mirror of
https://github.com/bryanthaboi/gen1recomp.git
synced 2026-08-12 08:21:02 +02:00
bryanthaboi
371 lines
15 KiB
YAML
371 lines
15 KiB
YAML
name: Release
|
|
|
|
# Builds the macOS, Windows, and Linux desktop apps, an Android APK, an iOS
|
|
# IPA, and the Anbernic RG34XXSP (Stock OS 64-bit MOD / PortMaster) port on
|
|
# the self-hosted Mac runner, and publishes them as a GitHub Release.
|
|
#
|
|
# Versioning:
|
|
# - First ever release is 0.1.0.
|
|
# - Every push to main auto-increments the patch: 0.1.0 -> 0.1.1 -> ... -> 0.1.99,
|
|
# then rolls over to 0.2.0 and keeps going.
|
|
# - To force a specific version, either:
|
|
# * run this workflow manually (Actions tab) and type it into "version", or
|
|
# * put "[release X.Y.Z]" anywhere in the commit message.
|
|
#
|
|
# Branch model: day-to-day work merges to `dev`. Releases stay on `main` only
|
|
# so promoting `dev` -> `main` is the ship gate that cuts a build.
|
|
|
|
on:
|
|
push:
|
|
branches: [main]
|
|
# CI/workflow and docs-only changes don't ship anything to users, so they
|
|
# don't earn a release. A push touching these *and* real source still
|
|
# releases; only pushes confined entirely to these paths are skipped.
|
|
paths-ignore:
|
|
- '.github/**'
|
|
- '**.md'
|
|
workflow_dispatch:
|
|
inputs:
|
|
version:
|
|
description: "Exact version to release (e.g. 0.2.0). Leave blank to auto-increment."
|
|
required: false
|
|
default: ""
|
|
|
|
permissions:
|
|
contents: write
|
|
issues: read
|
|
pull-requests: read
|
|
|
|
concurrency:
|
|
group: release
|
|
cancel-in-progress: false
|
|
|
|
jobs:
|
|
release:
|
|
runs-on: [self-hosted, macOS]
|
|
|
|
steps:
|
|
- name: Checkout
|
|
uses: actions/checkout@v4
|
|
with:
|
|
fetch-depth: 0
|
|
fetch-tags: true
|
|
|
|
- name: Determine version
|
|
id: ver
|
|
env:
|
|
DISPATCH_VERSION: ${{ github.event.inputs.version }}
|
|
GH_TOKEN: ${{ github.token }}
|
|
run: |
|
|
set -euo pipefail
|
|
|
|
semver_re='^[0-9]+\.[0-9]+\.[0-9]+$'
|
|
|
|
# 1) Explicit override from a manual run.
|
|
override=""
|
|
if [ -n "${DISPATCH_VERSION:-}" ]; then
|
|
override="$DISPATCH_VERSION"
|
|
else
|
|
# 2) Override from the commit message: [release X.Y.Z]
|
|
msg="$(git log -1 --pretty=%B || true)"
|
|
tag_ver="$(printf '%s' "$msg" | sed -n -E 's/.*\[release[[:space:]]+([0-9]+\.[0-9]+\.[0-9]+)\].*/\1/p' | head -1)"
|
|
if [ -n "$tag_ver" ]; then
|
|
override="$tag_ver"
|
|
fi
|
|
fi
|
|
|
|
if [ -n "$override" ]; then
|
|
if ! printf '%s' "$override" | grep -Eq "$semver_re"; then
|
|
echo "::error::Invalid version override '$override' (expected X.Y.Z)"
|
|
exit 1
|
|
fi
|
|
version="$override"
|
|
echo "Using override version: $version"
