catsona/macoc
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
macoc/docs/ci.md
root 009c7e5a33
Some checks failed
macoc macOS / build (push) Has been cancelled
Details
feat: brand macoc add icon stable restart scripts and Forgejo CI
2026-10-26 00:22:35 +03:00

2.2 KiB
Raw Blame History

Forgejo Actions CI and macOS releases

The workflow is in .forgejo/workflows/macos.yml.

  • Push to main: Swift tests, static checks, macOS app build and ZIP archive.
  • Push a version tag like v0.3.0: same checks plus a Forgejo release with macoc-vX.Y.Z-macos-.zip and a SHA-256 checksum file.
  • Manual workflow run: test and build only.

Artifacts are for the runner's CPU architecture, not universal.

One-time macOS runner setup

  1. Enable Actions under repository Settings -> Units.
  2. Register a dedicated runner on a real Mac with Command Line Tools, Swift, iconutil, sips, codesign, ditto, curl, Git, Python 3 and Node for checkout.
  3. Under Settings -> Actions -> Runners obtain the registration token.
  4. Configure the runner label macos:host; workflow uses runs-on: macos.
  5. Push a main-branch commit to check the workflow. Then push an exact version tag matching Resources/Info.plist when the build is green.

Host runners have no isolation; allow only trusted contributors to edit the workflow, protect release tags, and avoid running arbitrary PR code.

Official documentation: https://forgejo.org/docs/latest/user/actions/overview/ https://forgejo.org/docs/latest/admin/actions/configuration/ https://forgejo.org/docs/latest/user/actions/basic-concepts/

Signing and publishing

The optional Forgejo repository variable MACOC_CODESIGN_IDENTITY selects a code-signing identity already available in the macOS runner keychain. Otherwise builds use ad-hoc signing. Ad-hoc releases are useful for local testing but are not notarized and may trigger Gatekeeper warnings.

For public distribution use Developer ID Application signing plus Apple notarization. Do not commit private keys or notarization credentials. Notarization has not been automated in this version.

scripts/package.sh builds the archive and SHA-256 checksum. scripts/publish-release.sh creates the release and uploads artifacts over Forgejo REST using the workflow's short-lived FORGEJO_TOKEN. No long-lived access token is stored in this repository.

The workflow requires a separately provisioned macOS runner. It cannot be completed with the current Linux development host alone, and merely committing it does not prove that a Mac build/release has run.