Workflow file for this run
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Sign and Upload Mac Installer | |
| on: | |
| release: | |
| types: [created, published] | |
| workflow_dispatch: | |
| inputs: | |
| version: | |
| description: 'Release version to build and upload (e.g. "v9.8.7")' | |
| required: true | |
| dryrun: | |
| description: 'Perform all the steps except uploading to the release page' | |
| required: true | |
| default: "true" # 'choice' type requires string value | |
| type: choice | |
| options: | |
| - "true" # Must be quoted string, boolean value not supported. | |
| - "false" | |
| permissions: | |
| contents: write | |
| jobs: | |
| build: | |
| runs-on: macos-latest | |
| env: | |
| APPLICATION_CERTIFICATE: ${{ secrets.MACOS_APPLICATION_CERT }} | |
| CODESIGN_IDENTITY: ${{ secrets.MACOS_APPLICATION_IDENTITY }} | |
| INSTALLER_CERTIFICATE: ${{ secrets.MACOS_INSTALLER_CERT }} | |
| PRODUCTSIGN_IDENTITY: ${{ secrets.MACOS_INSTALLER_IDENTITY }} | |
| CERTIFICATE_PWD: ${{ secrets.MACOS_CERTIFICATE_PWD }} | |
| NOTARIZE_TEAM: ${{ secrets.MACOS_NOTARIZATION_TEAM_ID }} | |
| NOTARIZE_USERNAME: ${{ secrets.MACOS_NOTARIZATION_APPLE_ID }} | |
| NOTARIZE_PASSWORD: ${{ secrets.MACOS_NOTARIZATION_PWD }} | |
| KEYCHAIN_PWD: ${{ secrets.MACOS_CI_KEYCHAIN_PWD }} | |
| steps: | |
| - name: Consolidate dryrun setting to always be true or false | |
| id: actual_dryrun | |
| run: | | |
| # The 'release' trigger will not have a 'dryrun' input set. Handle | |
| # this case in a readable/maintainable way. | |
| if [[ -z "${{ inputs.dryrun }}" ]] | |
| then | |
| echo "dryrun=false" >> $GITHUB_OUTPUT | |
| else | |
| echo "dryrun=${{ inputs.dryrun }}" >> $GITHUB_OUTPUT | |
| fi | |
| - name: Dry Run Status | |
| run: | | |
| echo "::notice::This workflow execution will be a dry-run: ${{ steps.actual_dryrun.outputs.dryrun }}" | |
| - name: Determine Version | |
| id: getversion | |
| run: | | |
| if [[ -z "${{ inputs.version }}" ]] | |
| then | |
| VERSION=${{ github.event.release.tag_name }} | |
| else | |
| VERSION=${{ inputs.version }} | |
| fi | |
| echo | |
| echo "version=$VERSION" >> $GITHUB_OUTPUT | |
| - name: Check uploads | |
| id: check | |
| run: | | |
| URI="https://github.com/containers/podman/releases/download/${{steps.getversion.outputs.version}}" | |
| ARM_FILE="podman-installer-macos-arm64.pkg" | |
| AMD_FILE="podman-installer-macos-amd64.pkg" | |
| UNIVERSAL_FILE="podman-installer-macos-universal.pkg" | |
| status=$(curl -s -o /dev/null -w "%{http_code}" "${URI}/${ARM_FILE}") | |
| if [[ "$status" == "404" ]] ; then | |
| echo "buildarm=true" >> $GITHUB_OUTPUT | |
| else | |
| echo "::warning::ARM installer already exists, skipping" | |
| echo "buildarm=false" >> $GITHUB_OUTPUT | |
| fi | |
| status=$(curl -s -o /dev/null -w "%{http_code}" "${URI}/${AMD_FILE}") | |
| if [[ "$status" == "404" ]] ; then | |
| echo "buildamd=true" >> $GITHUB_OUTPUT | |
| else | |
| echo "::warning::AMD installer already exists, skipping" | |
| echo "buildamd=false" >> $GITHUB_OUTPUT | |
| fi | |
| status=$(curl -s -o /dev/null -w "%{http_code}" "${URI}/${UNIVERSAL_FILE}") | |
| if [[ "$status" == "404" ]] ; then | |
| echo "builduniversal=true" >> $GITHUB_OUTPUT | |
| else | |
| echo "::warning::Universal installer already exists, skipping" | |
| echo "builduniversal=false" >> $GITHUB_OUTPUT | |
| fi | |
| - name: Checkout Version | |
| if: >- | |
| steps.check.outputs.buildamd == 'true' || | |
| steps.check.outputs.buildarm == 'true' || | |
| steps.check.outputs.builduniversal == 'true' || | |
