|
| 1 | +# This workflow builds binaries for a closed-source package. |
| 2 | +# The output is an XCFramework container(!) zip a dSYMs zip. |
| 3 | + |
| 4 | +# For this to work you must define these repository secrets: |
| 5 | +# - BUILD_CERTIFICATE_BASE64 |
| 6 | +# - P12_PASSWORD |
| 7 | +# - KEYCHAIN_PASSWORD |
| 8 | + |
| 9 | +# VERY IMPORTANT! |
| 10 | +# The XCFramework zip is a CONTAINER with the actual zip inside! |
| 11 | +# You must download and unzip it, then upload the nested zip to a release. |
| 12 | +# Uploading the container zip file will make Xcode fail to use the release. |
| 13 | + |
| 14 | +# For more information see: |
| 15 | +# https://danielsaidi.com/blog/2025/11/09/building-closed-source-binaries-with-github-actions |
| 16 | + |
| 17 | +name: Create Binary Artifacts |
| 18 | + |
| 19 | +on: |
| 20 | + workflow_dispatch: |
| 21 | + inputs: |
| 22 | + bump_type: |
| 23 | + description: 'Version bump' |
| 24 | + required: false |
| 25 | + type: choice |
| 26 | + options: |
| 27 | + - none |
| 28 | + - patch |
| 29 | + - minor |
| 30 | + - major |
| 31 | + - custom |
| 32 | + default: none |
| 33 | + custom_version: |
| 34 | + description: 'Custom version (for "custom")' |
| 35 | + required: false |
| 36 | + type: string |
| 37 | + |
| 38 | +permissions: |
| 39 | + contents: write |
| 40 | + |
| 41 | +jobs: |
| 42 | + build: |
| 43 | + runs-on: macos-15 # macos-latest |
| 44 | + |
| 45 | + steps: |
| 46 | + - name: Checkout |
| 47 | + uses: actions/checkout@v4 |
| 48 | + with: |
| 49 | + fetch-depth: 0 # Fetch all history and tags (needed for version bumping) |
| 50 | + |
| 51 | + - name: Get Package Name |
| 52 | + run: | |
| 53 | + PACKAGE_NAME=$(./scripts/package_name.sh) |
| 54 | + echo "PACKAGE_NAME=$PACKAGE_NAME" >> $GITHUB_ENV |
| 55 | +
|
| 56 | + - name: Install build certificate |
| 57 | + env: |
| 58 | + BUILD_CERTIFICATE_BASE64: ${{ secrets.BUILD_CERTIFICATE_BASE64 }} |
| 59 | + P12_PASSWORD: ${{ secrets.P12_PASSWORD }} |
| 60 | + KEYCHAIN_PASSWORD: ${{ secrets.KEYCHAIN_PASSWORD }} |
| 61 | + run: | |
| 62 | + # create variables |
| 63 | + CERTIFICATE_PATH=$RUNNER_TEMP/build_certificate.p12 |
| 64 | + KEYCHAIN_PATH=$RUNNER_TEMP/app-signing.keychain-db |
| 65 | +
|
| 66 | + # import certificate from secrets |
| 67 | + echo -n "$BUILD_CERTIFICATE_BASE64" | base64 --decode -o $CERTIFICATE_PATH |
| 68 | +
|
| 69 | + # create temporary keychain |
| 70 | + security create-keychain -p "$KEYCHAIN_PASSWORD" $KEYCHAIN_PATH |
| 71 | + security set-keychain-settings -lut 21600 $KEYCHAIN_PATH |
| 72 | + security unlock-keychain -p "$KEYCHAIN_PASSWORD" $KEYCHAIN_PATH |
| 73 | +
|
| 74 | + # import certificate to keychain |
| 75 | + security import $CERTIFICATE_PATH -P "$P12_PASSWORD" -A -t cert -f pkcs12 -k $KEYCHAIN_PATH |
| 76 | + security set-key-partition-list -S apple-tool:,apple: -k "$KEYCHAIN_PASSWORD" $KEYCHAIN_PATH |
| 77 | + security list-keychain -d user -s $KEYCHAIN_PATH |
| 78 | +
|
| 79 | + - name: Set up Xcode |
| 80 | + uses: maxim-lobanov/setup-xcode@v1 |
| 81 | + with: |
| 82 | + xcode-version: 16.4 # latest-stable |
| 83 | + |
| 84 | + - name: Validate Project |
| 85 | + run: ./scripts/validate_release.sh -p iOS --swiftlint 0 |
| 86 | + |
| 87 | + - name: Run framwork script |
| 88 | + run: ./scripts/framework.sh -p iOS --dsyms 1 --zip 1 |
| 89 | + |
| 90 | + - name: Upload XCFramework ZIP |
| 91 | + uses: actions/upload-artifact@v4 |
| 92 | + with: |
| 93 | + name: ${{ env.PACKAGE_NAME }} |
| 94 | + path: .build/${{ env.PACKAGE_NAME }}.zip |
| 95 | + if-no-files-found: error |
| 96 | + |
| 97 | + - name: Upload dSYMs |
| 98 | + uses: actions/upload-artifact@v4 |
| 99 | + with: |
| 100 | + name: ${{ env.PACKAGE_NAME }}-dSYMs |
| 101 | + path: .build/dSYMs |
| 102 | + if-no-files-found: error |
| 103 | + |
| 104 | + - name: Configure Git |
| 105 | + if: ${{ inputs.bump_type != 'none' }} |
| 106 | + run: | |
| 107 | + git config user.name "github-actions[bot]" |
| 108 | + git config user.email "github-actions[bot]@users.noreply.github.com" |
| 109 | +
|
| 110 | + - name: Bump Version |
| 111 | + if: ${{ inputs.bump_type != 'none' }} |
| 112 | + run: | |
| 113 | + if [ "${{ inputs.bump_type }}" = "custom" ]; then |
| 114 | + if [ -z "${{ inputs.custom_version }}" ]; then |
| 115 | + echo "Error: Custom version not provided" |
| 116 | + exit 1 |
| 117 | + fi |
| 118 | + ./scripts/version_bump.sh --version "${{ inputs.custom_version }}" |
| 119 | + else |
| 120 | + ./scripts/version_bump.sh --type "${{ inputs.bump_type }}" |
| 121 | + fi |
0 commit comments