|
|
|
@@ -16,12 +16,15 @@ on:
|
|
|
|
|
- All
|
|
|
|
|
- Binary
|
|
|
|
|
- Android
|
|
|
|
|
- Windows
|
|
|
|
|
- Linux
|
|
|
|
|
- Apple
|
|
|
|
|
- Apple-release
|
|
|
|
|
- iOS
|
|
|
|
|
- macOS
|
|
|
|
|
- tvOS
|
|
|
|
|
- macOS-standalone
|
|
|
|
|
- iOS-jailbreak
|
|
|
|
|
- publish-android
|
|
|
|
|
test_message:
|
|
|
|
|
description: "TestFlight test message"
|
|
|
|
@@ -51,7 +54,7 @@ jobs:
|
|
|
|
|
- name: Setup Go
|
|
|
|
|
uses: actions/setup-go@v5
|
|
|
|
|
with:
|
|
|
|
|
go-version: 1.25.12
|
|
|
|
|
go-version: 1.26.7
|
|
|
|
|
cache: false
|
|
|
|
|
- name: Cache Go modules
|
|
|
|
|
uses: actions/cache/restore@v4
|
|
|
|
@@ -142,7 +145,7 @@ jobs:
|
|
|
|
|
if: ${{ ! matrix.legacy_win7 }}
|
|
|
|
|
uses: actions/setup-go@v5
|
|
|
|
|
with:
|
|
|
|
|
go-version: 1.25.12
|
|
|
|
|
go-version: 1.26.7
|
|
|
|
|
cache: false
|
|
|
|
|
- name: Cache Go modules
|
|
|
|
|
uses: actions/cache/restore@v4
|
|
|
|
@@ -157,7 +160,7 @@ jobs:
|
|
|
|
|
with:
|
|
|
|
|
path: |
|
|
|
|
|
~/go/go_win7
|
|
|
|
|
key: go_win7_12512
|
|
|
|
|
key: go_win7_1267
|
|
|
|
|
- name: Setup Go for Windows 7
|
|
|
|
|
if: matrix.legacy_win7 && steps.cache-go-for-windows7.outputs.cache-hit != 'true'
|
|
|
|
|
env:
|
|
|
|
@@ -485,7 +488,7 @@ jobs:
|
|
|
|
|
if: ${{ ! matrix.legacy_osx }}
|
|
|
|
|
uses: actions/setup-go@v5
|
|
|
|
|
with:
|
|
|
|
|
go-version: ^1.25.3
|
|
|
|
|
go-version: 1.26.7
|
|
|
|
|
cache: false
|
|
|
|
|
- name: Cache Go modules
|
|
|
|
|
uses: actions/cache/restore@v4
|
|
|
|
@@ -500,7 +503,7 @@ jobs:
|
|
|
|
|
with:
|
|
|
|
|
path: |
|
|
|
|
|
~/go/go_osx
|
|
|
|
|
key: go_osx_1258
|
|
|
|
|
key: go_osx_1267
|
|
|
|
|
- name: Setup Go for macOS 10.13
|
|
|
|
|
if: matrix.legacy_osx && steps.cache-go-for-macos1013.outputs.cache-hit != 'true'
|
|
|
|
|
env:
|
|
|
|
@@ -584,7 +587,7 @@ jobs:
|
|
|
|
|
- name: Setup Go
|
|
|
|
|
uses: actions/setup-go@v5
|
|
|
|
|
with:
|
|
|
|
|
go-version: ^1.25.4
|
|
|
|
|
go-version: 1.26.7
|
|
|
|
|
cache: false
|
|
|
|
|
- name: Cache Go modules
|
|
|
|
|
uses: actions/cache@v4
|
|
|
|
@@ -687,7 +690,7 @@ jobs:
|
|
|
|
|
- name: Setup Go
|
|
|
|
|
uses: actions/setup-go@v5
|
|
|
|
|
with:
|
|
|
|
|
go-version: 1.25.12
|
|
|
|
|
go-version: 1.26.7
|
|
|
|
|
cache: false
|
|
|
|
|
- name: Cache Go modules
|
|
|
|
|
uses: actions/cache@v4
|
|
|
|
@@ -751,7 +754,7 @@ jobs:
|
|
|
|
|
- name: Setup Go
|
|
|
|
|
uses: actions/setup-go@v5
|
|
|
|
|
with:
|
|
|
|
|
go-version: 1.25.12
|
|
|
|
|
go-version: 1.26.7
|
|
|
|
|
cache: false
|
|
|
|
|
- name: Cache Go modules
|
|
|
|
|
uses: actions/cache/restore@v4
|
|
|
|
@@ -859,7 +862,7 @@ jobs:
|
|
|
|
|
- name: Setup Go
|
|
|
|
|
uses: actions/setup-go@v5
|
|
|
|
|
with:
|
|
|
|
|
go-version: 1.25.12
|
|
|
|
|
go-version: 1.26.7
|
|
|
|
|
cache: false
|
|
|
|
|
- name: Cache Go modules
|
|
|
|
|
uses: actions/cache/restore@v4
|
|
|
|
@@ -941,10 +944,278 @@ jobs:
|
|
|
|
|
env:
|
|
|
|
|
ANDROID_NDK_HOME: ${{ steps.setup-ndk.outputs.ndk-path }}
|
|
|
|
|
LOCAL_PROPERTIES: ${{ secrets.LOCAL_PROPERTIES }}
|
|
|
|
|
build_windows_client:
|
|
|
|
|
name: Build Windows client (${{ matrix.desktop_arch }})
|
|
|
|
|
if: (github.event_name != 'workflow_dispatch' || inputs.build == 'All' || inputs.build == 'Windows') && github.ref != 'refs/heads/oldstable'
|
|
|
|
|
runs-on: windows-latest
|
|
|
|
|
needs:
|
|
|
|
|
- calculate_version
|
|
|
|
|
strategy:
|
|
|
|
|
fail-fast: false
|
|
|
|
|
matrix:
|
|
|
|
|
include:
|
|
|
|
|
- { desktop_arch: x64, rust_target: x86_64-pc-windows-msvc }
|
|
|
|
|
- { desktop_arch: x86, rust_target: i686-pc-windows-msvc }
|
|
|
|
|
- { desktop_arch: arm64, rust_target: aarch64-pc-windows-msvc }
|
|
|
|
|
steps:
|
|
|
|
|
