mirror of
https://github.com/streetwriters/notesnook.git
synced 2026-08-29 10:09:26 +02:00
223 lines
9.5 KiB
YAML
223 lines
9.5 KiB
YAML
name: Notesnook iOS Preview Publish
|
|
|
|
# TRUSTED stage. Runs via `workflow_run` after the build workflow finishes, so
|
|
# it has the base repo's secrets and a write-scoped token. It checks out the
|
|
# BASE repository (never fork code), downloads the unsigned archive the build
|
|
# produced, then signs + distributes it and posts the PR comment. Signing is
|
|
# done directly with `codesign` on the prebuilt archive -- no app build phases
|
|
# run here, so fork code is never executed in this trusted context.
|
|
#
|
|
# Split into two jobs on purpose: signing needs macOS, but the Firebase
|
|
# distribution action is a Docker container action and only runs on Linux.
|
|
|
|
on:
|
|
workflow_run:
|
|
workflows: ["Notesnook iOS Preview Build"]
|
|
types: [completed]
|
|
|
|
jobs:
|
|
export:
|
|
# Only publish previews for builds that actually succeeded.
|
|
if: github.event.workflow_run.conclusion == 'success'
|
|
runs-on: macos-26
|
|
timeout-minutes: 30
|
|
outputs:
|
|
pr_number: ${{ steps.meta.outputs.PR_NUMBER }}
|
|
head_sha: ${{ steps.meta.outputs.HEAD_SHA }}
|
|
|
|
steps:
|
|
- name: Checkout base repo (trusted)
|
|
uses: actions/checkout@v5
|
|
# No `ref` -> checks out the default branch, i.e. trusted base code.
|
|
|
|
- name: Setup Xcode
|
|
uses: maxim-lobanov/setup-xcode@v1
|
|
with:
|
|
xcode-version: "26.1.1"
|
|
|
|
- name: Download build artifact
|
|
uses: actions/download-artifact@v4
|
|
with:
|
|
name: ios-preview-build
|
|
path: ${{ runner.temp }}/artifact
|
|
run-id: ${{ github.event.workflow_run.id }}
|
|
github-token: ${{ secrets.GITHUB_TOKEN }}
|
|
|
|
- name: Load PR metadata & extract archive
|
|
id: meta
|
|
run: |
|
|
set -euo pipefail
|
|
cat "$RUNNER_TEMP/artifact/pr-meta.env" >> "$GITHUB_OUTPUT"
|
|
tar -xzf "$RUNNER_TEMP/artifact/Notesnook.xcarchive.tar.gz" -C "$RUNNER_TEMP"
|
|
|
|
- name: Import signing certificate
|
|
uses: apple-actions/import-codesign-certs@v3
|
|
with:
|
|
p12-file-base64: ${{ secrets.APPLE_CERTIFICATE_P12 }}
|
|
p12-password: ${{ secrets.APPLE_CERTIFICATE_P12_PASSWORD }}
|
|
|
|
- name: Install provisioning profiles
|
|
env:
|
|
PROFILE_APP: ${{ secrets.APPLE_MOBILE_PROVISION_ADHOC_APP }}
|
|
PROFILE_SHARE: ${{ secrets.APPLE_MOBILE_PROVISION_ADHOC_SHARE }}
|
|
PROFILE_WIDGET: ${{ secrets.APPLE_MOBILE_PROVISION_ADHOC_WIDGET }}
|
|
run: |
|
|
set -euo pipefail
|
|
PROFILE_DIR="$HOME/Library/MobileDevice/Provisioning Profiles"
|
|
mkdir -p "$PROFILE_DIR"
|
|
i=0
|
|
for p in "$PROFILE_APP" "$PROFILE_SHARE" "$PROFILE_WIDGET"; do
|
|
echo "$p" | base64 --decode > "$PROFILE_DIR/preview-$i.mobileprovision"
|
|
i=$((i + 1))
