WIP: feat(workflows): add new build workflows for Windows, Linux, and macOS, and remove obsolete build scripts #17
@ -22,6 +22,9 @@ jobs:
|
|||||||
WORKSPACE_DIR="$(pwd)"
|
WORKSPACE_DIR="$(pwd)"
|
||||||
echo "WORKSPACE_DIR=$WORKSPACE_DIR" >> "$GITHUB_ENV"
|
echo "WORKSPACE_DIR=$WORKSPACE_DIR" >> "$GITHUB_ENV"
|
||||||
echo "ENTITLEMENTS_FILE=LuckyWorld.entitlements" >> "$GITHUB_ENV"
|
echo "ENTITLEMENTS_FILE=LuckyWorld.entitlements" >> "$GITHUB_ENV"
|
||||||
|
|
||||||
|
# Set CI environment variable to true for build script
|
||||||
|
echo "CI=true" >> "$GITHUB_ENV"
|
||||||
|
|
||||||
# Create directories for builds
|
# Create directories for builds
|
||||||
mkdir -p Builds/Mac
|
mkdir -p Builds/Mac
|
||||||
@ -58,6 +61,8 @@ jobs:
|
|||||||
run: |
|
run: |
|
||||||
if [ -f "./scripts/mac_build.sh" ]; then
|
if [ -f "./scripts/mac_build.sh" ]; then
|
||||||
chmod +x ./scripts/mac_build.sh
|
chmod +x ./scripts/mac_build.sh
|
||||||
|
# Set CI environment variable explicitly before running
|
||||||
|
export CI=true
|
||||||
./scripts/mac_build.sh
|
./scripts/mac_build.sh
|
||||||
else
|
else
|
||||||
echo "ERROR: Build script not found at ./scripts/mac_build.sh"
|
echo "ERROR: Build script not found at ./scripts/mac_build.sh"
|
||||||
|
|||||||
@ -13,20 +13,34 @@ PROJECT_ROOT="$(pwd)"
|
|||||||
PROJECT_FILE="$PROJECT_ROOT/LuckyWorld.uproject"
|
PROJECT_FILE="$PROJECT_ROOT/LuckyWorld.uproject"
|
||||||
ARCHIVE_DIR="$PROJECT_ROOT/Builds"
|
ARCHIVE_DIR="$PROJECT_ROOT/Builds"
|
||||||
|
|
||||||
|
# Check if running in CI environment
|
||||||
|
if [ -n "$GITHUB_ACTIONS" ] || [ -n "$CI" ]; then
|
||||||
|
# Skip certificate check in CI environment
|
||||||
|
echo "🔄 Running in CI environment, skipping certificate checks"
|
||||||
|
RUNNING_IN_CI=true
|
||||||
|
else
|
||||||
|
RUNNING_IN_CI=false
|
||||||
|
fi
|
||||||
|
|
||||||
# Check for Developer ID certificate
|
# Check for Developer ID certificate
|
||||||
CERTIFICATE_NAME=""
|
CERTIFICATE_NAME=""
|
||||||
if [ -z "$CERTIFICATE_NAME" ]; then
|
if [ "$RUNNING_IN_CI" = "false" ]; then
|
||||||
# Try to find a Developer ID Application certificate
|
# Only check for certificate in non-CI environments
|
||||||
CERTIFICATE_NAME=$(security find-identity -v -p codesigning | grep "Developer ID Application" | head -1 | sed -E 's/.*"(Developer ID Application.*)"$/\1/')
|
|
||||||
|
|
||||||
if [ -z "$CERTIFICATE_NAME" ]; then
|
if [ -z "$CERTIFICATE_NAME" ]; then
|
||||||
echo "⚠️ No Developer ID Application certificate found. Please specify a valid certificate name."