|
|
else
|
|
# 3) Auto-increment from the highest existing vX.Y.Z tag.
|
|
latest="$(git tag -l 'v*' \
|
|
| sed -E 's/^v//' \
|
|
| grep -E "$semver_re" \
|
|
| sort -t. -k1,1n -k2,2n -k3,3n \
|
|
| tail -1 || true)"
|
|
|
|
if [ -z "$latest" ]; then
|
|
version="0.1.0"
|
|
echo "No existing release tag; starting at $version"
|
|
else
|
|
major="${latest%%.*}"
|
|
rest="${latest#*.}"
|
|
minor="${rest%%.*}"
|
|
patch="${rest##*.}"
|
|
patch=$((patch + 1))
|
|
if [ "$patch" -gt 99 ]; then
|
|
minor=$((minor + 1))
|
|
patch=0
|
|
fi
|
|
version="${major}.${minor}.${patch}"
|
|
echo "Latest was $latest; next is $version"
|
|
fi
|
|
fi
|
|
|
|
tag="v${version}"
|
|
if git rev-parse -q --verify "refs/tags/$tag" >/dev/null; then
|
|
echo "::error::Tag $tag already exists. Pick a different version."
|
|
exit 1
|
|
fi
|
|
if gh release view "$tag" >/dev/null 2>&1; then
|
|
echo "::error::Release $tag already exists. Pick a different version."
|
|
exit 1
|
|
fi
|
|
|
|
echo "version=$version" >> "$GITHUB_OUTPUT"
|
|
echo "tag=$tag" >> "$GITHUB_OUTPUT"
|
|
|
|
- name: Import signing certificate into a temporary keychain
|
|
run: |
|
|
set -euo pipefail
|
|
KEYCHAIN_PATH="$RUNNER_TEMP/pokemon-signing.keychain-db"
|
|
ci_dir="${POKEMON_CI_DIR:-$HOME/.config/pokemon-ci}"
|
|
p12="$ci_dir/signing.p12"
|
|
passfile="$ci_dir/signing.pass"
|
|
if [ ! -f "$p12" ] || [ ! -f "$passfile" ]; then
|
|
echo "::error::Signing material not found in $ci_dir. Run scripts/ci-setup-signing.sh on the runner."
|
|
exit 1
|
|
fi
|
|
p12pw="$(cat "$passfile")"
|
|
|
|
kcpw="$(openssl rand -base64 24)"
|
|
echo "::add-mask::$kcpw"
|
|
|
|
# Fresh, dedicated keychain — no dependence on the login keychain/session.
|
|
security delete-keychain "$KEYCHAIN_PATH" 2>/dev/null || true
|
|
security create-keychain -p "$kcpw" "$KEYCHAIN_PATH"
|
|
security set-keychain-settings "$KEYCHAIN_PATH" # disable auto-lock
|
|
security unlock-keychain -p "$kcpw" "$KEYCHAIN_PATH"
|
|
|
|
security import "$p12" -P "$p12pw" -k "$KEYCHAIN_PATH" \
|
|
-T /usr/bin/codesign -T /usr/bin/security
|
|
|
|
# Let codesign use the key non-interactively.
|
|
security set-key-partition-list -S apple-tool:,apple:,codesign: \
|
|
-s -k "$kcpw" "$KEYCHAIN_PATH" >/dev/null
|
|
|
|
# Make the keychain visible to find-identity/codesign (prepend to search list).
|
|
existing="$(security list-keychains -d user | sed -e 's/^[[:space:]]*//' -e 's/"//g')"
|
|
security list-keychains -d user -s "$KEYCHAIN_PATH" $existing
|
|
|
|
echo "Identities available to codesign:"
|
|
security find-identity -v -p codesigning "$KEYCHAIN_PATH"
