main.yml

name: Build Tools

on:
  push:
    branches:
      - oz/ci

jobs:
  build-mac:
    runs-on: macos-latest
    env:
      TAG: ${{ github.ref_name }}
    steps:
      - uses: actions/checkout@v4
      - name: Install dependencies
        run: brew install just ninja
      - name: Clone
        run: just clone
      - name: Prepare
        run: just prepare
      - name: Build alls
        run: just build-all
      - name: Create keychain
        run: |
          printf ${{ secrets.APPLE_P12_BASE64 }} | base64 -d > dev.p12
          security create-keychain -p "${{ secrets.APPLE_TEMPKEYCHAIN_PASSWORD }}" "${{ secrets.APPLE_TEMPKEYCHAIN_NAME }}"
          security list-keychains -d user -s "${{ secrets.APPLE_TEMPKEYCHAIN_NAME }}" $(security list-keychains -d user | tr -d '"')
          security set-keychain-settings "${{ secrets.APPLE_TEMPKEYCHAIN_NAME }}"
          security import dev.p12 -k "${{ secrets.APPLE_TEMPKEYCHAIN_NAME }}" -P "${{ secrets.APPLE_P12_PASSWORD }}" -T "/usr/bin/codesign"
          security set-key-partition-list -S apple-tool:,apple: -s -k "${{ secrets.APPLE_TEMPKEYCHAIN_PASSWORD }}" -D "${{ secrets.APPLE_CODESIGN_IDENTITY }}" -t private ${{ secrets.APPLE_TEMPKEYCHAIN_NAME }}
          security default-keychain -d user -s ${{ secrets.APPLE_TEMPKEYCHAIN_NAME }}
          security unlock-keychain -p ${{ secrets.APPLE_TEMPKEYCHAIN_PASSWORD }} ${{ secrets.APPLE_TEMPKEYCHAIN_NAME }}
      - name: Sign the binary
        run: |
          codesign -o runtime --timestamp -s "${{ secrets.APPLE_CODESIGN_IDENTITY }}" -v ./out/rust/build/aarch64-apple-darwin/llvm/bin/llvm-objcopy
          ditto -c -k ./out/rust/build/aarch64-apple-darwin/llvm/bin/llvm-objcopy llvm-objcopy.zip
      - name: Notarize
        run: |
          xcrun notarytool store-credentials --apple-id shelly@certora.com --password "${{ secrets.APPLE_CRED }}" --team-id "${{ secrets.APPLE_TEAMID }}" altool
          xcrun notarytool submit llvm-objcopy.zip --keychain-profile altool --wait
      - name: Package
        run: just package
      - uses: actions/upload-artifact@v4
        with:
          name: platform-tools-osx-aarch64.tar.bz2
          path: out/platform-tools-osx-aarch64.tar.bz2