|
# Try to find a Developer ID Application certificate
|
||||||
echo "Available certificates:"
|
CERTIFICATE_NAME=$(security find-identity -v -p codesigning | grep "Developer ID Application" | head -1 | sed -E 's/.*"(Developer ID Application.*)"$/\1/')
|
||||||
security find-identity -v -p codesigning
|
|
||||||
exit 1
|
if [ -z "$CERTIFICATE_NAME" ]; then
|
||||||
else
|
echo "⚠️ No Developer ID Application certificate found. Please specify a valid certificate name."
|
||||||
echo "🔑 Found Developer ID certificate: $CERTIFICATE_NAME"
|
echo "Available certificates:"
|
||||||
|
security find-identity -v -p codesigning
|
||||||
|
echo "Continuing build without signing..."
|
||||||
|
else
|
||||||
|
echo "🔑 Found Developer ID certificate: $CERTIFICATE_NAME"
|
||||||
|
fi
|
||||||
fi
|
fi
|
||||||
|
else
|
||||||
|
echo "🔄 Skipping local certificate check - signing will be handled in CI pipeline"
|
||||||
fi
|
fi
|
||||||
|
|
||||||
# Check for entitlements file
|
# Check for entitlements file
|
||||||
@ -44,7 +58,11 @@ echo "Project root: $PROJECT_ROOT"
|
|||||||
echo "Project file: $PROJECT_FILE"
|
echo "Project file: $PROJECT_FILE"
|
||||||
echo "Archive directory: $ARCHIVE_DIR"
|
echo "Archive directory: $ARCHIVE_DIR"
|
||||||
echo "Entitlements file: $ENTITLEMENTS_FILE"
|
echo "Entitlements file: $ENTITLEMENTS_FILE"
|
||||||
echo "Signing with certificate: $CERTIFICATE_NAME"
|
if [ "$RUNNING_IN_CI" = "false" ] && [ -n "$CERTIFICATE_NAME" ]; then
|
||||||
|
echo "Signing with certificate: $CERTIFICATE_NAME"
|
||||||
|
else
|
||||||
|
echo "Not signing locally - will be handled in CI"
|
||||||
|
fi
|
||||||
|
|
||||||
# Clean up previous build artifacts
|
# Clean up previous build artifacts
|
||||||
rm -rf DerivedDataCache Intermediate Binaries Saved
|
rm -rf DerivedDataCache Intermediate Binaries Saved
|
||||||
@ -146,116 +164,118 @@ if [ -n "$APP_PATH" ]; then
|
|||||||
fi
|
fi
|
||||||
fi
|
fi
|
||||||
|
|
||||||
# Recursive signing function - signs all binary files
|
# Only perform signing if not in CI and certificate is available
|
||||||
function sign_recursively() {
|
if [ "$RUNNING_IN_CI" = "false" ] && [ -n "$CERTIFICATE_NAME" ] && [ -n "$ENTITLEMENTS_FILE" ]; then
|
||||||
local app_path="$1"
|
# Recursive signing function - signs all binary files
|
||||||
local entitlements_file="$2"
|
function sign_recursively() {
|
||||||
local certificate="$3"
|
local app_path="$1"
|
||||||
local counter=0
|
local entitlements_file="$2"
|
||||||
local total=0
|
local certificate="$3"
|
||||||
local failed=0
|
local counter=0
|
||||||
|
local total=0
|
||||||
# First calculate total file count
|
local failed=0
|
||||||
# Find all binary files (executables, dylibs, .so files, frameworks)
|
|
||||||
echo "Scanning for binary files..."
|
|
||||||
|
|
||||||
# Executable binary files (libraries, executables)
|
|
||||||
binaries=$(find "$app_path" -type f \( -name "*.dylib" -o -name "*.so" -o -perm +111 \) | sort)
|
|
||||||
total=$(echo "$binaries" | wc -l)
|
|
||||||
|
|
||||||
echo "Found $total binary files to sign"
|
|
||||||
|
|
||||||
# Sign helper binary files (in order of preference)
|
|
||||||
echo "Signing all binary files (libraries and executables)..."
