Skip to content

Update GHA workflows #29

Update GHA workflows

Update GHA workflows #29

Workflow file for this run

name: mac
on:
push:
jobs:
build-mac:
runs-on: ${{ matrix.os }}
strategy:
matrix:
os: [macos-latest]
steps:
- uses: actions/checkout@v4
with:
fetch-depth: 0
- name: setup
run: |
cd ../..
git clone https://github.com/open-ephys/plugin-GUI.git --branch development-juce8
cd plugin-GUI/Build && cmake -G "Xcode" ..
cd ../..
mkdir OEPlugins && cd OEPlugins
git clone https://github.com/open-ephys-plugins/OpenEphysHDF5Lib.git --branch juce8
cd OpenEphysHDF5Lib/Build
cmake -G "Xcode" ..
xcodebuild -configuration Release
mkdir -p ../../../plugin-GUI/installed_libs/Release/lib/x64
mkdir -p ../../../plugin-GUI/installed_libs/include
cp Release/libOpenEphysHDF5.dylib ../../../plugin-GUI/installed_libs/Release/lib/x64
cp ../Source/HDF5FileFormat.h ../../../plugin-GUI/installed_libs/include
- name: build
run: |
cd Build
cmake -G "Xcode" ..
xcodebuild -configuration Release
# - name: test
# run: cd build && ctest
- name: deploy
if: github.ref == 'refs/heads/juce8'
env:
artifactoryApiKey: ${{ secrets.artifactoryApiKey }}
MACOS_CERTIFICATE: ${{ secrets.BUILD_CERTIFICATE_BASE64 }}
MACOS_CERTIFICATE_PWD: ${{ secrets.BUILD_CERTIFICATE_PWD }}
MACOS_CERTIFICATE_NAME: ${{ secrets.BUILD_CERTIFICATE_NAME }}
MACOS_CI_KEYCHAIN_PWD: ${{ secrets.PROD_MACOS_CI_KEYCHAIN_PWD }}
PROD_MACOS_NOTARIZATION_APPLE_ID: ${{ secrets.PROD_MACOS_NOTARIZATION_APPLE_ID }}
PROD_MACOS_NOTARIZATION_TEAM_ID: ${{ secrets.PROD_MACOS_NOTARIZATION_TEAM_ID }}
PROD_MACOS_NOTARIZATION_PWD: ${{ secrets.PROD_MACOS_NOTARIZATION_PWD }}
build_dir: "Build/Release"
package: NWBFormat-mac
run: |
plugin_api=$(grep -rnw ../../plugin-GUI/Source -e '#define PLUGIN_API_VER' | grep -Eo "[0-9]" | tail -1)
tag=$(grep -w Source/OpenEphysLib.cpp -e 'info->libVersion' | grep -Eo "[0-9]+.[0-9]+.[0-9]+")
new_plugin_ver=$tag-API$plugin_api
mkdir plugins
cp -r $build_dir/*.bundle plugins
# Turn our base64-encoded certificate back to a regular .p12 file
echo $MACOS_CERTIFICATE | base64 --decode > certificate.p12
# We need to create a new keychain, otherwise using the certificate will prompt
# with a UI dialog asking for the certificate password, which we can't
# use in a headless CI environment
security create-keychain -p $MACOS_CI_KEYCHAIN_PWD build.keychain
security default-keychain -s build.keychain
security unlock-keychain -p $MACOS_CI_KEYCHAIN_PWD build.keychain
security import certificate.p12 -k build.keychain -P $MACOS_CERTIFICATE_PWD -T /usr/bin/codesign
security set-key-partition-list -S apple-tool:,apple:,codesign: -s -k $MACOS_CI_KEYCHAIN_PWD build.keychain
/usr/bin/codesign --force -s "$MACOS_CERTIFICATE_NAME" -v plugins/nwb-format.bundle --deep --strict --timestamp --options=runtime
/usr/bin/codesign -dv --verbose=4 plugins/nwb-format.bundle
# Store the notarization credentials so that we can prevent a UI password dialog from blocking the CI
echo "Create keychain profile"
xcrun notarytool store-credentials "notarytool-profile" --apple-id "$PROD_MACOS_NOTARIZATION_APPLE_ID" --team-id "$PROD_MACOS_NOTARIZATION_TEAM_ID" --password "$PROD_MACOS_NOTARIZATION_PWD"
# We can't notarize an app bundle directly, but we need to compress it as an archive.
# Therefore, we create a zip file containing our app bundle, so that we can send it to the
# notarization service
echo "Creating temp notarization archive"
/usr/bin/ditto -c -k --sequesterRsrc --keepParent plugins/nwb-format.bundle nwb-format.zip
# Here we send the notarization request to the Apple's Notarization service, waiting for the result.
# This typically takes a few seconds inside a CI environment, but it might take more depending on the App
# characteristics. Visit the Notarization docs for more information and strategies on how to optimize it if
# you're curious
echo "Notarize app"
xcrun notarytool submit "nwb-format.zip" --keychain-profile "notarytool-profile" --wait
# Finally, we need to "attach the staple" to our executable, which will allow our app to be
# validated by macOS even when an internet connection is not available.
echo "Attach staple"
rm -r plugins/*
/usr/bin/ditto -x -k nwb-format.zip plugins
xcrun stapler staple plugins/nwb-format.bundle
spctl -vvv --assess --type exec plugins/nwb-format.bundle
zipfile=${package}_${new_plugin_ver}.zip
/usr/bin/ditto -c -k --sequesterRsrc --keepParent plugins $zipfile
curl -H "X-JFrog-Art-Api:$artifactoryApiKey" -T $zipfile "https://openephys.jfrog.io/artifactory/NWBFormat-plugin/mac/$zipfile"