051d7ec4f7
Co-authored-by: Mike McQuaid <mike@mikemcquaid.com> Co-authored-by: Carlo Cabrera <30379873+carlocab@users.noreply.github.com>
77 lines
3.7 KiB
YAML
77 lines
3.7 KiB
YAML
name: Build Homebrew installer pkg
|
|
on:
|
|
push:
|
|
paths:
|
|
- .github/workflows/build-pkg.yml
|
|
- package/scripts
|
|
release:
|
|
types:
|
|
- published
|
|
|
|
jobs:
|
|
build:
|
|
if: github.repository_owner == 'Homebrew'
|
|
runs-on: macos-13
|
|
env:
|
|
TEMPORARY_CERTIFICATE_FILE: 'homebrew_developer_id_installer_certificate.p12'
|
|
TEMPORARY_KEYCHAIN_FILE: 'homebrew_installer_signing.keychain-db'
|
|
MIN_MACOS_VERSION: '11.0'
|
|
steps:
|
|
- uses: actions/checkout@v3
|
|
with:
|
|
path: brew
|
|
fetch-depth: 0
|
|
|
|
- name: Get Homebrew version from Git
|
|
id: print-version
|
|
run: echo "version=$(git -C brew describe --tags --always)" >> "${GITHUB_OUTPUT}"
|
|
|
|
- name: Create and unlock temporary macOS keychain
|
|
env:
|
|
PKG_KEYCHAIN_PASSWORD: ${{ secrets.PKG_KEYCHAIN_PASSWORD }}
|
|
run: |
|
|
TEMPORARY_KEYCHAIN_PATH="${RUNNER_TEMP}/${TEMPORARY_KEYCHAIN_FILE}"
|
|
security create-keychain -p "${PKG_KEYCHAIN_PASSWORD}" "${TEMPORARY_KEYCHAIN_PATH}"
|
|
security set-keychain-settings -l -u -t 21600 "${TEMPORARY_KEYCHAIN_PATH}"
|
|
security unlock-keychain -p "${PKG_KEYCHAIN_PASSWORD}" "${TEMPORARY_KEYCHAIN_PATH}"
|
|
|
|
- name: Create temporary certificate file
|
|
env:
|
|
PKG_APPLE_SIGNING_CERTIFICATE_BASE64: ${{ secrets.PKG_APPLE_SIGNING_CERTIFICATE_BASE64 }}
|
|
run: echo -n "${PKG_APPLE_SIGNING_CERTIFICATE_BASE64}" | base64 --decode --output="${RUNNER_TEMP}/${TEMPORARY_CERTIFICATE_FILE}"
|
|
|
|
- name: Import certificate file into macOS keychain
|
|
env:
|
|
PKG_APPLE_SIGNING_CERTIFICATE_PASSWORD: ${{ secrets.PKG_APPLE_SIGNING_CERTIFICATE_PASSWORD }}
|
|
run: security import "${RUNNER_TEMP}/${TEMPORARY_CERTIFICATE_FILE}" -k "${RUNNER_TEMP}/${TEMPORARY_KEYCHAIN_FILE}" -t cert -f pkcs12 -P "${PKG_APPLE_SIGNING_CERTIFICATE_PASSWORD}" -A
|
|
|
|
- name: Clean up temporary certificate file
|
|
if: ${{ always() }}
|
|
run: rm -f "${RUNNER_TEMP}/${TEMPORARY_CERTIFICATE_FILE}"
|
|
|
|
- name: Open macOS keychain
|
|
run: security list-keychain -d user -s "${RUNNER_TEMP}/${TEMPORARY_KEYCHAIN_FILE}"
|
|
|
|
- name: Build Homebrew installer package
|
|
env:
|
|
PKG_APPLE_DEVELOPER_TEAM_ID: ${{ secrets.PKG_APPLE_DEVELOPER_TEAM_ID }}
|
|
# Note: `Library/Homebrew/test/support/fixtures/` contains unsigned
|
|
# binaries so it needs to be excluded from notarization.
|
|
run: pkgbuild --root brew --scripts brew/package/scripts --identifier "sh.brew.homebrew" --version ${{ steps.print-version.outputs.version }} --install-location "/tmp/brew" --filter .DS_Store --filter "(.*)/Library/Homebrew/test/support/fixtures/" --min-os-version "${MIN_MACOS_VERSION}" --sign "${PKG_APPLE_DEVELOPER_TEAM_ID}" Homebrew-${{ steps.print-version.outputs.version }}.pkg
|
|
|
|
- name: Notarize Homebrew installer package
|
|
env:
|
|
PKG_APPLE_DEVELOPER_TEAM_ID: ${{ secrets.PKG_APPLE_DEVELOPER_TEAM_ID }}
|
|
PKG_APPLE_ID_USERNAME: ${{ secrets.PKG_APPLE_ID_USERNAME }}
|
|
PKG_APPLE_ID_APP_SPECIFIC_PASSWORD: ${{ secrets.PKG_APPLE_ID_APP_SPECIFIC_PASSWORD }}
|
|
run: xcrun notarytool submit Homebrew-${{ steps.print-version.outputs.version }}.pkg --team-id "${PKG_APPLE_DEVELOPER_TEAM_ID}" --apple-id "${PKG_APPLE_ID_USERNAME}" --password "${PKG_APPLE_ID_APP_SPECIFIC_PASSWORD}" --wait
|
|
|
|
- name: Clean up temporary macOS keychain
|
|
if: ${{ always() }}
|
|
run: test -f "${RUNNER_TEMP}/${TEMPORARY_KEYCHAIN_FILE}" && security delete-keychain "${RUNNER_TEMP}/${TEMPORARY_KEYCHAIN_FILE}"
|
|
|
|
- uses: actions/upload-artifact@v3
|
|
with:
|
|
name: Homebrew ${{ steps.print-version.outputs.version }}
|
|
path: Homebrew-${{ steps.print-version.outputs.version }}.pkg
|