- name: Checkout
|
|
|
|
|
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5
|
|
|
|
|
with:
|
|
|
|
|
fetch-depth: 1
|
|
|
|
|
- name: Checkout desktop client
|
|
|
|
|
run: git submodule update --init clients/desktop
|
|
|
|
|
- name: Checkout main branch
|
|
|
|
|
if: github.ref == 'refs/heads/stable' && github.event_name != 'workflow_dispatch'
|
|
|
|
|
run: git -C clients/desktop checkout main
|
|
|
|
|
- name: Checkout dev branch
|
|
|
|
|
if: github.ref == 'refs/heads/testing'
|
|
|
|
|
run: git -C clients/desktop checkout dev
|
|
|
|
|
- name: Checkout desktop submodules
|
|
|
|
|
run: git -C clients/desktop submodule update --init --recursive
|
|
|
|
|
- name: Setup Go
|
|
|
|
|
uses: actions/setup-go@v5
|
|
|
|
|
with:
|
|
|
|
|
go-version: 1.26.7
|
|
|
|
|
cache: false
|
|
|
|
|
- name: Cache Go modules
|
|
|
|
|
uses: actions/cache@v4
|
|
|
|
|
with:
|
|
|
|
|
path: ~/go/pkg/mod
|
|
|
|
|
key: go-mod-desktop-windows-${{ hashFiles('go.sum') }}
|
|
|
|
|
restore-keys: go-mod-desktop-windows-
|
|
|
|
|
- name: Setup Rust
|
|
|
|
|
uses: dtolnay/rust-toolchain@1.88.0
|
|
|
|
|
with:
|
|
|
|
|
targets: ${{ matrix.rust_target }}
|
|
|
|
|
- name: Cache Windows sharing module
|
|
|
|
|
uses: actions/cache@v4
|
|
|
|
|
with:
|
|
|
|
|
path: |
|
|
|
|
|
~/.cargo/git
|
|
|
|
|
~/.cargo/registry
|
|
|
|
|
clients/desktop/bin/windows-share-toolchain/cargo-target
|
|
|
|
|
key: windows-share-${{ matrix.rust_target }}-${{ hashFiles('clients/desktop/native/windows-share/Cargo.lock') }}
|
|
|
|
|
restore-keys: windows-share-${{ matrix.rust_target }}-
|
|
|
|
|
- name: Setup pnpm
|
|
|
|
|
uses: pnpm/action-setup@v4
|
|
|
|
|
with:
|
|
|
|
|
package_json_file: clients/desktop/package.json
|
|
|
|
|
- name: Setup Node.js
|
|
|
|
|
uses: actions/setup-node@v4
|
|
|
|
|
with:
|
|
|
|
|
node-version-file: clients/desktop/package.json
|
|
|
|
|
cache: pnpm
|
|
|
|
|
cache-dependency-path: |
|
|
|
|
|
clients/desktop/pnpm-lock.yaml
|
|
|
|
|
clients/desktop/dashboard/pnpm-lock.yaml
|
|
|
|
|
- name: Set tag
|
|
|
|
|
run: |-
|
|
|
|
|
git ls-remote --exit-code --tags origin v${{ needs.calculate_version.outputs.version }}
|
|
|
|
|
if ($LASTEXITCODE -ne 0) {
|
|
|
|
|
"PUBLISHED=false" >> $env:GITHUB_ENV
|
|
|
|
|
}
|
|
|
|
|
git tag v${{ needs.calculate_version.outputs.version }} -f
|
|
|
|
|
- name: Update version
|
|
|
|
|
if: github.event_name == 'workflow_dispatch'
|
|
|
|
|
run: |-
|
|
|
|
|
go run -v ./cmd/internal/update_desktop_version --ci
|
|
|
|
|
- name: Update nightly version
|
|
|
|
|
if: github.event_name != 'workflow_dispatch'
|
|
|
|
|
run: |-
|
|
|
|
|
go run -v ./cmd/internal/update_desktop_version --ci --nightly
|
|
|
|
|
- name: Setup signing
|
|
|
|
|
run: |-
|
|
|
|
|
$certificatePath = Join-Path $env:RUNNER_TEMP "windows-signing.p12"
|
|
|
|
|
[IO.File]::WriteAllBytes($certificatePath, [Convert]::FromBase64String($env:WINDOWS_CERTIFICATES_P12))
|
|
|
|
|
@{
|
|
|
|
|
windows = @{
|
|
|
|
|
certificateFile = $certificatePath
|
|
|
|
|
certificatePassword = $env:WINDOWS_P12_PASSWORD
|
|
|
|
|
}
|
|
|
|
|
} | ConvertTo-Json -Depth 3 | Set-Content -Encoding utf8NoBOM clients/desktop/signing.local.json
|
|
|
|
|
env:
|
|
|
|
|
WINDOWS_CERTIFICATES_P12: ${{ secrets.WINDOWS_CERTIFICATES_P12 }}
|
|
|
|
|
WINDOWS_P12_PASSWORD: ${{ secrets.WINDOWS_P12_PASSWORD }}
|
|
|
|
|
- name: Install dependencies
|
|
|
|
|
run: |-
|
|
|
|
|
pnpm -C clients/desktop install
|
|
|
|
|
- name: Build
|
|
|
|
|
run: |-
|
|
|
|
|
pnpm -C clients/desktop package:win -- ${{ matrix.desktop_arch }}
|
|
|
|
|
env:
|
|
|
|
|
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
|
|
|
|
- name: Prepare upload
|
|
|
|
|
run: |-
|
|
|
|
|
