Publish Signed Standalone Chat Repo #4
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Publish Signed Standalone Chat Repo | |
| on: | |
| workflow_dispatch: | |
| inputs: | |
| release_tag: | |
| description: "Optional override tag (defaults to v<app version>)" | |
| required: false | |
| default: "" | |
| permissions: | |
| contents: read | |
| jobs: | |
| publish-chat-signed: | |
| name: Build + sign + notarize silicon-refinery-chat | |
| # Requires a self-hosted macOS 26+ Apple Silicon runner with Xcode + Briefcase prerequisites. | |
| runs-on: [self-hosted, macOS, ARM64] | |
| steps: | |
| - uses: actions/checkout@v4 | |
| with: | |
| fetch-depth: 0 | |
| - uses: astral-sh/setup-uv@v5 | |
| with: | |
| enable-cache: true | |
| - name: Validate required secrets | |
| env: | |
| CHAT_REPO_GH_TOKEN: ${{ secrets.CHAT_REPO_GH_TOKEN }} | |
| APPLE_SIGN_IDENTITY: ${{ secrets.APPLE_SIGN_IDENTITY }} | |
| APPLE_NOTARY_PROFILE: ${{ secrets.APPLE_NOTARY_PROFILE }} | |
| APPLE_ID: ${{ secrets.APPLE_ID }} | |
| APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }} | |
| APPLE_APP_SPECIFIC_PASSWORD: ${{ secrets.APPLE_APP_SPECIFIC_PASSWORD }} | |
| APPLE_NOTARY_KEY_ID: ${{ secrets.APPLE_NOTARY_KEY_ID }} | |
| APPLE_NOTARY_ISSUER: ${{ secrets.APPLE_NOTARY_ISSUER }} | |
| APPLE_NOTARY_KEY_B64: ${{ secrets.APPLE_NOTARY_KEY_B64 }} | |
| run: | | |
| if [ -z "${CHAT_REPO_GH_TOKEN}" ]; then | |
| echo "CHAT_REPO_GH_TOKEN is required." >&2 | |
| exit 1 | |
| fi | |
| if [ -z "${APPLE_SIGN_IDENTITY}" ]; then | |
| echo "APPLE_SIGN_IDENTITY is required for Developer ID signing." >&2 | |
| exit 1 | |
| fi | |
| if [ -n "${APPLE_NOTARY_PROFILE}" ]; then | |
| exit 0 | |
| fi | |
| if [ -n "${APPLE_ID}" ] && [ -n "${APPLE_TEAM_ID}" ] && [ -n "${APPLE_APP_SPECIFIC_PASSWORD}" ]; then | |
| exit 0 | |
| fi | |
| if [ -n "${APPLE_NOTARY_KEY_ID}" ] && [ -n "${APPLE_NOTARY_ISSUER}" ] && [ -n "${APPLE_NOTARY_KEY_B64}" ]; then | |
| exit 0 | |
| fi | |
| echo "Notarization credentials are missing." >&2 | |
| echo "Provide APPLE_NOTARY_PROFILE, or APPLE_ID/APPLE_TEAM_ID/APPLE_APP_SPECIFIC_PASSWORD, or APPLE_NOTARY_KEY_ID/APPLE_NOTARY_ISSUER/APPLE_NOTARY_KEY_B64." >&2 | |
| exit 1 | |
| - name: Materialize Notary API key (optional) | |
| env: | |
| APPLE_NOTARY_KEY_B64: ${{ secrets.APPLE_NOTARY_KEY_B64 }} | |
| run: | | |
| if [ -n "${APPLE_NOTARY_KEY_B64}" ]; then | |
| KEY_PATH="${RUNNER_TEMP}/AuthKey_Notary.p8" | |
| printf "%s" "${APPLE_NOTARY_KEY_B64}" | base64 --decode > "${KEY_PATH}" | |
| chmod 600 "${KEY_PATH}" | |
| echo "APPLE_NOTARY_KEY_PATH=${KEY_PATH}" >> "$GITHUB_ENV" | |
| fi | |
| - name: Build, sign, notarize, and publish standalone chat repo | |
| env: | |
| GH_TOKEN: ${{ secrets.CHAT_REPO_GH_TOKEN }} | |
| CHAT_REPO: adpena/silicon-refinery-chat | |
| CHAT_APP_NAME: SiliconRefineryChat | |
| CHAT_REPO_DESCRIPTION: Standalone macOS app for SiliconRefineryChat (Toga + Briefcase). | |
| CHAT_SIGN_MODE: developer-id | |
| CHAT_SIGN_IDENTITY: ${{ secrets.APPLE_SIGN_IDENTITY }} | |
| CHAT_NOTARIZE_MODE: required | |
| APPLE_NOTARY_PROFILE: ${{ secrets.APPLE_NOTARY_PROFILE }} | |
| APPLE_ID: ${{ secrets.APPLE_ID }} | |
| APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }} | |
| APPLE_APP_SPECIFIC_PASSWORD: ${{ secrets.APPLE_APP_SPECIFIC_PASSWORD }} | |
| APPLE_NOTARY_KEY_ID: ${{ secrets.APPLE_NOTARY_KEY_ID }} | |
| APPLE_NOTARY_ISSUER: ${{ secrets.APPLE_NOTARY_ISSUER }} | |
| APPLE_NOTARY_KEY_PATH: ${{ env.APPLE_NOTARY_KEY_PATH }} | |
| RELEASE_TAG_INPUT: ${{ github.event.inputs.release_tag }} | |
| RELEASE_TAG_EVENT: ${{ github.event.release.tag_name }} | |
| run: | | |
| if [ -n "${RELEASE_TAG_INPUT}" ]; then | |
| ./scripts/publish_chat_repo.sh --release-tag "${RELEASE_TAG_INPUT}" | |
| elif [ -n "${RELEASE_TAG_EVENT}" ]; then | |
| ./scripts/publish_chat_repo.sh --release-tag "${RELEASE_TAG_EVENT}" | |
| else | |
| ./scripts/publish_chat_repo.sh | |
| fi |