|
|
|
|
- name: Build macOS + Windows + Linux
|
|
run: |
|
|
set -euo pipefail
|
|
# Sign in-build (identity auto-detected from the temp keychain);
|
|
# notarize separately below so it uses secret credentials, not a
|
|
# login-keychain profile. "all" also builds the Linux AppImage,
|
|
# which needs no signing/notarization.
|
|
scripts/build.sh all --version "${{ steps.ver.outputs.version }}" --no-notarize
|
|
|
|
- name: Build Android
|
|
run: |
|
|
set -euo pipefail
|
|
scripts/build_android.sh --version "${{ steps.ver.outputs.version }}"
|
|
|
|
- name: Build iOS
|
|
run: |
|
|
set -euo pipefail
|
|
# Device Release IPA; signs with the Apple Development identity on
|
|
# the runner (auto team detection). Users on other Apple IDs still
|
|
# re-sign or build via docs/ios-install.md.
|
|
scripts/build_ios.sh --fetch --device --release \
|
|
--version "${{ steps.ver.outputs.version }}"
|
|
|
|
- name: Build Anbernic RG34XXSP port
|
|
run: |
|
|
set -euo pipefail
|
|
# Self-contained aarch64 PortMaster-style pack; pulls the LÖVE 11.5
|
|
# runtime from PortMaster-GUI, so it needs no signing/notarization.
|
|
./build-rg34xxsp.sh --version "${{ steps.ver.outputs.version }}"
|
|
|
|
- name: Notarize & staple macOS app
|
|
run: |
|
|
set -euo pipefail
|
|
ci_dir="${POKEMON_CI_DIR:-$HOME/.config/pokemon-ci}"
|
|
if [ ! -f "$ci_dir/notary.env" ]; then
|
|
echo "::error::Missing $ci_dir/notary.env. Run scripts/ci-setup-signing.sh on the runner."
|
|
exit 1
|
|
fi
|
|
set -a; . "$ci_dir/notary.env"; set +a
|
|
echo "::add-mask::$APPLE_APP_PASSWORD"
|
|
|
|
app=".bazinga/work/gen1recomp.app"
|
|
zip="dist/mac/gen1recomp-macos.zip"
|
|
[ -d "$app" ] || { echo "::error::signed app not found at $app"; exit 1; }
|
|
if [ -z "${APPLE_ID:-}" ] || [ -z "${APPLE_APP_PASSWORD:-}" ] || [ -z "${APPLE_TEAM_ID:-}" ]; then
|
|
echo "::error::notary.env is missing APPLE_ID / APPLE_APP_PASSWORD / APPLE_TEAM_ID."
|
|
exit 1
|
|
fi
|
|
|
|
echo "Submitting to Apple notary service (can take a few minutes)..."
|
|
xcrun notarytool submit "$zip" \
|
|
--apple-id "$APPLE_ID" \
|
|
--team-id "$APPLE_TEAM_ID" \
|
|
--password "$APPLE_APP_PASSWORD" \
|
|
--wait
|
|
|
|
echo "Stapling ticket to the app..."
|
|
xcrun stapler staple "$app"
|
|
|
|
# Re-zip the now-stapled app (same format build.sh uses).
|
|
rm -f "$zip"
|
|
ditto -c -k --sequesterRsrc --keepParent "$app" "$zip"
|
|
echo "Notarized + stapled ✓"
|
|
|
|
- name: Stage release assets
|
|
id: assets
|
|
run: |
|
|
set -euo pipefail
|
|
v="${{ steps.ver.outputs.version }}"
|
|
outdir="dist/release"
|
|
rm -rf "$outdir"
|
|
mkdir -p "$outdir"
|
|
cp "dist/mac/gen1recomp-macos.zip" "$outdir/gen1recomp-${v}-macos.zip"
|
|
cp "dist/win/gen1recomp-win64.zip" "$outdir/gen1recomp-${v}-windows.zip"
|
|
cp "dist/linux/gen1recomp-linux.zip" "$outdir/gen1recomp-${v}-linux.zip"
|
|
apk="$(find dist/android/debug -name '*.apk' | head -1)"
|
|
[ -n "$apk" ] || { echo "::error::no Android APK found under dist/android/debug"; exit 1; }
|
|
cp "$apk" "$outdir/gen1recomp-${v}-android.apk"
|
|
|
|
ipa="dist/ios/gen1recomp.ipa"
|
|
[ -f "$ipa" ] || { echo "::error::$ipa not found (expected from scripts/build_ios.sh --device)"; exit 1; }
|
|
cp "$ipa" "$outdir/gen1recomp-${v}-ios.ipa"