$artifacts = @(Get-ChildItem clients/desktop/release/SFW-*.exe -File)
|
|
|
|
|
if ($artifacts.Count -ne 1) {
|
|
|
|
|
throw "expected 1 Windows installer for ${{ matrix.desktop_arch }}, found $($artifacts.Count)"
|
|
|
|
|
}
|
|
|
|
|
New-Item -ItemType Directory -Force dist | Out-Null
|
|
|
|
|
Copy-Item $artifacts.FullName dist
|
|
|
|
|
- name: Upload artifact
|
|
|
|
|
uses: actions/upload-artifact@v4
|
|
|
|
|
with:
|
|
|
|
|
name: binary-windows-client-${{ matrix.desktop_arch }}
|
|
|
|
|
path: 'dist'
|
|
|
|
|
build_linux_client:
|
|
|
|
|
name: Build Linux client (${{ matrix.desktop_arch }})
|
|
|
|
|
if: (github.event_name != 'workflow_dispatch' || inputs.build == 'All' || inputs.build == 'Linux') && github.ref != 'refs/heads/oldstable'
|
|
|
|
|
runs-on: ubuntu-26.04
|
|
|
|
|
needs:
|
|
|
|
|
- calculate_version
|
|
|
|
|
strategy:
|
|
|
|
|
matrix:
|
|
|
|
|
include:
|
|
|
|
|
- { desktop_arch: x64, go_arch: amd64 }
|
|
|
|
|
- { desktop_arch: arm64, go_arch: arm64 }
|
|
|
|
|
- { desktop_arch: armv7l, go_arch: arm, go_arm: "7" }
|
|
|
|
|
steps:
|
|
|
|
|
- name: Checkout
|
|
|
|
|
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5
|
|
|
|
|
with:
|
|
|
|
|
fetch-depth: 1
|
|
|
|
|
- name: Checkout desktop client
|
|
|
|
|
run: git submodule update --init clients/desktop
|
|
|
|
|
- name: Checkout main branch
|
|
|
|
|
if: github.ref == 'refs/heads/stable' && github.event_name != 'workflow_dispatch'
|
|
|
|
|
run: git -C clients/desktop checkout main
|
|
|
|
|
- name: Checkout dev branch
|
|
|
|
|
if: github.ref == 'refs/heads/testing'
|
|
|
|
|
run: git -C clients/desktop checkout dev
|
|
|
|
|
- name: Checkout desktop submodules
|
|
|
|
|
run: git -C clients/desktop submodule update --init --recursive
|
|
|
|
|
- name: Setup Go
|
|
|
|
|
uses: actions/setup-go@v5
|
|
|
|
|
with:
|
|
|
|
|
go-version: 1.26.7
|
|
|
|
|
cache: false
|
|
|
|
|
- name: Cache Go modules
|
|
|
|
|
uses: actions/cache@v4
|
|
|
|
|
with:
|
|
|
|
|
path: ~/go/pkg/mod
|
|
|
|
|
key: go-mod-desktop-linux-${{ hashFiles('go.sum') }}
|
|
|
|
|
restore-keys: go-mod-desktop-linux-
|
|
|
|
|
- name: Setup pnpm
|
|
|
|
|
uses: pnpm/action-setup@v4
|
|
|
|
|
with:
|
|
|
|
|
package_json_file: clients/desktop/package.json
|
|
|
|
|
- name: Setup Node.js
|
|
|
|
|
uses: actions/setup-node@v4
|
|
|
|
|
with:
|
|
|
|
|
node-version-file: clients/desktop/package.json
|
|
|
|
|
cache: pnpm
|
|
|
|
|
cache-dependency-path: |
|
|
|
|
|
clients/desktop/pnpm-lock.yaml
|
|
|
|
|
clients/desktop/dashboard/pnpm-lock.yaml
|
|
|
|
|
- name: Set tag
|
|
|
|
|
run: |-
|
|
|
|
|
git ls-remote --exit-code --tags origin v${{ needs.calculate_version.outputs.version }} || echo "PUBLISHED=false" >> "$GITHUB_ENV"
|
|
|
|
|
git tag v${{ needs.calculate_version.outputs.version }} -f
|
|
|
|
|
- name: Update version
|
|
|
|
|
if: github.event_name == 'workflow_dispatch'
|
|
|
|
|
run: |-
|
|
|
|
|
go run -v ./cmd/internal/update_desktop_version --ci
|
|
|
|
|
- name: Update nightly version
|
|
|
|
|
if: github.event_name != 'workflow_dispatch'
|
|
|
|
|
run: |-
|
|
|
|
|
go run -v ./cmd/internal/update_desktop_version --ci --nightly
|
|
|
|
|
- name: Clone cronet-go
|
|
|
|
|
run: |-
|
|
|
|
|
set -xeuo pipefail
|
|
|
|
|
CRONET_GO_VERSION=$(cat .github/CRONET_GO_VERSION)
|
|
|
|
|
git init ~/cronet-go
|
|
|
|
|
git -C ~/cronet-go remote add origin https://github.com/sagernet/cronet-go.git
|
|
|
|
|
git -C ~/cronet-go fetch --depth=1 origin "$CRONET_GO_VERSION"
|
|
|
|
|
git -C ~/cronet-go checkout FETCH_HEAD
|
|
|
|
|
git -C ~/cronet-go submodule update --init --recursive --depth=1
|
|
|
|
|
- name: Regenerate Debian keyring
|
|
|
|
|
run: |-
|
|
|
|
|
set -xeuo pipefail
|
|
|
|
|