|
|
||||||
echo "$binaries" | while read -r binary; do
|
|
||||||
counter=$((counter + 1))
|
|
||||||
|
|
||||||
# Show progress every 20 files
|
# First calculate total file count
|
||||||
if [ $((counter % 20)) -eq 0 ] || [ $counter -eq 1 ] || [ $counter -eq $total ]; then
|
# Find all binary files (executables, dylibs, .so files, frameworks)
|
||||||
echo "Progress: $counter/$total - Signing: $binary"
|
echo "Scanning for binary files..."
|
||||||
|
|
||||||
|
# Executable binary files (libraries, executables)
|
||||||
|
binaries=$(find "$app_path" -type f \( -name "*.dylib" -o -name "*.so" -o -perm +111 \) | sort)
|
||||||
|
total=$(echo "$binaries" | wc -l)
|
||||||
|
|
||||||
|
echo "Found $total binary files to sign"
|
||||||
|
|
||||||
|
# Sign helper binary files (in order of preference)
|
||||||
|
echo "Signing all binary files (libraries and executables)..."
|
||||||
|
echo "$binaries" | while read -r binary; do
|
||||||
|
counter=$((counter + 1))
|
||||||
|
|
||||||
|
# Show progress every 20 files
|
||||||
|
if [ $((counter % 20)) -eq 0 ] || [ $counter -eq 1 ] || [ $counter -eq $total ]; then
|
||||||
|
echo "Progress: $counter/$total - Signing: $binary"
|
||||||
|
fi
|
||||||
|
|
||||||
|
# Skip if not a regular file (symbolic links etc)
|
||||||
|
if [ ! -f "$binary" ]; then
|
||||||
|
continue
|
||||||
|
fi
|
||||||
|
|
||||||
|
# Check file type
|
||||||
|
file_info=$(file "$binary")
|
||||||
|
|
||||||
|
# Only sign Mach-O files
|
||||||
|
if ! echo "$file_info" | grep -q "Mach-O"; then
|
||||||
|
continue
|
||||||
|
fi
|
||||||
|
|
||||||
|
if [[ "$binary" == *CrashReportClient* ]]; then
|
||||||
|
echo "🛠️ Special handling for CrashReportClient: $binary"
|
||||||
|
fi
|
||||||
|
|
||||||
|
# Sign with timestamp and runtime options
|
||||||
|
codesign --force --options runtime --deep --sign "$certificate" --timestamp --entitlements "$entitlements_file" "$binary" 2>&1 || {
|
||||||
|
echo "⚠️ Failed to sign: $binary"
|
||||||
|
failed=$((failed + 1))
|
||||||
|
}
|
||||||
|
done
|
||||||
|
|
||||||
|
# Show ENTITLEMENTS content for reference
|
||||||
|
echo "Using entitlements file for signatures:"
|
||||||
|
cat "$entitlements_file"
|
||||||
|
|
||||||
|
# Find all nested apps and sign them
|
||||||
|
nested_apps=$(find "$app_path" -name "*.app" -type d)
|
||||||
|
|
||||||
|
if [ -n "$nested_apps" ]; then
|
||||||
|
echo "Signing nested applications..."
