Skip to content

Commit 48f4feb

Browse files
theoephraimtheoephraim
committed
gh actions changes
1 parent 4cbbc7c commit 48f4feb

13 files changed

Lines changed: 499 additions & 137 deletions

‎.github/workflows/binary-release.yaml‎

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,9 @@ on:
1212
release:
1313
types: [published]
1414

15+
permissions:
16+
contents: read
17+
1518
concurrency: ${{ github.workflow }}-${{ github.ref }}
1619

1720
jobs:
@@ -24,10 +27,35 @@ jobs:
2427
run: |
2528
echo "$GITHUB_CONTEXT"
2629
30+
# Build and sign the macOS native binary (cache hit if already built in CI)
31+
build-native-macos:
32+
if: github.event_name == 'workflow_dispatch' || startsWith(github.ref_name, 'varlock@')
33+
uses: ./.github/workflows/build-native-macos.yaml
34+
with:
35+
mode: release
36+
version: ${{ github.event_name == 'workflow_dispatch' && inputs.version || github.ref_name }}
37+
artifact-name: native-bin-macos-signed
38+
secrets:
39+
OP_CI_TOKEN: ${{ secrets.OP_CI_TOKEN }}
40+
41+
# Notarize the signed binary for production distribution
42+
notarize-native-macos:
43+
needs: build-native-macos
44+
if: github.event_name == 'workflow_dispatch' || startsWith(github.ref_name, 'varlock@')
45+
uses: ./.github/workflows/notarize-native-macos.yaml
46+
with:
47+
source-artifact-name: native-bin-macos-signed
48+
artifact-name: native-bin-macos-release
49+
secrets:
50+
OP_CI_TOKEN: ${{ secrets.OP_CI_TOKEN }}
51+
2752
release-binaries:
53+
needs: notarize-native-macos
2854
# was using github.ref.tag_name, but it seems that when publishing multiple tags at once, it was behaving weirdly
2955
if: github.event_name == 'workflow_dispatch' || startsWith(github.ref_name, 'varlock@')
3056
runs-on: ubuntu-latest
57+
permissions:
58+
contents: write
3159
steps:
3260
- uses: actions/checkout@v6
3361
- name: Setup Bun
@@ -63,6 +91,15 @@ jobs:
6391
echo "RELEASE_TAG=varlock@${{ inputs.version }}" >> $GITHUB_ENV
6492
echo "RELEASE_VERSION=${{ inputs.version }}" >> $GITHUB_ENV
6593
94+
# Download the signed macOS native binary
95+
- name: Download macOS native binary
96+
uses: actions/download-artifact@v8
97+
with:
98+
name: native-bin-macos-release
99+
path: packages/varlock/native-bins/darwin/VarlockEnclave.app
100+
- name: Restore native binary execute permission
101+
run: chmod +x packages/varlock/native-bins/darwin/VarlockEnclave.app/Contents/MacOS/varlock-local-encrypt
102+
66103
- name: build libs
67104
run: bun run build:libs
68105
env:

‎.github/workflows/build-native-macos.yaml‎

Lines changed: 142 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,142 @@
1+
name: Build macOS native binary
2+
3+
# Reusable workflow that compiles, bundles, and Developer ID signs the
4+
# VarlockEnclave Swift binary on a macOS runner.
5+
#
6+
# The Swift .build directory is cached by source hash, so the compile
7+
# step (~minutes) is near-instant on cache hit. The .app bundle wrapping
8+
# (plist, icon, signing) always runs since it varies by mode/version.
9+
#
10+
# Notarization is intentionally NOT included here — it's a separate
11+
# workflow for production releases.
12+
13+
permissions:
14+
contents: read
15+
16+
on:
17+
workflow_call:
18+
inputs:
19+
mode:
20+
description: 'Build mode: dev, preview, or release (affects bundle metadata)'
21+
type: string
22+
default: 'preview'
23+
version:
24+
description: 'Bundle version string (e.g. 1.2.3)'
25+
type: string
26+
default: '0.0.0-preview'
27+
artifact-name:
28+
description: 'Name for the uploaded artifact'
29+
type: string
30+
default: 'native-bin-macos'
31+
secrets:
32+
OP_CI_TOKEN:
33+
required: true
34+
35+
jobs:
36+
build-swift-binary:
37+
runs-on: macos-latest
38+
steps:
39+
- uses: actions/checkout@v6
40+
41+
- name: Setup Bun
42+
uses: oven-sh/setup-bun@v2
43+
44+
# skip bun dep caching since less likely to hit
45+
46+
- name: Install node deps
47+
run: bun install
48+
49+
- name: Enable turborepo build cache
50+
uses: rharkor/caching-for-turbo@v2.3.11
51+
52+
# Cache the Swift .build directory so compilation is fast on unchanged source
53+
- name: Compute Swift source hash
54+
id: swift-hash
55+
run: |
56+
HASH=$(find packages/encryption-binary-swift/swift -type f | sort | xargs shasum -a 256 | shasum -a 256 | cut -d' ' -f1)
57+
echo "hash=$HASH" >> $GITHUB_OUTPUT
58+
echo "Swift source hash: $HASH"
59+
60+
- name: Cache Swift build artifacts
61+
uses: actions/cache@v5
62+
with:
63+
path: packages/encryption-binary-swift/swift/.build
64+
key: varlock-swift-build-${{ steps.swift-hash.outputs.hash }}
65+
66+
# Build varlock JS so we can use it to resolve secrets from 1Password
67+
- name: Build varlock libs
68+
run: bun run build:libs
69+
70+
# Load secrets from 1Password via varlock (scoped to the Swift package)
71+
- name: Load signing secrets
72+
uses: dmno-dev/varlock-action@v1.0.1
73+
with:
74+
working-directory: packages/encryption-binary-swift
75+
env:
76+
OP_CI_TOKEN: ${{ secrets.OP_CI_TOKEN }}
77+
78+
# Import signing certificate into a temporary keychain
79+
- name: Import signing certificate
80+
run: |
81+
KEYCHAIN_PATH=$RUNNER_TEMP/signing.keychain-db
82+
KEYCHAIN_PASSWORD=$(openssl rand -base64 24)
83+
84+
echo "$APPLE_CERTIFICATE_BASE64" | base64 --decode > $RUNNER_TEMP/certificate.p12
85+
86+
security create-keychain -p "$KEYCHAIN_PASSWORD" "$KEYCHAIN_PATH"
87+
security set-keychain-settings -lut 21600 "$KEYCHAIN_PATH"
88+
security unlock-keychain -p "$KEYCHAIN_PASSWORD" "$KEYCHAIN_PATH"
89+
90+
security import $RUNNER_TEMP/certificate.p12 \
91+
-P "$APPLE_CERTIFICATE_PASSWORD" \
92+
-A -t cert -f pkcs12 \
93+
-k "$KEYCHAIN_PATH"
94+
95+
security set-key-partition-list -S apple-tool:,apple:,codesign: \
96+
-s -k "$KEYCHAIN_PASSWORD" "$KEYCHAIN_PATH"
97+
98+
security list-keychains -d user -s "$KEYCHAIN_PATH" login.keychain-db
99+
100+
echo "APPLE_SIGNING_IDENTITY=$APPLE_SIGNING_IDENTITY" >> $GITHUB_ENV
101+
102+
# Compile (cached), bundle with mode-specific metadata, and sign
103+
- name: Build, bundle, and sign
104+
run: |
105+
bun run --filter @varlock/encryption-binary-swift build:swift \
106+
-- --mode ${{ inputs.mode }} --version ${{ inputs.version }} --sign "$APPLE_SIGNING_IDENTITY"
107+
108+
- name: Verify binary
109+
run: |
110+
APP_PATH="packages/varlock/native-bins/darwin/VarlockEnclave.app"
111+
echo "=== App bundle contents ==="
112+
ls -la "$APP_PATH/Contents/MacOS/"
113+
echo "=== Binary architectures ==="
114+
lipo -info "$APP_PATH/Contents/MacOS/varlock-local-encrypt"
115+
echo "=== Code signature ==="
116+
codesign -dvv "$APP_PATH" 2>&1 || true
117+
echo "=== Info.plist ==="
118+
cat "$APP_PATH/Contents/Info.plist"
119+
120+
- name: Upload native binary artifact
121+
uses: actions/upload-artifact@v7
122+
with:
123+
name: ${{ inputs.artifact-name }}
124+
path: packages/varlock/native-bins/darwin/VarlockEnclave.app
125+
retention-days: 7
126+
127+
# Cache the signed .app so other jobs (e.g. release-preview) can restore
128+
# it on a Linux runner without needing a macOS build
129+
- name: Cache signed .app bundle
130+
uses: actions/cache/save@v5
131+
with:
132+
path: packages/varlock/native-bins/darwin/VarlockEnclave.app
133+
key: native-bin-macos-signed-${{ hashFiles('packages/encryption-binary-swift/swift/**') }}
134+
135+
- name: Cleanup signing keychain
136+
if: always()
137+
run: |
138+
KEYCHAIN_PATH=$RUNNER_TEMP/signing.keychain-db
139+
if [ -f "$KEYCHAIN_PATH" ]; then
140+
security delete-keychain "$KEYCHAIN_PATH" || true
141+
fi
142+
rm -f $RUNNER_TEMP/certificate.p12