rm -f ~/cronet-go/naiveproxy/src/build/linux/sysroot_scripts/keyring.gpg
|
|
|
|
|
cd ~/cronet-go
|
|
|
|
|
GPG_TTY=/dev/null ./naiveproxy/src/build/linux/sysroot_scripts/generate_keyring.sh
|
|
|
|
|
- name: Download Chromium toolchain
|
|
|
|
|
run: |-
|
|
|
|
|
set -xeuo pipefail
|
|
|
|
|
cd ~/cronet-go
|
|
|
|
|
go run ./cmd/build-naive --target=linux/${{ matrix.go_arch }} download-toolchain
|
|
|
|
|
- name: Set Chromium toolchain environment
|
|
|
|
|
run: |-
|
|
|
|
|
set -xeuo pipefail
|
|
|
|
|
cd ~/cronet-go
|
|
|
|
|
go run ./cmd/build-naive --target=linux/${{ matrix.go_arch }} env >> "$GITHUB_ENV"
|
|
|
|
|
- name: Install package tools
|
|
|
|
|
run: |-
|
|
|
|
|
set -euo pipefail
|
|
|
|
|
sudo apt-get update || true
|
|
|
|
|
sudo apt-get install -y debsigs libarchive-tools rpm zstd
|
|
|
|
|
echo '%_rpmformat 4' > "$HOME/.rpmmacros"
|
|
|
|
|
- name: Install dependencies
|
|
|
|
|
run: |-
|
|
|
|
|
pnpm -C clients/desktop install
|
|
|
|
|
- name: Build
|
|
|
|
|
run: |-
|
|
|
|
|
pnpm -C clients/desktop package:linux -- deb rpm pacman ${{ matrix.desktop_arch }}
|
|
|
|
|
env:
|
|
|
|
|
CGO_ENABLED: "0"
|
|
|
|
|
GOARM: ${{ matrix.go_arm }}
|
|
|
|
|
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
|
|
|
|
- name: Setup package signing
|
|
|
|
|
run: |-
|
|
|
|
|
set -euo pipefail
|
|
|
|
|
SIGNING_GNUPG_HOME="$RUNNER_TEMP/package-signing-gnupg"
|
|
|
|
|
SIGNING_PASSPHRASE_FILE="$RUNNER_TEMP/package-signing-passphrase"
|
|
|
|
|
mkdir -m 700 "$SIGNING_GNUPG_HOME"
|
|
|
|
|
printf '%s' "$GPG_PASSPHRASE" > "$SIGNING_PASSPHRASE_FILE"
|
|
|
|
|
chmod 600 "$SIGNING_PASSPHRASE_FILE"
|
|
|
|
|
{
|
|
|
|
|
echo "GNUPGHOME=$SIGNING_GNUPG_HOME"
|
|
|
|
|
echo "SIGNING_PASSPHRASE_FILE=$SIGNING_PASSPHRASE_FILE"
|
|
|
|
|
} >> "$GITHUB_ENV"
|
|
|
|
|
printf '%s' "$GPG_KEY" | gpg \
|
|
|
|
|
--homedir "$SIGNING_GNUPG_HOME" \
|
|
|
|
|
--batch \
|
|
|
|
|
--pinentry-mode loopback \
|
|
|
|
|
--passphrase-file "$SIGNING_PASSPHRASE_FILE" \
|
|
|
|
|
--import
|
|
|
|
|
cat > "$HOME/.rpmmacros" <<EOF
|
|
|
|
|
%_gpg_name $GPG_KEY_ID
|
|
|
|
|
%_gpg_sign_cmd_extra_args --pinentry-mode loopback --passphrase-file $SIGNING_PASSPHRASE_FILE
|
|
|
|
|
EOF
|
|
|
|
|
env:
|
|
|
|
|
GPG_KEY: ${{ secrets.GPG_KEY }}
|
|
|
|
|
GPG_KEY_ID: ${{ secrets.GPG_KEY_ID }}
|
|
|
|
|
GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }}
|
|
|
|
|
- name: Sign Linux packages
|
|
|
|
|
run: |-
|
|
|
|
|
set -euo pipefail
|
|
|
|
|
debsigs \
|
|
|
|
|
--sign=origin \
|
|
|
|
|
-k "$GPG_KEY_ID" \
|
|
|
|
|
--gpgopts "--batch --pinentry-mode loopback --passphrase-file $SIGNING_PASSPHRASE_FILE" \
|
|
|
|
|
clients/desktop/release/SFL-*.deb
|
|
|
|
|
rpmsign --addsign clients/desktop/release/SFL-*.rpm
|
|
|
|
|
env:
|
|
|
|
|
GPG_KEY_ID: ${{ secrets.GPG_KEY_ID }}
|
|
|
|
|
- name: Prepare upload
|
|
|
|
|
run: |-
|
|
|
|
|
shopt -s nullglob
|
|
|
|
|
artifacts=(clients/desktop/release/SFL-*.deb clients/desktop/release/SFL-*.rpm clients/desktop/release/SFL-*.pkg.tar.zst)
|
|
|
|
|
if (( ${#artifacts[@]} != 3 )); then
|
|
|
|
|
echo "expected 3 Linux packages, found ${#artifacts[@]}" >&2
|
|
|
|
|
exit 1
|
|
|
|
|
fi
|
|
|
|
|
mkdir -p dist
|
|
|
|
|
cp "${artifacts[@]}" dist
|
|
|
|
|
- name: Upload artifact
|
|
|
|
|
uses: actions/upload-artifact@v4
|
|
|
|
|
with:
|
|
|
|
|
name: binary-linux-client-${{ matrix.desktop_arch }}
|
|
|
|
|
path: 'dist'
|
|
|
|
|
build_apple_library:
|
|
|
|
|
name: Build Apple library (${{ matrix.artifact }})
|
|
|
|
|
runs-on: ${{ matrix.build && 'macos-26' || 'ubuntu-latest' }}
|
|
|
|
|
if: github.event_name != 'workflow_dispatch' || inputs.build == 'All' || inputs.build == 'Apple' || inputs.build == 'Apple-release' || inputs.build == 'iOS' || inputs.build == 'macOS' || inputs.build == 'tvOS' || inputs.build == 'macOS-standalone'