|
|
|
|
# Anbernic handheld port (suffix names the CFW it targets, so a
|
|
# future RG35XX/other-CFW pack can ship alongside it).
|
|
rg34="dist/rg34xxsp/gen1recomp-rg34xxsp-stockos64-mod.zip"
|
|
[ -f "$rg34" ] || { echo "::error::$rg34 not found (expected from ./build-rg34xxsp.sh)"; exit 1; }
|
|
cp "$rg34" "$outdir/gen1recomp-${v}-rg34xxsp-stockos64-mod.zip"
|
|
|
|
# Platform-independent update payload, built alongside the desktop
|
|
# apps above (same game.love that gets fused into each of them).
|
|
love_file=".bazinga/work/game.love"
|
|
[ -f "$love_file" ] || { echo "::error::$love_file not found (expected from scripts/build.sh)"; exit 1; }
|
|
cp "$love_file" "$outdir/gen1recomp-${v}.love"
|
|
|
|
ls -lh "$outdir"
|
|
|
|
# Checksums for every staged release asset (sums file itself is
|
|
# written after this and named outside the gen1recomp-* glob, so it
|
|
# never lists itself).
|
|
(cd "$outdir" && shasum -a 256 gen1recomp-* > sha256sums.txt)
|
|
cat "$outdir/sha256sums.txt"
|
|
|
|
- name: Publish GitHub Release
|
|
env:
|
|
GH_TOKEN: ${{ github.token }}
|
|
run: |
|
|
set -euo pipefail
|
|
v="${{ steps.ver.outputs.version }}"
|
|
tag="${{ steps.ver.outputs.tag }}"