|
|
done
|
|
|
|
# Sign the unsigned archive by hand. `xcodebuild -exportArchive` re-signs
|
|
# from the archive's `archived-expanded-entitlements.xcent`, which an
|
|
# unsigned archive does not contain, so it dropped the App Group and the
|
|
# app crashed on launch. Instead we sign each bundle directly, taking the
|
|
# entitlements from each provisioning profile (exactly what Apple
|
|
# provisioned -- App Group, keychain groups with the right team prefix).
|
|
# Runs on macOS but executes NO fork build phases, so it stays trusted.
|
|
- name: Sign IPA
|
|
run: |
|
|
set -euo pipefail
|
|
PROFILES="$HOME/Library/MobileDevice/Provisioning Profiles"
|
|
APP="$(find "$RUNNER_TEMP/Notesnook.xcarchive/Products/Applications" -maxdepth 1 -name '*.app' | head -n1)"
|
|
[ -n "$APP" ] || { echo "::error::No .app in archive"; exit 1; }
|
|
|
|
# Single Apple Distribution identity from the imported keychain.
|
|
IDENTITY="$(security find-identity -v -p codesigning | awk '/Apple Distribution/{print $2; exit}')"
|
|
[ -n "$IDENTITY" ] || { echo "::error::No Apple Distribution identity found"; exit 1; }
|
|
echo "Signing identity: $IDENTITY"
|
|
|
|
TMP="$RUNNER_TEMP/sign"; mkdir -p "$TMP"
|
|
|
|
# Decode a profile's bundle id (application-identifier minus team prefix).
|
|
profile_bundle_id() {
|
|
security cms -D -i "$1" -o "$TMP/_p.plist" 2>/dev/null
|
|
local appid; appid="$(plutil -extract Entitlements.application-identifier raw -o - "$TMP/_p.plist")"
|
|
echo "${appid#*.}"
|
|
}
|
|
# Find the profile matching a bundle id; echoes its path.
|
|
profile_for() {
|
|
local want="$1" p
|
|
for p in "$PROFILES"/*.mobileprovision; do
|
|
[ -e "$p" ] || continue
|
|
[ "$(profile_bundle_id "$p")" = "$want" ] && { echo "$p"; return 0; }
|
|
done
|
|
return 1
|
|
}
|
|
# Embed the matching profile and sign a bundle with the profile's entitlements.
|
|
sign_bundle() {
|
|
local bundle="$1" bid prof ent
|
|
bid="$(/usr/libexec/PlistBuddy -c 'Print :CFBundleIdentifier' "$bundle/Info.plist")"
|
|
prof="$(profile_for "$bid")" || { echo "::error::No provisioning profile for $bid"; exit 1; }
|
|
ent="$TMP/ent-$bid.plist"
|
|
security cms -D -i "$prof" -o "$TMP/_p.plist"
|
|
plutil -extract Entitlements xml1 -o "$ent" "$TMP/_p.plist"
|
|
cp "$prof" "$bundle/embedded.mobileprovision"
|
|
echo "Signing $(basename "$bundle") ($bid)"
|
|
codesign --force --sign "$IDENTITY" --entitlements "$ent" "$bundle"
|
|
}
|
|
|
|
# Sign inside-out: nested code first, then extensions, then the app.
|
|
if [ -d "$APP/Frameworks" ]; then
|
|
find "$APP/Frameworks" -maxdepth 1 \( -name '*.framework' -o -name '*.dylib' \) -print0 \
|
|
| while IFS= read -r -d '' f; do codesign --force --sign "$IDENTITY" "$f"; done
|
|
fi
|
|
if [ -d "$APP/PlugIns" ]; then
|
|
for appex in "$APP/PlugIns"/*.appex; do
|
|
[ -e "$appex" ] || continue
|
|
if [ -d "$appex/Frameworks" ]; then
|
|
find "$appex/Frameworks" -maxdepth 1 \( -name '*.framework' -o -name '*.dylib' \) -print0 \
|
|
| while IFS= read -r -d '' f; do codesign --force --sign "$IDENTITY" "$f"; done
|
|
fi
|
|
sign_bundle "$appex"
|
|
done
|
|
fi
|
|
sign_bundle "$APP"
|
|
|
|
codesign --verify --deep --strict --verbose=2 "$APP"
