48 lines
2.2 KiB
Markdown
48 lines
2.2 KiB
Markdown
# Forgejo Actions CI and macOS releases
|
|
|
|
The workflow is in .forgejo/workflows/macos.yml.
|
|
|
|
- Push to main: Swift tests, static checks, macOS app build and ZIP archive.
|
|
- Push a version tag like v0.3.0: same checks plus a Forgejo release with
|
|
macoc-vX.Y.Z-macos-<arch>.zip and a SHA-256 checksum file.
|
|
- Manual workflow run: test and build only.
|
|
|
|
Artifacts are for the runner's CPU architecture, not universal.
|
|
|
|
## One-time macOS runner setup
|
|
|
|
1. Enable Actions under repository Settings -> Units.
|
|
2. Register a dedicated runner on a real Mac with Command Line Tools, Swift,
|
|
iconutil, sips, codesign, ditto, curl, Git, Python 3 and Node for checkout.
|
|
3. Under Settings -> Actions -> Runners obtain the registration token.
|
|
4. Configure the runner label macos:host; workflow uses runs-on: macos.
|
|
5. Push a main-branch commit to check the workflow. Then push an exact version
|
|
tag matching Resources/Info.plist when the build is green.
|
|
|
|
Host runners have no isolation; allow only trusted contributors to edit
|
|
the workflow, protect release tags, and avoid running arbitrary PR code.
|
|
|
|
Official documentation:
|
|
https://forgejo.org/docs/latest/user/actions/overview/
|
|
https://forgejo.org/docs/latest/admin/actions/configuration/
|
|
https://forgejo.org/docs/latest/user/actions/basic-concepts/
|
|
|
|
## Signing and publishing
|
|
|
|
The optional Forgejo repository variable MACOC_CODESIGN_IDENTITY selects
|
|
a code-signing identity already available in the macOS runner keychain.
|
|
Otherwise builds use ad-hoc signing. Ad-hoc releases are useful for local
|
|
testing but are not notarized and may trigger Gatekeeper warnings.
|
|
|
|
For public distribution use Developer ID Application signing plus Apple
|
|
notarization. Do not commit private keys or notarization credentials.
|
|
Notarization has not been automated in this version.
|
|
|
|
scripts/package.sh builds the archive and SHA-256 checksum.
|
|
scripts/publish-release.sh creates the release and uploads artifacts over
|
|
Forgejo REST using the workflow's short-lived FORGEJO_TOKEN. No long-lived
|
|
access token is stored in this repository.
|
|
|
|
The workflow requires a separately provisioned macOS runner. It cannot
|
|
be completed with the current Linux development host alone, and merely
|
|
committing it does not prove that a Mac build/release has run.
|