|
|
|
|
|
if: github.event_name != 'workflow_dispatch' || inputs.build == 'All' || inputs.build == 'Apple' || inputs.build == 'Apple-release' || inputs.build == 'iOS' || inputs.build == 'macOS' || inputs.build == 'tvOS' || inputs.build == 'macOS-standalone' || inputs.build == 'iOS-jailbreak'
|
|
|
|
|
needs:
|
|
|
|
|
- calculate_version
|
|
|
|
|
strategy:
|
|
|
|
@@ -953,7 +1224,7 @@ jobs:
|
|
|
|
|
include:
|
|
|
|
|
- artifact: ios-arm64
|
|
|
|
|
platform: ios/arm64
|
|
|
|
|
build: ${{ github.event_name != 'workflow_dispatch' || inputs.build == 'All' || inputs.build == 'Apple' || inputs.build == 'Apple-release' || inputs.build == 'iOS' }}
|
|
|
|
|
build: ${{ github.event_name != 'workflow_dispatch' || inputs.build == 'All' || inputs.build == 'Apple' || inputs.build == 'Apple-release' || inputs.build == 'iOS' || inputs.build == 'iOS-jailbreak' }}
|
|
|
|
|
- artifact: tvos-arm64
|
|
|
|
|
platform: tvos/arm64
|
|
|
|
|
build: ${{ github.event_name == 'workflow_dispatch' && (inputs.build == 'All' || inputs.build == 'Apple' || inputs.build == 'tvOS') }}
|
|
|
|
@@ -973,7 +1244,7 @@ jobs:
|
|
|
|
|
if: matrix.build
|
|
|
|
|
uses: actions/setup-go@v5
|
|
|
|
|
with:
|
|
|
|
|
go-version: 1.25.12
|
|
|
|
|
go-version: 1.26.7
|
|
|
|
|
cache: false
|
|
|
|
|
- name: Cache Go modules
|
|
|
|
|
if: matrix.build
|
|
|
|
@@ -987,8 +1258,8 @@ jobs:
|
|
|
|
|
uses: actions/cache@v4
|
|
|
|
|
with:
|
|
|
|
|
path: ~/Library/Caches/go-build
|
|
|
|
|
key: libbox-go-build-${{ matrix.artifact }}-1.25.12-${{ hashFiles('go.sum') }}
|
|
|
|
|
restore-keys: libbox-go-build-${{ matrix.artifact }}-1.25.12-
|
|
|
|
|
key: libbox-go-build-${{ matrix.artifact }}-1.26.7-${{ hashFiles('go.sum') }}
|
|
|
|
|
restore-keys: libbox-go-build-${{ matrix.artifact }}-1.26.7-
|
|
|
|
|
- name: Set tag
|
|
|
|
|
if: matrix.build
|
|
|
|
|
run: git tag v${{ needs.calculate_version.outputs.version }} -f
|
|
|
|
@@ -1010,7 +1281,7 @@ jobs:
|
|
|
|
|
build_apple:
|
|
|
|
|
name: Build Apple release clients
|
|
|
|
|
runs-on: ${{ matrix.if && 'macos-26' || 'ubuntu-latest' }}
|
|
|
|
|
if: github.event_name != 'workflow_dispatch' || inputs.build == 'All' || inputs.build == 'Apple-release' || inputs.build == 'macOS-standalone'
|
|
|
|
|
if: github.event_name != 'workflow_dispatch' || inputs.build == 'All' || inputs.build == 'Apple-release' || inputs.build == 'macOS-standalone' || inputs.build == 'iOS-jailbreak'
|
|
|
|
|
needs:
|
|
|
|
|
- calculate_version
|
|
|
|
|
- build_apple_library
|
|
|
|
@@ -1028,6 +1299,20 @@ jobs:
|
|
|
|
|
destination: ''
|
|
|
|
|
archive: ''
|
|
|
|
|
upload: ''
|
|
|
|
|
upload_extension: ''
|
|
|
|
|
altool_platform: ''
|
|
|
|
|
- name: iOS-jailbreak
|
|
|
|
|
if: ${{ github.event_name != 'workflow_dispatch' || inputs.build == 'All' || inputs.build == 'Apple-release' || inputs.build == 'iOS-jailbreak' }}
|
|
|
|
|
type: jailbreak
|
|
|
|
|
platform: ios
|
|
|
|
|
variant: ''
|
|
|
|
|
library_arch: ''
|
|
|
|
|
scheme: ''
|
|
|
|
|
destination: ''
|
|
|
|
|
archive: ''
|
|
|
|
|
upload: ''
|
|
|
|
|
upload_extension: ''
|
|
|
|
|
altool_platform: ''
|
|
|
|
|
steps: &build_apple_steps
|
|
|
|
|
- name: Checkout
|
|
|
|
|
if: matrix.if
|
|
|
|
@@ -1041,7 +1326,7 @@ jobs:
|
|
|
|
|
if: matrix.if
|
|
|
|
|
uses: actions/setup-go@v5
|
|
|
|
|
with:
|
|
|
|
|
go-version: 1.25.12
|
|
|
|
|
go-version: 1.26.7
|
|
|
|
|
cache: false
|
|
|
|
|
- name: Cache Go modules
|
|
|
|
|
if: matrix.if
|
|
|
|
@@ -1092,29 +1377,25 @@ jobs:
|
|
|
|
|
- name: Setup App Store Connect key
|
|
|
|
|
if: matrix.if && matrix.type != 'jailbreak' && github.event_name == 'workflow_dispatch'