|
|
|
|
# Package into an IPA.
|
|
rm -rf "$TMP/Payload"; mkdir -p "$TMP/Payload"
|
|
cp -R "$APP" "$TMP/Payload/"
|
|
( cd "$TMP" && zip -qry "$RUNNER_TEMP/Notesnook.ipa" Payload )
|
|
|
|
# Fail fast if the App Group didn't make it into the signed app -- its
|
|
# absence is the launch crash (MMKV nil group path). Never distribute
|
|
# a build without it.
|
|
echo "::group::Signed app entitlements"
|
|
codesign -d --entitlements :- "$APP" 2>/dev/null || true
|
|
echo "::endgroup::"
|
|
codesign -d --entitlements :- "$APP" 2>/dev/null | grep -q "group.org.streetwriters.notesnook" \
|
|
|| { echo "::error::Signed app is missing the App Group entitlement; it would crash on launch."; exit 1; }
|
|
echo "App Group entitlement present."
|
|
|
|
- name: Upload signed IPA
|
|
uses: actions/upload-artifact@v4
|
|
with:
|
|
name: ios-preview-ipa
|
|
path: ${{ runner.temp }}/Notesnook.ipa
|
|
if-no-files-found: error
|
|
retention-days: 1
|
|
|
|
# Must be Linux: wzieba/Firebase-Distribution-Github-Action is a Docker
|
|
# container action, which GitHub only supports on Linux runners.
|
|
distribute:
|
|
needs: export
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 20
|
|
|
|
steps:
|
|
- name: Download signed IPA
|
|
uses: actions/download-artifact@v4
|
|
with:
|
|
name: ios-preview-ipa
|
|
path: ${{ runner.temp }}
|
|
|
|
- name: Publish to Firebase
|
|
id: firebase-output
|
|
uses: wzieba/Firebase-Distribution-Github-Action@v1
|
|
with:
|
|
appId: ${{ secrets.FIREBASE_IOS_APP_ID }}
|
|
serviceCredentialsFileContent: ${{ secrets.QA_SERVICE_ACCOUNT }}
|
|
groups: testers
|
|
file: ${{ runner.temp }}/Notesnook.ipa
|
|
releaseNotes: Preview for https://github.com/${{ github.repository }}/pull/${{ needs.export.outputs.pr_number }}
|
|
|
|
- name: Post or update PR comment
|
|
uses: actions/github-script@v7
|
|
env:
|
|
preview_url: ${{ steps.firebase-output.outputs.TESTING_URI }}
|
|
PR_NUMBER: ${{ needs.export.outputs.pr_number }}
|
|
HEAD_SHA: ${{ needs.export.outputs.head_sha }}
|
|
with:
|
|
script: |
|
|
const marker = '<!-- ios-preview-comment -->';
|
|
const prNumber = Number(process.env.PR_NUMBER);
|
|
if (!prNumber) return;
|
|
const previewUrl = process.env.preview_url || '';
|
|
const body = `${marker}\n**iOS App Preview**\n\n${previewUrl || 'Preview URL unavailable — check workflow logs.'}\n\nCommit: ${process.env.HEAD_SHA}\n`;
|
|
const { data: comments } = await github.rest.issues.listComments({
|
|
owner: context.repo.owner,
|
|
repo: context.repo.repo,
|
|
issue_number: prNumber,
|
|
});
|
|
const existing = comments.find(c => c.body && c.body.includes(marker));
|
|
if (existing) {
|
|
await github.rest.issues.updateComment({
|
|
owner: context.repo.owner,
|
|
repo: context.repo.repo,
|
|
comment_id: existing.id,
|
|
body,
|
|
});
|
|
} else {
|
|
await github.rest.issues.createComment({
|
|
owner: context.repo.owner,
|
|
repo: context.repo.repo,
|
|
issue_number: prNumber,
|
|
body,
|
|
});
|
|
}
|