mac-build-manually.yml

# Build the binary release version for Mac

name: Build Crynux Node mac app manually

# Controls when the action will run. Workflow runs when manually triggered using the UI
# or API.
on:
  workflow_dispatch:
    inputs:
      name:
        description: 'build manually trigger'
        required: true
        default: 'triggered by developer'
      home:
        description: 'location'
        required: false
        default: 'The developer team'

env:
  RELEASE_VERSION: 2.5.0
  REGISTRY: ghcr.io
  IMAGE_NAME: ${{ github.repository }}

# A workflow run is made up of one or more jobs that can run sequentially or in parallel
jobs:
  # This workflow contains a single job called "greet"
  build-the-mac-binary:
    # The type of runner that the job will run on
    runs-on: macos-latest

    # Steps represent a sequence of tasks that will be executed as part of the job
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4
        with:
          submodules: recursive

      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: '3.10'

      - name: Setup Go 1.21.x
        uses: actions/setup-go@v5
        with:
          go-version: '1.21.x'

      - name: Set up Node.js
        uses: actions/setup-node@v4
        with:
          node-version: '18.x'

      - name: Install the Apple certificate
        env:
          BUILD_CERTIFICATE_BASE64: ${{ secrets.BUILD_CERTIFICATE_BASE64 }}
          P12_PASSWORD: ${{ secrets.P12_PASSWORD }}
          KEYCHAIN_PASSWORD: ${{ secrets.KEYCHAIN_PASSWORD }}
        run: |
          # create variables
          CERTIFICATE_PATH=$RUNNER_TEMP/build_certificate.p12
          KEYCHAIN_PATH=$RUNNER_TEMP/app-signing.keychain-db

          # import certificate from secrets
          echo -n "$BUILD_CERTIFICATE_BASE64" | base64 --decode -o $CERTIFICATE_PATH

          # create temporary keychain
          security create-keychain -p "$KEYCHAIN_PASSWORD" $KEYCHAIN_PATH
          security set-keychain-settings -lut 21600 $KEYCHAIN_PATH
          security unlock-keychain -p "$KEYCHAIN_PASSWORD" $KEYCHAIN_PATH

          # import certificate to keychain
          security import $CERTIFICATE_PATH -P "$P12_PASSWORD" -A -t cert -f pkcs12 -k $KEYCHAIN_PATH
          security set-key-partition-list -S apple-tool:,apple: -k "$KEYCHAIN_PASSWORD" $KEYCHAIN_PATH
          security list-keychain -d user -s $KEYCHAIN_PATH

      - name: Build
        run: ./build/macos/build.sh -s "${{ secrets.APPLE_DEVELOPER_IDENTITY }}" -u "${{ secrets.APPLE_USER }}" -p "${{ secrets.APPLE_PASS }}" -t "${{ secrets.APPLE_TEAM_ID }}"

      - name:
        id: vars
        shell: bash
        run: |
          echo "sha_short=$(git rev-parse --short HEAD)" >> $GITHUB_OUTPUT

      - name: rename
        shell: bash
        run: |
          mv build/crynux_node/dist/crynux-node-helium-v${{ env.RELEASE_VERSION }}-mac-arm64-signed.dmg build/crynux_node/dist/crynux-node-helium-${{ steps.vars.outputs.sha_short }}-mac-arm64-signed.dmg

      - name: Upload the artifact
        uses: actions/upload-artifact@v4
        with:
          if-no-files-found: error
          name: mac-app
          path: build/crynux_node/dist/crynux-node-helium-${{ steps.vars.outputs.sha_short }}-mac-arm64-signed.dmg