‎.github/workflows/notarize-native-macos.yaml‎

Lines changed: 91 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,91 @@
1+
name: Notarize macOS native binary
2+
3+
# Reusable workflow that takes an already-signed .app bundle artifact,
4+
# submits it to Apple for notarization, and staples the ticket.
5+
# Requires a macOS runner for xcrun.
6+
7+
permissions:
8+
contents: read
9+
10+
on:
11+
workflow_call:
12+
inputs:
13+
source-artifact-name:
14+
description: 'Name of the signed .app artifact to notarize'
15+
type: string
16+
required: true
17+
artifact-name:
18+
description: 'Name for the notarized artifact'
19+
type: string
20+
default: 'native-bin-macos-notarized'
21+
secrets:
22+
OP_CI_TOKEN:
23+
required: true
24+
25+
jobs:
26+
notarize:
27+
runs-on: macos-latest
28+
steps:
29+
- uses: actions/checkout@v6
30+
31+
- name: Setup Bun
32+
uses: oven-sh/setup-bun@v2
33+
34+
# skip bun dep caching since less likely to hit
35+
36+
- name: Install node deps
37+
run: bun install
38+
39+
- name: Enable turborepo build cache
40+
uses: rharkor/caching-for-turbo@v2.3.11
41+
42+
- name: Build varlock libs
43+
run: bun run build:libs
44+
45+
- name: Download signed .app bundle
46+
uses: actions/download-artifact@v8
47+
with:
48+
name: ${{ inputs.source-artifact-name }}
49+
path: VarlockEnclave.app
50+
51+
# Load secrets from 1Password via varlock (scoped to the Swift package)
52+
- name: Load signing secrets
53+
uses: dmno-dev/varlock-action@v1.0.1
54+
with:
55+
working-directory: packages/encryption-binary-swift
56+
env:
57+
OP_CI_TOKEN: ${{ secrets.OP_CI_TOKEN }}
58+
59+
- name: Notarize and staple
60+
working-directory: packages/encryption-binary-swift
61+
run: |
62+
APP_PATH="$GITHUB_WORKSPACE/VarlockEnclave.app"
63+
64+
# Create a zip for notarization submission
65+
ditto -c -k --keepParent "$APP_PATH" $RUNNER_TEMP/VarlockEnclave.zip
66+
67+
# Submit for notarization and wait
68+
xcrun notarytool submit $RUNNER_TEMP/VarlockEnclave.zip \
69+
--apple-id "$APPLE_ID" \
70+
--password "$APPLE_APP_PASSWORD" \
71+
--team-id "$APPLE_TEAM_ID" \
72+
--wait
73+
74+
# Staple the notarization ticket to the app bundle
75+
xcrun stapler staple "$APP_PATH"
76+
env:
77+
OP_CI_TOKEN: ${{ secrets.OP_CI_TOKEN }}
78+
79+
- name: Verify notarization
80+
run: |
81+
echo "=== Code signature ==="
82+
codesign -dvv VarlockEnclave.app 2>&1 || true
83+
echo "=== Notarization staple ==="
84+
xcrun stapler validate VarlockEnclave.app
85+
86+
- name: Upload notarized artifact
87+
uses: actions/upload-artifact@v7
88+
with:
89+
name: ${{ inputs.artifact-name }}
90+
path: VarlockEnclave.app
91+
retention-days: 7

‎.github/workflows/release-preview.yaml‎

Lines changed: 0 additions & 46 deletions
This file was deleted.

‎.github/workflows/release.yaml‎

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,11 +5,34 @@ on:
55
branches:
66
- main
77

8+
permissions:
9+
contents: read
10+
811
concurrency: ${{ github.workflow }}-${{ github.ref }}
912

1013
jobs:
14+
# Build and sign the macOS native binary (cache hit if already built in CI)
15+
build-native-macos:
16+
uses: ./.github/workflows/build-native-macos.yaml
17+
with:
18+
mode: release
19+
artifact-name: native-bin-macos-signed
20+
secrets:
21+
OP_CI_TOKEN: ${{ secrets.OP_CI_TOKEN }}
22+
23+
# Notarize for production npm distribution
24+
notarize-native-macos:
25+
needs: build-native-macos
26+
uses: ./.github/workflows/notarize-native-macos.yaml
27+
with:
28+
source-artifact-name: native-bin-macos-signed
29+
artifact-name: native-bin-macos-npm
30+
secrets:
31+
OP_CI_TOKEN: ${{ secrets.OP_CI_TOKEN }}
32+
1133
release:
1234
name: Release
35+
needs: notarize-native-macos
1336
runs-on: ubuntu-latest
1437
permissions:
1538
id-token: write # Required for OIDC
@@ -45,6 +68,15 @@ jobs:
4568
- name: Update npm
4669
run: npm install -g npm@latest
4770

71+
# Download signed macOS native binary so it's included in the npm package
72+
- name: Download macOS native binary
73+
uses: actions/download-artifact@v8
74+
with:
75+
name: native-bin-macos-npm
76+
path: packages/varlock/native-bins/darwin/VarlockEnclave.app
77+
- name: Restore native binary execute permission
78+
run: chmod +x packages/varlock/native-bins/darwin/VarlockEnclave.app/Contents/MacOS/varlock-local-encrypt
79+
4880
# ------------------------------------------------------------
4981
- name: Create Release Pull Request or Publish to npm
5082
id: changesets

0 commit comments

Comments
 (0)