Update changelog #56
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| push: | |
| branches: | |
| - '**' | |
| tags: | |
| - 'release/*.*.*' | |
| jobs: | |
| test: | |
| name: Test & Lint | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@v4 | |
| - name: Setup Bun | |
| uses: oven-sh/setup-bun@v2 | |
| with: | |
| bun-version: latest | |
| - name: Install dependencies | |
| run: bun install | |
| - name: Install frontend dependencies | |
| run: cd frontend && bun install | |
| - name: Run tests | |
| run: bun run test | |
| env: | |
| GITHUB_ACTIONS: false | |
| - name: Run linting | |
| run: bun run lint | |
| build: | |
| name: Build Binaries | |
| runs-on: ubuntu-latest | |
| needs: test | |
| if: startsWith(github.ref, 'refs/tags/release/') | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@v4 | |
| - name: Setup Bun | |
| uses: oven-sh/setup-bun@v2 | |
| with: | |
| bun-version: latest | |
| - name: Install dependencies | |
| run: bun install | |
| - name: Install frontend dependencies | |
| run: cd frontend && bun install | |
| - name: Build all binaries | |
| run: bun run build | |
| - name: Upload binaries | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: binaries | |
| path: dist/bin/* | |
| retention-days: 1 | |
| sign-macos: | |
| name: Sign & Notarize macOS Binaries | |
| runs-on: macos-latest | |
| needs: build | |
| if: startsWith(github.ref, 'refs/tags/release/') | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@v4 | |
| - name: Download binaries | |
| uses: actions/download-artifact@v4 | |
| with: | |
| name: binaries | |
| path: dist/bin | |
| - name: Install Apple certificate | |
| env: | |
| MACOS_CERTIFICATE: ${{ secrets.MACOS_CERTIFICATE }} | |
| MACOS_CERTIFICATE_PASSWORD: ${{ secrets.MACOS_CERTIFICATE_PASSWORD }} | |
| run: | | |
| CERTIFICATE_PATH=$RUNNER_TEMP/build_certificate.p12 | |
| KEYCHAIN_PATH=$RUNNER_TEMP/app-signing.keychain-db | |
| KEYCHAIN_PASSWORD=$(openssl rand -hex 20) | |
| echo -n "$MACOS_CERTIFICATE" | base64 --decode -o $CERTIFICATE_PATH | |
| security create-keychain -p "$KEYCHAIN_PASSWORD" $KEYCHAIN_PATH | |
| security set-keychain-settings -lut 21600 $KEYCHAIN_PATH | |
| security unlock-keychain -p "$KEYCHAIN_PASSWORD" $KEYCHAIN_PATH | |
| security import $CERTIFICATE_PATH -P "$MACOS_CERTIFICATE_PASSWORD" -A -t cert -f pkcs12 -k $KEYCHAIN_PATH | |
| security set-key-partition-list -S apple-tool:,apple: -k "$KEYCHAIN_PASSWORD" $KEYCHAIN_PATH | |
| security list-keychain -d user -s $KEYCHAIN_PATH | |
| - name: Sign macOS binaries | |
| env: | |
| MACOS_SIGNING_IDENTITY: ${{ secrets.MACOS_SIGNING_IDENTITY }} | |
| run: | | |
| chmod +x dist/bin/context-evaluator-darwin-arm64 | |
| chmod +x dist/bin/context-evaluator-darwin-x64 | |
| codesign --force --options runtime \ | |
| --entitlements entitlements.plist \ | |
| --sign "$MACOS_SIGNING_IDENTITY" \ | |
| --timestamp \ | |
| dist/bin/context-evaluator-darwin-arm64 | |
| codesign --force --options runtime \ | |
| --entitlements entitlements.plist \ | |
| --sign "$MACOS_SIGNING_IDENTITY" \ | |
| --timestamp \ | |
| dist/bin/context-evaluator-darwin-x64 | |
| codesign -dv --verbose=2 dist/bin/context-evaluator-darwin-arm64 | |
| codesign -dv --verbose=2 dist/bin/context-evaluator-darwin-x64 | |
| - name: Notarize macOS binaries | |
| env: | |
| APPLE_ID: ${{ secrets.APPLE_ID }} | |
| APPLE_ID_PASSWORD: ${{ secrets.APPLE_ID_PASSWORD }} | |
| APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }} | |
| run: | | |
| for binary in context-evaluator-darwin-arm64 context-evaluator-darwin-x64; do | |
| zip -j dist/bin/${binary}.zip dist/bin/${binary} | |
| xcrun notarytool submit dist/bin/${binary}.zip \ | |
| --apple-id "$APPLE_ID" \ | |
| --password "$APPLE_ID_PASSWORD" \ | |
| --team-id "$APPLE_TEAM_ID" \ | |
| --wait | |
| rm dist/bin/${binary}.zip | |
| done | |
| - name: Upload signed macOS binaries | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: macos-signed | |
| path: | | |
| dist/bin/context-evaluator-darwin-arm64 | |
| dist/bin/context-evaluator-darwin-x64 | |
| retention-days: 1 | |
| release: | |
| name: Create GitHub Release | |
| runs-on: ubuntu-latest | |
| needs: [build, sign-macos] | |
| if: startsWith(github.ref, 'refs/tags/release/') | |
| permissions: | |
| contents: write | |
| steps: | |
| - name: Download all binaries | |
| uses: actions/download-artifact@v4 | |
| with: | |
| name: binaries | |
| path: dist/bin | |
| - name: Download signed macOS binaries | |
| uses: actions/download-artifact@v4 | |
| with: | |
| name: macos-signed | |
| path: dist/bin | |
| - name: Create GitHub Release | |
| uses: softprops/action-gh-release@v2 | |
| with: | |
| name: ${{ github.ref_name }} | |
| files: dist/bin/* | |
| generate_release_notes: true |