk | |
| brew trust bysiber/cleardisk | |
| brew install --cask cleardisk | |
| ``` | |
| Or download the DMG below and drag ClearDisk to Applications. | |
| EOF | |
| - name: Publish release | |
| if: startsWith(github.ref, 'refs/tags/') | |
| uses: softprops/action-gh-release@v2 | |
| with: | |
| files: ClearDisk-v*.dmg | |
| body_path: release-notes.md | |
| env: | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| - name: Update Homebrew cask | |
| if: startsWith(github.ref, 'refs/tags/') | |
| env: | |
| GH_TOKEN: ${{ secrets.TAP_TOKEN }} | |
| run: | | |
| SHA=$(shasum -a 256 ClearDisk-v*.dmg | awk '{print $1}') | |
| scripts/brew_update.sh --sha256 "$SHA" |