|
|
|
|
# Issues this release closes. Three sources, deduped by number:
|
|
# 1. GitHub's own "closing issues" links on every PR whose
|
|
# commits are in the range (works for squash, rebase, and
|
|
# merge commits alike) -- including PRs that were merged
|
|
# into a branch this release PR is itself merging in.
|
|
# 2. CLOSES/fixes/resolves text in those PRs' titles + bodies
|
|
# that GitHub didn't turn into a closing link (a PR into a
|
|
# non-default branch never gets one).
|
|
# 3. The same text in raw commit messages, so a direct push
|
|
# with "CLOSES #N #M" still lands in the notes.
|
|
# Scans every commit since the previous tag so a skipped release
|
|
# run doesn't drop issues on the floor.
|
|
prev_tag="$(git tag -l 'v*' --sort=-v:refname | grep -v "^${tag}$" | head -1 || true)"
|
|
range="${prev_tag:+${prev_tag}..}$GITHUB_SHA"
|
|
|
|
# every #N on a line that carries a closing keyword (handles the
|
|
# multi-issue "CLOSES #1 #2 #3" form the tracker uses)
|
|
scan_closes() {
|
|
grep -iE '\b(close[sd]?|fix(es|ed)?|resolve[sd]?)\b' \
|
|
| grep -oE '#[0-9]+' | tr -d '#' || true
|
|
}
|
|
|
|
nums=""
|
|
nums+=" $(git log --pretty=%B "$range" | scan_closes | tr '\n' ' ')"
|
|
|
|
prs="$(git log --pretty=%H "$range" \
|
|
| xargs -I{} gh api "repos/$GITHUB_REPOSITORY/commits/{}/pulls" \
|
|
--jq '.[].number' 2>/dev/null \
|
|
| sort -un || true)"
|
|
for pr in $prs; do
|
|
nums+=" $(gh api graphql \
|
|
-f owner="${GITHUB_REPOSITORY%/*}" \
|
|
-f name="${GITHUB_REPOSITORY#*/}" \
|
|
-F pr="$pr" \
|
|
-f query='
|
|
query($owner:String!, $name:String!, $pr:Int!) {
|
|
repository(owner:$owner, name:$name) {
|
|
pullRequest(number:$pr) {
|
|
closingIssuesReferences(first:50) { nodes { number } }
|
|
}
|
|
}
|
|
}' \
|
|
--jq '.data.repository.pullRequest.closingIssuesReferences.nodes[].number' \
|
|
2>/dev/null | grep -E '^[0-9]+$' | tr '\n' ' ' || true)"
|
|
nums+=" $(gh api "repos/$GITHUB_REPOSITORY/pulls/$pr" \
|
|
--jq '.title + " " + (.body // "")' 2>/dev/null \
|
|
| scan_closes | tr '\n' ' ' || true)"
|
|
done
|
|
|
|
# dedupe, drop anything that is a PR or does not exist, keep
|
|
# titles (gh api prints the response body to stdout on an HTTP
|
|
# error, so only a zero exit counts)
|
|
closed=""
|
|
for n in $(printf '%s' "$nums" | tr ' ' '\n' | grep -E '^[0-9]+$' | sort -un); do
|
|
if title="$(gh api "repos/$GITHUB_REPOSITORY/issues/$n" \
|
|
--jq 'if .pull_request then empty else .title end' \
|
|
2>/dev/null)"; then
|
|
[ -n "$title" ] && closed+="- #$n $title"$'\n'
|
|
fi
|
|
done
|
|
closed="$(printf '%s' "$closed" | grep . | sort -t'#' -k2 -n || true)"
|
|
|
|
# Everyone whose commits are in the range: GitHub login when the
|
|
# commit is linked to an account, the raw git author name when not;
|
|
# CI bots filtered out.
|
|
base="${prev_tag:-$(git rev-list --max-parents=0 "$GITHUB_SHA" | tail -1)}"
|
|
contributors="$(gh api --paginate \
|
|
"repos/$GITHUB_REPOSITORY/compare/${base}...${GITHUB_SHA}" \
|
|
--jq '.commits[] | if .author and .author.login
|
|
then "@" + .author.login
|
|
else .commit.author.name end' 2>/dev/null \
|
|
| grep -viE '\[bot\]$' | sort -uf | sed 's/^/- /' || true)"
|
|
|
|
notes="Download the correct version for your computer below."
|
|
if [ -n "$closed" ]; then
|
|
notes+=$'\n\n## Issues closed\n\n'"$closed"
|
|
fi
|
|
if [ -n "$contributors" ]; then
|
|
notes+=$'\n\n## Contributors\n\n'"$contributors"
|
|
fi
|
|
printf 'Release notes:\n%s\n' "$notes"
|
|
|
|
gh release create "$tag" \
|
|
--target "$GITHUB_SHA" \
|
|
--title "$v" \
|
|
--notes "$notes" \
|
|
"dist/release/gen1recomp-${v}-macos.zip" \
|
|
"dist/release/gen1recomp-${v}-windows.zip" \
|
|
"dist/release/gen1recomp-${v}-linux.zip" \
|
|
"dist/release/gen1recomp-${v}-android.apk" \
|
|
"dist/release/gen1recomp-${v}-ios.ipa" \
|
|
"dist/release/gen1recomp-${v}-rg34xxsp-stockos64-mod.zip" \
|
|
"dist/release/gen1recomp-${v}.love" \
|
|
"dist/release/sha256sums.txt"
|
|
|
|
echo "Published release $tag"
|
|
|
|
- name: Clean up signing keychain
|
|
if: always()
|
|
run: |
|
|
security delete-keychain "$RUNNER_TEMP/pokemon-signing.keychain-db" 2>/dev/null || true
|