4545 path : ${{ env.DIST_DIR }}
4646
4747 notarize-macos :
48+ name : Notarize ${{ matrix.artifact.name }}
4849 runs-on : macos-latest
4950 needs : create-nightly-artifacts
5051
52+ outputs :
53+ checksum-darwin_amd64 : ${{ steps.re-package.outputs.checksum-darwin_amd64 }}
54+ checksum-darwin_arm64 : ${{ steps.re-package.outputs.checksum-darwin_arm64 }}
55+
56+ env :
57+ GON_CONFIG_PATH : gon.config.hcl
58+
59+ strategy :
60+ matrix :
61+ artifact :
62+ - name : darwin_amd64
63+ path : " macOS_64bit.tar.gz"
64+ - name : darwin_arm64
65+ path : " macOS_ARM64.tar.gz"
66+
5167 steps :
5268 - name : Checkout repository
5369 uses : actions/checkout@v3
@@ -86,38 +102,59 @@ jobs:
86102 wget -q https://github.com/mitchellh/gon/releases/download/v0.2.3/gon_macos.zip
87103 unzip gon_macos.zip -d /usr/local/bin
88104
105+ - name : Write gon config to file
106+ # gon does not allow env variables in config file (https://github.com/mitchellh/gon/issues/20)
107+ run : |
108+ cat > "${{ env.GON_CONFIG_PATH }}" <<EOF
109+ # See: https://github.com/mitchellh/gon#configuration-file
110+ source = ["${{ env.DIST_DIR }}/${{ env.PROJECT_NAME }}_osx_${{ matrix.artifact.name }}/${{ env.PROJECT_NAME }}"]
111+ bundle_id = "cc.arduino.${{ env.PROJECT_NAME }}"
112+
113+ sign {
114+ application_identity = "Developer ID Application: ARDUINO SA (7KT7ZWMCJT)"
115+ }
116+
117+ # Ask Gon for zip output to force notarization process to take place.
118+ # The CI will ignore the zip output, using the signed binary only.
119+ zip {
120+ output_path = "unused.zip"
121+ }
122+ EOF
123+
89124 - name : Sign and notarize binary
90125 env :
91126 AC_USERNAME : ${{ secrets.AC_USERNAME }}
92127 AC_PASSWORD : ${{ secrets.AC_PASSWORD }}
93128 run : |
94- gon gon.config.hcl
129+ gon "${{ env.GON_CONFIG_PATH }}"
95130
96- - name : Re-package binary and update checksum
131+ - name : Re-package binary and output checksum
132+ id : re-package
133+ working-directory : ${{ env.DIST_DIR }}
97134 # This step performs the following:
98135 # 1. Repackage the signed binary replaced in place by Gon (ignoring the output zip file)
99- # 2. Recalculate package checksum and replace it in the nnnnnn-checksums.txt file
136+ # 2. Recalculate package checksum
137+ # 3. Output the new checksum to include in the nnnnnn-checksums.txt file
138+ # (it cannot be done there because of workflow job parallelization)
100139 run : |
101- # GitHub's upload/download-artifact@v2 actions don't preserve file permissions,
140+ # GitHub's upload/download-artifact actions don't preserve file permissions,
102141 # so we need to add execution permission back until the action is made to do this.
103- chmod +x "${{ env.DIST_DIR }}/${{ env.PROJECT_NAME }}_osx_darwin_amd64/${{ env.PROJECT_NAME }}"
104- PACKAGE_FILENAME="$(basename ${{ env.DIST_DIR }}/${{ env.PROJECT_NAME }}_nightly-*_macOS_64bit.tar.gz)"
105- tar -czvf "${{ env.DIST_DIR }}/$PACKAGE_FILENAME" \
106- -C "${{ env.DIST_DIR }}/${{ env.PROJECT_NAME }}_osx_darwin_amd64/" "${{ env.PROJECT_NAME }}" \
142+ chmod +x "${{ env.PROJECT_NAME }}_osx_${{ matrix.artifact.name }}/${{ env.PROJECT_NAME }}"
143+ # Use of an array here is required for globbing
144+ PACKAGE_FILENAME=(${{ env.PROJECT_NAME }}_nightly-*${{ matrix.artifact.path }})
145+ tar -czvf "$PACKAGE_FILENAME" \
146+ -C "${{ env.PROJECT_NAME }}_osx_${{ matrix.artifact.name }}/" "${{ env.PROJECT_NAME }}" \
107147 -C ../../ LICENSE.txt
108- CHECKSUM="$(shasum -a 256 ${{ env.DIST_DIR }}/$PACKAGE_FILENAME | cut -d " " -f 1)"
109- perl \
110- -pi \
111- -w \
112- -e "s/.*${PACKAGE_FILENAME}/${CHECKSUM} ${PACKAGE_FILENAME}/g;" \
113- ${{ env.DIST_DIR }}/*-checksums.txt
148+ CHECKSUM_LINE="$(shasum -a 256 $PACKAGE_FILENAME)"
149+ echo "PACKAGE_FILENAME=$PACKAGE_FILENAME" >> $GITHUB_ENV
150+ echo "::set-output name=checksum-${{ matrix.artifact.name }}::$CHECKSUM_LINE"
114151
115152 - name : Upload artifacts
116153 uses : actions/upload-artifact@v3
117154 with :
118155 if-no-files-found : error
119156 name : ${{ env.ARTIFACT_NAME }}
120- path : ${{ env.DIST_DIR }}
157+ path : ${{ env.DIST_DIR }}/${{ env.PACKAGE_FILENAME }}
121158
122159 publish-nightly :
123160 runs-on : ubuntu-latest
@@ -130,6 +167,16 @@ jobs:
130167 name : ${{ env.ARTIFACT_NAME }}
131168 path : ${{ env.DIST_DIR }}
132169
170+ - name : Update checksum
171+ run : |
172+ declare -a checksum_lines=("${{ needs.notarize-macos.outputs.checksum-darwin_amd64 }}" "${{ needs.notarize-macos.outputs.checksum-darwin_arm64 }}")
173+ for checksum_line in "${checksum_lines[@]}"
174+ do
175+ CHECKSUM=$(echo ${checksum_line} | cut -d " " -f 1)
176+ PACKAGE_FILENAME=$(echo ${checksum_line} | cut -d " " -f 2)
177+ perl -pi -w -e "s/.*${PACKAGE_FILENAME}/${CHECKSUM} ${PACKAGE_FILENAME}/g;" ${{ env.DIST_DIR }}/*-checksums.txt
178+ done
179+
133180 - name : Upload release files on Arduino downloads servers
134181 uses : docker://plugins/s3
135182 env :
0 commit comments