|
|
|
|
|
run: |-
|
|
|
|
|
ASC_KEY_PATH=$RUNNER_TEMP/AuthKey.p8
|
|
|
|
|
# altool selects individual key authentication by the ApiKey_ file name prefix;
|
|
|
|
|
# an AuthKey_ prefixed file is signed as a team key and rejected.
|
|
|
|
|
ASC_PRIVATE_KEYS_DIR=$RUNNER_TEMP/private_keys
|
|
|
|
|
mkdir -p $ASC_PRIVATE_KEYS_DIR
|
|
|
|
|
ASC_KEY_PATH=$ASC_PRIVATE_KEYS_DIR/ApiKey_$ASC_KEY_ID.p8
|
|
|
|
|
echo -n "$ASC_KEY" | base64 --decode -o $ASC_KEY_PATH
|
|
|
|
|
echo "API_PRIVATE_KEYS_DIR=$ASC_PRIVATE_KEYS_DIR" >> "$GITHUB_ENV"
|
|
|
|
|
echo "ASC_KEY_PATH=$ASC_KEY_PATH" >> "$GITHUB_ENV"
|
|
|
|
|
echo "ASC_KEY_ID=$ASC_KEY_ID" >> "$GITHUB_ENV"
|
|
|
|
|
echo "ASC_KEY_ISSUER_ID=$ASC_KEY_ISSUER_ID" >> "$GITHUB_ENV"
|
|
|
|
|
env:
|
|
|
|
|
ASC_KEY: ${{ secrets.ASC_KEY }}
|
|
|
|
|
ASC_KEY_ID: ${{ secrets.ASC_KEY_ID }}
|
|
|
|
|
ASC_KEY_ISSUER_ID: ${{ secrets.ASC_KEY_ISSUER_ID }}
|
|
|
|
|
- name: Install Apple provisioning profiles
|
|
|
|
|
if: matrix.if && matrix.type != 'jailbreak'
|
|
|
|
|
run: |-
|
|
|
|
|
PROFILES_ZIP_PATH=$RUNNER_TEMP/AppleProvisioningProfiles.zip
|
|
|
|
|
printf '%s%s%s%s%s%s%s%s' \
|
|
|
|
|
"$PROVISIONING_PROFILES_1" \
|
|
|
|
|
"$PROVISIONING_PROFILES_2" \
|
|
|
|
|
"$PROVISIONING_PROFILES_3" \
|
|
|
|
|
"$PROVISIONING_PROFILES_4" \
|
|
|
|
|
"$PROVISIONING_PROFILES_5" \
|
|
|
|
|
"$PROVISIONING_PROFILES_6" \
|
|
|
|
|
"$PROVISIONING_PROFILES_7" \
|
|
|
|
|
"$PROVISIONING_PROFILES_8" \
|
|
|
|
|
| base64 --decode -o $PROFILES_ZIP_PATH
|
|
|
|
|
for variable in $(compgen -v | grep -E '^PROVISIONING_PROFILES_[0-9]+$' | sort -t_ -k3 -n); do
|
|
|
|
|
printf '%s' "${!variable}"
|
|
|
|
|
done | base64 --decode -o $PROFILES_ZIP_PATH
|
|
|
|
|
PROFILES_PATH="$HOME/Library/Developer/Xcode/UserData/Provisioning Profiles"
|
|
|
|
|
mkdir -p "$PROFILES_PATH"
|
|
|
|
|
unzip -q $PROFILES_ZIP_PATH -d "$PROFILES_PATH"
|
|
|
|
@@ -1127,6 +1408,14 @@ jobs:
|
|
|
|
|
PROVISIONING_PROFILES_6: ${{ secrets.APPLE_PROVISIONING_PROFILES_6 }}
|
|
|
|
|
PROVISIONING_PROFILES_7: ${{ secrets.APPLE_PROVISIONING_PROFILES_7 }}
|
|
|
|
|
PROVISIONING_PROFILES_8: ${{ secrets.APPLE_PROVISIONING_PROFILES_8 }}
|
|
|
|
|
PROVISIONING_PROFILES_9: ${{ secrets.APPLE_PROVISIONING_PROFILES_9 }}
|
|
|
|
|
PROVISIONING_PROFILES_10: ${{ secrets.APPLE_PROVISIONING_PROFILES_10 }}
|
|
|
|
|
PROVISIONING_PROFILES_11: ${{ secrets.APPLE_PROVISIONING_PROFILES_11 }}
|
|
|
|
|
PROVISIONING_PROFILES_12: ${{ secrets.APPLE_PROVISIONING_PROFILES_12 }}
|
|
|
|
|
PROVISIONING_PROFILES_13: ${{ secrets.APPLE_PROVISIONING_PROFILES_13 }}
|
|
|
|
|
PROVISIONING_PROFILES_14: ${{ secrets.APPLE_PROVISIONING_PROFILES_14 }}
|
|
|
|
|
PROVISIONING_PROFILES_15: ${{ secrets.APPLE_PROVISIONING_PROFILES_15 }}
|
|
|
|
|
PROVISIONING_PROFILES_16: ${{ secrets.APPLE_PROVISIONING_PROFILES_16 }}
|
|
|
|
|
- name: Setup Apple Development certificate
|
|
|
|
|
if: matrix.if && matrix.type != 'jailbreak'
|
|
|
|
|
run: |-
|
|
|
|
@@ -1165,14 +1454,33 @@ jobs:
|
|
|
|
|
DEVELOPER_ID_CERTIFICATES_P12: ${{ secrets.DEVELOPER_ID_CERTIFICATES_P12 }}
|
|
|
|
|
P12_PASSWORD: ${{ secrets.DEVELOPER_ID_P12_PASSWORD }}
|
|
|
|
|
KEYCHAIN_PASSWORD: ${{ secrets.APPLE_KEYCHAIN_PASSWORD }}
|
|
|
|
|
- name: Setup Apple Distribution certificate
|
|
|
|
|
if: matrix.if && matrix.type == 'app-store'
|
|
|
|
|
run: |-
|
|
|
|
|
CERTIFICATE_PATH=$RUNNER_TEMP/AppleDistributionCertificates.p12
