.github/workflows/release.yml - main - githubmirror/gogs

.github/workflows/release.yml
216 строк9 KB
ᴊᴏᴇ ᴄʜᴇɴ
ci: notarize macOS release archives (#8297)
25 май 2026, 06:08
25 май 2026, 06:08878caa7
name: Release

on:
  release:
    types: [published]
  push:
    branches:
      - main
  pull_request:
    paths:
      - '.github/workflows/release.yml'

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

env:
  GOPROXY: "https://proxy.golang.org"

permissions:
  contents: write

jobs:
  build:
    name: Build ${{ matrix.goos }}/${{ matrix.goarch }}${{ matrix.suffix }}
    if: ${{ github.repository == 'gogs/gogs' }}
    runs-on: ${{ matrix.runner }}
    strategy:
      fail-fast: false
      matrix:
        include:
          - {goos: linux, goarch: amd64, runner: ubuntu-latest}
          - {goos: linux, goarch: arm64, runner: ubuntu-latest}
          - {goos: linux, goarch: "386", runner: ubuntu-latest}
          - {goos: darwin, goarch: amd64, runner: macos-latest}
          - {goos: darwin, goarch: arm64, runner: macos-latest}
          - {goos: windows, goarch: amd64, runner: ubuntu-latest}
          - {goos: windows, goarch: arm64, runner: ubuntu-latest}
          - {goos: windows, goarch: "386", runner: ubuntu-latest}
          - {goos: windows, goarch: amd64, suffix: "_mws", tags: minwinsvc, runner: ubuntu-latest}
          - {goos: windows, goarch: arm64, suffix: "_mws", tags: minwinsvc, runner: ubuntu-latest}
          - {goos: windows, goarch: "386", suffix: "_mws", tags: minwinsvc, runner: ubuntu-latest}
    steps:
      - name: Check out code
        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
      - name: Set up Go
        uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5.5.0
        with:
          go-version: 1.26.x
      - name: Set up pnpm
        uses: pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093 # v6.0.8
      - name: Set up Node
        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
        with:
          node-version: 24
          cache: pnpm
      - name: Build web assets
        run: |
          pnpm install --frozen-lockfile
          pnpm --filter gogs-web run build
      - name: Determine version
        id: version
        run: |
          if [ "${{ github.event_name }}" = "release" ]; then
            echo "version=${{ github.event.release.tag_name }}" | sed 's/version=v/version=/' >> "$GITHUB_OUTPUT"
            echo "release_tag=${{ github.event.release.tag_name }}" >> "$GITHUB_OUTPUT"
          elif [ "${{ github.event_name }}" = "push" ] && [ "${{ github.ref }}" = "refs/heads/main" ]; then
            echo "version=$(git rev-parse --short HEAD)" >> "$GITHUB_OUTPUT"
            echo "release_tag=latest-commit-build" >> "$GITHUB_OUTPUT"
          else
            echo "version=$(git rev-parse --short HEAD)" >> "$GITHUB_OUTPUT"
            echo "release_tag=release-archive-testing" >> "$GITHUB_OUTPUT"
          fi
      - name: Build binary
        env:
          GOOS: ${{ matrix.goos }}
          GOARCH: ${{ matrix.goarch }}
          CGO_ENABLED: "0"
        run: |
          BINARY_NAME="gogs"
          if [ "${{ matrix.goos }}" = "windows" ]; then
            BINARY_NAME="gogs.exe"
          fi

          TAGS="prod"
          if [ -n "${{ matrix.tags }}" ]; then
            TAGS="$TAGS ${{ matrix.tags }}"
          fi

          go build -v \
            -ldflags "
              -X \"gogs.io/gogs/internal/conf.BuildTime=$(date -u '+%Y-%m-%d %I:%M:%S %Z')\"
              -X \"gogs.io/gogs/internal/conf.BuildCommit=$(git rev-parse HEAD)\"
            " \
            -tags "$TAGS" \
            -trimpath -o "$BINARY_NAME" ./cmd/gogs
      - name: Import Apple signing certificate
        if: ${{ matrix.goos == 'darwin' }}
        env:
          APPLE_DEVELOPER_ID_CERTIFICATE_BASE64: ${{ secrets.APPLE_DEVELOPER_ID_CERTIFICATE_BASE64 }}
          APPLE_DEVELOPER_ID_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_DEVELOPER_ID_CERTIFICATE_PASSWORD }}
          APPLE_KEYCHAIN_PASSWORD: ${{ secrets.APPLE_KEYCHAIN_PASSWORD }}
        run: |
          if [ -z "$APPLE_DEVELOPER_ID_CERTIFICATE_BASE64" ] || [ -z "$APPLE_DEVELOPER_ID_CERTIFICATE_PASSWORD" ] || [ -z "$APPLE_KEYCHAIN_PASSWORD" ]; then
            echo "Missing required Apple signing secrets." >&2
            exit 1
          fi