| steps.actual_dryrun.outputs.dryrun == 'true' | |
| uses: actions/checkout@v4 | |
| with: | |
| ref: ${{steps.getversion.outputs.version}} | |
| - name: Set up Go | |
| # Conditional duplication sucks - GHA doesn't grok YAML anchors/aliases | |
| if: >- | |
| steps.check.outputs.buildamd == 'true' || | |
| steps.check.outputs.buildarm == 'true' || | |
| steps.check.outputs.builduniversal == 'true' || | |
| steps.actual_dryrun.outputs.dryrun == 'true' | |
| uses: actions/setup-go@v5 | |
| with: | |
| go-version: stable | |
| - name: Create Keychain | |
| if: >- | |
| steps.check.outputs.buildamd == 'true' || | |
| steps.check.outputs.buildarm == 'true' || | |
| steps.check.outputs.builduniversal == 'true' || | |
| steps.actual_dryrun.outputs.dryrun == 'true' | |
| run: | | |
| echo $APPLICATION_CERTIFICATE | base64 --decode -o appcert.p12 | |
| echo $INSTALLER_CERTIFICATE | base64 --decode -o instcert.p12 | |
| security create-keychain -p "$KEYCHAIN_PWD" build.keychain | |
| security default-keychain -s build.keychain | |
| security unlock-keychain -p "$KEYCHAIN_PWD" build.keychain | |
| security import appcert.p12 -k build.keychain -P "$CERTIFICATE_PWD" -T /usr/bin/codesign | |
| security import instcert.p12 -k build.keychain -P "$CERTIFICATE_PWD" -T /usr/bin/productsign | |
| security set-key-partition-list -S apple-tool:,apple:,codesign: -s -k "$KEYCHAIN_PWD" build.keychain &> /dev/null | |
| xcrun notarytool store-credentials "notarytool-profile" --apple-id "$NOTARIZE_USERNAME" --team-id "$NOTARIZE_TEAM" --password "$NOTARIZE_PASSWORD" &> /dev/null | |
| - name: Build and Sign ARM | |
| if: steps.check.outputs.buildarm == 'true' || steps.actual_dryrun.outputs.dryrun == 'true' | |
| working-directory: contrib/pkginstaller | |
| run: | | |
| make ARCH=aarch64 notarize &> /dev/null | |
| cd out && shasum -a 256 podman-installer-macos-arm64.pkg >> shasums | |
| - name: Build and Sign AMD | |
| if: steps.check.outputs.buildamd == 'true' || steps.actual_dryrun.outputs.dryrun == 'true' | |
| working-directory: contrib/pkginstaller | |
| run: | | |
| make ARCH=amd64 notarize &> /dev/null | |
| cd out && shasum -a 256 podman-installer-macos-amd64.pkg >> shasums | |
| - name: Build and Sign Universal | |
| if: steps.check.outputs.builduniversal == 'true' || steps.actual_dryrun.outputs.dryrun == 'true' | |
| working-directory: contrib/pkginstaller | |
| run: | | |
| make ARCH=universal notarize &> /dev/null | |
| cd out && shasum -a 256 podman-installer-macos-universal.pkg >> shasums | |
| - name: Artifact | |
| if: >- | |
| steps.check.outputs.buildamd == 'true' || | |
| steps.check.outputs.buildarm == 'true' || | |
| steps.check.outputs.builduniversal == 'true' || | |
| steps.actual_dryrun.outputs.dryrun == 'true' | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: installers | |
| path: | | |
| contrib/pkginstaller/out/podman-installer-macos-*.pkg | |
| contrib/pkginstaller/out/shasums | |
| - name: Upload to Release | |
| if: >- | |
| steps.actual_dryrun.outputs.dryrun == 'false' && | |
| (steps.check.outputs.buildamd == 'true' || | |
| steps.check.outputs.buildarm == 'true'|| | |
| steps.check.outputs.builduniversal == 'true' ) | |
| env: | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| run: | | |
| (gh release download ${{steps.getversion.outputs.version}} -p "shasums" || exit 0) | |
| cat contrib/pkginstaller/out/shasums >> shasums | |
| gh release upload ${{steps.getversion.outputs.version}} contrib/pkginstaller/out/podman-installer-macos-*.pkg | |
| gh release upload ${{steps.getversion.outputs.version}} --clobber shasums |