|
|
|
|
|
KEYCHAIN_PATH=$RUNNER_TEMP/apple-distribution.keychain-db
|
|
|
|
|
echo -n "$APPLE_DISTRIBUTION_CERTIFICATES_P12" | base64 --decode -o $CERTIFICATE_PATH
|
|
|
|
|
security create-keychain -p "$KEYCHAIN_PASSWORD" $KEYCHAIN_PATH
|
|
|
|
|
security set-keychain-settings -lut 21600 $KEYCHAIN_PATH
|
|
|
|
|
security unlock-keychain -p "$KEYCHAIN_PASSWORD" $KEYCHAIN_PATH
|
|
|
|
|
security import $CERTIFICATE_PATH -P "$P12_PASSWORD" -A -t cert -f pkcs12 -k $KEYCHAIN_PATH
|
|
|
|
|
security set-key-partition-list -S apple-tool:,apple: -k "$KEYCHAIN_PASSWORD" $KEYCHAIN_PATH
|
|
|
|
|
security list-keychains -d user -s $KEYCHAIN_PATH $APPLE_DEVELOPMENT_KEYCHAIN_PATH
|
|
|
|
|
security default-keychain -d user -s $KEYCHAIN_PATH
|
|
|
|
|
security find-identity -v -p codesigning $KEYCHAIN_PATH
|
|
|
|
|
env:
|
|
|
|
|
APPLE_DISTRIBUTION_CERTIFICATES_P12: ${{ secrets.APPLE_DISTRIBUTION_CERTIFICATES_P12 }}
|
|
|
|
|
P12_PASSWORD: ${{ secrets.APPLE_DISTRIBUTION_P12_PASSWORD }}
|
|
|
|
|
KEYCHAIN_PASSWORD: ${{ secrets.APPLE_KEYCHAIN_PASSWORD }}
|
|
|
|
|
- name: Setup notarization credentials
|
|
|
|
|
if: matrix.if && matrix.type == 'standalone' && github.event_name == 'workflow_dispatch'
|
|
|
|
|
run: |-
|
|
|
|
|
security unlock-keychain -p "$KEYCHAIN_PASSWORD" $SIGNING_KEYCHAIN_PATH
|
|
|
|
|
xcrun notarytool store-credentials "notarytool-password" \
|
|
|
|
|
# store-credentials prompts for the issuer ID even when --issuer is absent;
|
|
|
|
|
# an empty answer selects individual key authentication.
|
|
|
|
|
printf '\n' | xcrun notarytool store-credentials "notarytool-password" \
|
|
|
|
|
--key $ASC_KEY_PATH \
|
|
|
|
|
--key-id $ASC_KEY_ID \
|
|
|
|
|
--issuer $ASC_KEY_ISSUER_ID \
|
|
|
|
|
--keychain $SIGNING_KEYCHAIN_PATH
|
|
|
|
|
env:
|
|
|
|
|
KEYCHAIN_PASSWORD: ${{ secrets.APPLE_KEYCHAIN_PASSWORD }}
|
|
|
|
@@ -1206,16 +1514,17 @@ jobs:
|
|
|
|
|
go run ./cmd/internal/merge_apple_xcframework \
|
|
|
|
|
-output clients/apple/Libbox.xcframework \
|
|
|
|
|
"${library_inputs[@]}"
|
|
|
|
|
- name: Update macOS version
|
|
|
|
|
if: matrix.if && matrix.name == 'macOS' && github.event_name == 'workflow_dispatch'
|
|
|
|
|
- name: Update project version
|
|
|
|
|
if: matrix.if && matrix.type == 'app-store' && github.event_name == 'workflow_dispatch'
|
|
|
|
|
run: |-
|
|
|
|
|
MACOS_PROJECT_VERSION=$(go run -v ./cmd/internal/app_store_connect next_macos_project_version)
|
|
|
|
|
echo "MACOS_PROJECT_VERSION=$MACOS_PROJECT_VERSION"
|
|
|
|
|
echo "MACOS_PROJECT_VERSION=$MACOS_PROJECT_VERSION" >> "$GITHUB_ENV"
|
|
|
|
|
PROJECT_VERSION_VARIABLE=$(echo "${{ matrix.platform }}" | tr '[:lower:]' '[:upper:]')_PROJECT_VERSION
|
|
|
|
|
PROJECT_VERSION=$(go run -v ./cmd/internal/app_store_connect next_project_version ${{ matrix.platform }})
|
|
|
|
|
echo "$PROJECT_VERSION_VARIABLE=$PROJECT_VERSION"
|
|
|
|
|
echo "$PROJECT_VERSION_VARIABLE=$PROJECT_VERSION" >> "$GITHUB_ENV"
|
|
|
|
|
- name: Update version
|
|
|
|
|
if: matrix.if && matrix.name != 'iOS'
|
|
|
|
|
if: matrix.if
|
|
|
|
|
run: |-
|
|
|
|
|
go run -v ./cmd/internal/update_apple_version --ci
|
|
|
|
|
go run -v ./cmd/internal/update_apple_version --ci ${{ matrix.type == 'app-store' && '--testflight' || '' }}
|
|
|
|
|
- name: Archive App Store build
|
|
|
|
|
if: matrix.if && matrix.type == 'app-store'
|
|
|
|
|
run: |-
|
|
|
|
@@ -1236,10 +1545,14 @@ jobs:
|
|
|
|
|
cd clients/apple
|
|
|
|
|
xcodebuild -exportArchive \
|
|
|
|
|
-archivePath "${{ matrix.archive }}" \
|
|
|
|
|
-exportOptionsPlist ${{ matrix.upload }} \
|
|
|
|
|
-authenticationKeyPath $ASC_KEY_PATH \
|
|
|
|
|
-authenticationKeyID $ASC_KEY_ID \
|
|
|
|
|
-authenticationKeyIssuerID $ASC_KEY_ISSUER_ID
|
|
|
|
|
-exportPath "$RUNNER_TEMP/export" \
|
|
|
|
|
-exportOptionsPlist ${{ matrix.upload }}
|
|
|
|
|
# altool requires --api-issuer even for an individual key, and ignores its value.
|
|
|
|
|
xcrun altool --upload-app \
|
|
|
|
|
-f "$RUNNER_TEMP"/export/*.${{ matrix.upload_extension }} \
|
|
|
|
|
-t ${{ matrix.altool_platform }} \
|
|
|
|
|
--api-key $ASC_KEY_ID \
|
|
|
|
|
--api-issuer 00000000-0000-0000-0000-000000000000
|
|
|
|
|
- name: Publish to TestFlight
|
|
|
|
|
if: matrix.if && matrix.type == 'app-store' && github.event_name == 'workflow_dispatch' && github.ref == 'refs/heads/testing'
|
|
|
|
|
run: |-
|
|
|
|
@@ -1314,7 +1627,9 @@ jobs:
|
|
|
|
|
scheme: SFI
|
|
|
|
|
destination: 'generic/platform=iOS'
|
|
|
|
|
archive: build/SFI.xcarchive
|
|
|
|
|
upload: SFI/Upload.plist
|
|
|
|
|
upload: SFI/AppStoreExport.plist
|
|
|
|
|
upload_extension: ipa
|
|
|
|
|
altool_platform: ios
|
|
|
|
|
variant: ''
|
|
|
|
|
library_arch: ''
|
|
|
|
|
- name: macOS
|
|
|
|
@@ -1324,7 +1639,9 @@ jobs:
|
|
|
|
|
scheme: SFM
|
|
|
|
|
destination: 'generic/platform=macOS'
|
|
|
|
|
archive: build/SFM.xcarchive
|
|
|
|
|
upload: SFI/Upload.plist
|
|
|
|
|
upload: SFI/AppStoreExport.plist
|
|
|
|
|
upload_extension: pkg
|
|
|
|
|
altool_platform: macos
|
|
|
|
|
variant: ''
|
|
|
|
|
library_arch: ''
|
|
|
|
|
- name: tvOS
|
|
|
|
@@ -1334,13 +1651,15 @@ jobs:
|
|
|
|
|
scheme: SFT
|
|
|
|
|
destination: 'generic/platform=tvOS'
|
|
|
|
|
archive: build/SFT.xcarchive
|
|
|
|
|
upload: SFI/Upload.plist
|
|
|
|
|
upload: SFI/AppStoreExport.plist
|
|
|
|
|
upload_extension: ipa
|
|
|
|
|
altool_platform: appletvos
|
|
|
|
|
variant: ''
|
|
|
|
|
library_arch: ''
|
|
|
|
|
steps: *build_apple_steps
|
|
|
|
|
upload:
|
|
|
|
|
name: Upload builds
|
|
|
|
|
if: "!failure() && github.event_name == 'workflow_dispatch' && (inputs.build == 'All' || inputs.build == 'Binary' || inputs.build == 'Android' || inputs.build == 'Apple-release' || inputs.build == 'macOS-standalone')"
|
|
|
|
|
if: "!failure() && github.event_name == 'workflow_dispatch' && (inputs.build == 'All' || inputs.build == 'Binary' || inputs.build == 'Android' || inputs.build == 'Windows' || inputs.build == 'Linux' || inputs.build == 'Apple-release' || inputs.build == 'macOS-standalone' || inputs.build == 'iOS-jailbreak')"
|
|
|
|
|
runs-on: ubuntu-latest
|
|
|
|
|
permissions:
|
|
|
|
|
contents: write
|
|
|
|
@@ -1354,6 +1673,8 @@ jobs:
|
|
|
|
|
- build_windows
|
|
|
|
|
- build_android_library
|
|
|
|
|
- build_android
|
|
|
|
|
- build_windows_client
|
|
|
|
|
- build_linux_client
|
|
|
|
|
- build_apple_library
|
|
|
|
|
- build_apple
|
|
|
|
|
steps:
|
|
|
|
@@ -1416,6 +1737,8 @@ jobs:
|
|
|
|
|
- build_windows
|
|
|
|
|
- build_android_library
|
|
|
|
|
- build_android
|
|
|
|
|
- build_windows_client
|
|
|
|
|
- build_linux_client
|
|
|
|
|
- build_apple_library
|
|
|
|
|
- build_apple
|
|
|
|
|
- build_apple_app_store
|
|
|
|
|
Shtorm