          CERTIFICATE_PATH="$RUNNER_TEMP/developer_id_application.p12"
          KEYCHAIN_PATH="$RUNNER_TEMP/app-signing.keychain-db"

          printf '%s' "$APPLE_DEVELOPER_ID_CERTIFICATE_BASE64" | base64 -d > "$CERTIFICATE_PATH"
          security create-keychain -p "$APPLE_KEYCHAIN_PASSWORD" "$KEYCHAIN_PATH"
          security set-keychain-settings -lut 21600 "$KEYCHAIN_PATH"
          security unlock-keychain -p "$APPLE_KEYCHAIN_PASSWORD" "$KEYCHAIN_PATH"
          security import "$CERTIFICATE_PATH" -P "$APPLE_DEVELOPER_ID_CERTIFICATE_PASSWORD" -A -t cert -f pkcs12 -k "$KEYCHAIN_PATH"
          security list-keychains -d user -s "$KEYCHAIN_PATH"
          security default-keychain -s "$KEYCHAIN_PATH"
          security set-key-partition-list -S apple-tool:,apple:,codesign: -s -k "$APPLE_KEYCHAIN_PASSWORD" "$KEYCHAIN_PATH"
      - name: Sign macOS binary
        if: ${{ matrix.goos == 'darwin' }}
        env:
          APPLE_DEVELOPER_IDENTITY: ${{ secrets.APPLE_DEVELOPER_IDENTITY }}
        run: |
          if [ -z "$APPLE_DEVELOPER_IDENTITY" ]; then
            echo "Missing required Apple signing identity secret." >&2
            exit 1
          fi

          security find-identity -v -p codesigning
          codesign --force --options runtime --timestamp --sign "$APPLE_DEVELOPER_IDENTITY" "gogs"
          codesign --verify --verbose=2 "gogs"
      - name: Prepare archive contents
        run: |
          mkdir -p dist/gogs
          BINARY_NAME="gogs"
          if [ "${{ matrix.goos }}" = "windows" ]; then
            BINARY_NAME="gogs.exe"
          fi
          cp "$BINARY_NAME" dist/gogs/
          cp LICENSE README.md dist/gogs/
          cp -r scripts dist/gogs/
      - name: Create archives
        working-directory: dist
        run: |
          VERSION="${{ steps.version.outputs.version }}"
          ARCHIVE_BASE="gogs_${VERSION}_${{ matrix.goos }}_${{ matrix.goarch }}${{ matrix.suffix }}"

          zip -r "${ARCHIVE_BASE}.zip" gogs

          if [ "${{ matrix.goos }}" = "linux" ]; then
            tar -czvf "${ARCHIVE_BASE}.tar.gz" gogs
          fi
      - name: Notarize macOS archive
        if: ${{ matrix.goos == 'darwin' }}
        env:
          APPLE_NOTARY_ISSUER_ID: ${{ secrets.APPLE_NOTARY_ISSUER_ID }}
          APPLE_NOTARY_KEY_BASE64: ${{ secrets.APPLE_NOTARY_KEY_BASE64 }}
          APPLE_NOTARY_KEY_ID: ${{ secrets.APPLE_NOTARY_KEY_ID }}
        run: |
          if [ -z "$APPLE_NOTARY_ISSUER_ID" ] || [ -z "$APPLE_NOTARY_KEY_BASE64" ] || [ -z "$APPLE_NOTARY_KEY_ID" ]; then
            echo "Missing required Apple notarization secrets." >&2
            exit 1
          fi

          VERSION="${{ steps.version.outputs.version }}"
          ARCHIVE_PATH="dist/gogs_${VERSION}_${{ matrix.goos }}_${{ matrix.goarch }}${{ matrix.suffix }}.zip"
          NOTARY_KEY_PATH="$RUNNER_TEMP/AuthKey_${APPLE_NOTARY_KEY_ID}.p8"

          printf '%s' "$APPLE_NOTARY_KEY_BASE64" | base64 -d > "$NOTARY_KEY_PATH"
          xcrun notarytool submit "$ARCHIVE_PATH" \
            --key "$NOTARY_KEY_PATH" \
            --key-id "$APPLE_NOTARY_KEY_ID" \
            --issuer "$APPLE_NOTARY_ISSUER_ID" \
            --wait
      - name: Upload to release
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          RELEASE_TAG="${{ steps.version.outputs.release_tag }}"

          if [ "${{ github.event_name }}" != "release" ]; then
            git tag -f "$RELEASE_TAG"
            git push origin "$RELEASE_TAG" --force || true

            RELEASE_TITLE="Release archive testing"
            RELEASE_NOTES="Automated testing release for workflow development."
            if [ "$RELEASE_TAG" = "latest-commit-build" ]; then
              RELEASE_TITLE="Latest commit build"
              RELEASE_NOTES="Automated build from the latest commit on main branch. This release is updated automatically with every push to main."
            fi

            gh release view "$RELEASE_TAG" || gh release create "$RELEASE_TAG" --title "$RELEASE_TITLE" --notes "$RELEASE_NOTES" --prerelease
          fi

          PATTERN="_${{ matrix.goos }}_${{ matrix.goarch }}${{ matrix.suffix }}\."
          gh release view "$RELEASE_TAG" --json assets --jq ".assets[].name" | grep "$PATTERN" | while read -r asset; do
            gh release delete-asset "$RELEASE_TAG" "$asset" --yes || true
          done

          gh release upload "$RELEASE_TAG" dist/gogs_*.zip --clobber
          if [ "${{ matrix.goos }}" = "linux" ]; then
            gh release upload "$RELEASE_TAG" dist/gogs_*.tar.gz --clobber
          fi

  notify-failure:
    name: Notify on failure
    runs-on: ubuntu-latest
    needs: [build]
    if: ${{ failure() && github.event_name == 'push' && github.ref == 'refs/heads/main' }}
    steps:
      - name: Send email on failure
        uses: unknwon/send-email-on-failure@89339a1bc93f4ad1d30f3b7e4911fcba985c9adb # v1
        with:
          smtp_username: ${{ secrets.SMTP_USERNAME }}
          smtp_password: ${{ secrets.SMTP_PASSWORD }}