|
||||||
|
echo "$nested_apps" | while read -r nested_app; do
|
||||||
|
if [ "$nested_app" != "$app_path" ]; then
|
||||||
|
echo "Signing nested app: $nested_app"
|
||||||
|
|
||||||
|
# Set Bundle ID in Info.plist if it exists before signing
|
||||||
|
nested_info="$nested_app/Contents/Info.plist"
|
||||||
|
if [ -f "$nested_info" ]; then
|
||||||
|
echo "Setting bundle identifier for nested app"
|
||||||
|
/usr/libexec/PlistBuddy -c "Set :CFBundleIdentifier com.luckyrobots.luckyworld.nested" "$nested_info" 2>/dev/null || true
|
||||||
|
fi
|
||||||
|
|
||||||
|
codesign --force --options runtime --deep --sign "$certificate" --timestamp --entitlements "$entitlements_file" "$nested_app" 2>&1 || {
|
||||||
|
echo "⚠️ Failed to sign nested app: $nested_app"
|
||||||
|
failed=$((failed + 1))
|
||||||
|
}
|
||||||
|
fi
|
||||||
|
done
|
||||||
fi
|
fi
|
||||||
|
|
||||||
# Skip if not a regular file (symbolic links etc)
|
# Sign the main application
|
||||||
if [ ! -f "$binary" ]; then
|
echo "Signing main application: $app_path"
|
||||||
continue
|
codesign --force --options runtime --deep --sign "$certificate" --timestamp --entitlements "$entitlements_file" "$app_path" 2>&1 || {
|
||||||
fi
|
echo "⚠️ Failed to sign main app: $app_path"
|
||||||
|
|
||||||
# Check file type
|
|
||||||
file_info=$(file "$binary")
|
|
||||||
|
|
||||||
# Only sign Mach-O files
|
|
||||||
if ! echo "$file_info" | grep -q "Mach-O"; then
|
|
||||||
continue
|
|
||||||
fi
|
|
||||||
|
|
||||||
if [[ "$binary" == *CrashReportClient* ]]; then
|
|
||||||
echo "🛠️ Special handling for CrashReportClient: $binary"
|
|
||||||
fi
|
|
||||||
|
|
||||||
# Sign with timestamp and runtime options
|
|
||||||
codesign --force --options runtime --deep --sign "$certificate" --timestamp --entitlements "$entitlements_file" "$binary" 2>&1 || {
|
|
||||||
echo "⚠️ Failed to sign: $binary"
|
|
||||||
failed=$((failed + 1))
|
failed=$((failed + 1))
|
||||||
}
|
}
|
||||||
done
|
|
||||||
|
echo "✅ Signing completed: $counter files processed, $failed failures"
|
||||||
# Show ENTITLEMENTS content for reference
|
|
||||||
echo "Using entitlements file for signatures:"
|
# Check signing status
|
||||||
cat "$entitlements_file"
|
echo "Verifying signatures..."
|
||||||
|
codesign -vvv --deep --strict "$app_path"
|
||||||
# Find all nested apps and sign them
|
|
||||||
nested_apps=$(find "$app_path" -name "*.app" -type d)
|
# Check Hardened Runtime and other security settings
|
||||||
|
echo "Checking security settings (Hardened Runtime, etc.):"
|
||||||
if [ -n "$nested_apps" ]; then
|
codesign -d --entitlements - "$app_path" | grep -i "runtime\|hardened\|security"
|
||||||
echo "Signing nested applications..."
|
|
||||||
echo "$nested_apps" | while read -r nested_app; do
|
# Check CrashReportClient specifically (problematic file)
|
||||||
if [ "$nested_app" != "$app_path" ]; then
|
crash_reporter=$(find "$app_path" -path "*CrashReportClient.app/Contents/MacOS/CrashReportClient" -type f | head -1)
|
||||||
echo "Signing nested app: $nested_app"
|
if [ -n "$crash_reporter" ]; then
|
||||||
|
echo "Checking CrashReportClient specifically:"
|
||||||
# Set Bundle ID in Info.plist if it exists before signing
|
codesign -d --entitlements - "$crash_reporter" | grep -i "runtime\|hardened\|security"
|
||||||
nested_info="$nested_app/Contents/Info.plist"
|
fi
|
||||||
if [ -f "$nested_info" ]; then
|
|
||||||
echo "Setting bundle identifier for nested app"
|
|
||||||
/usr/libexec/PlistBuddy -c "Set :CFBundleIdentifier com.luckyrobots.luckyworld.nested" "$nested_info" 2>/dev/null || true
|
|
||||||
fi
|
|
||||||
|
|
||||||
codesign --force --options runtime --deep --sign "$certificate" --timestamp --entitlements "$entitlements_file" "$nested_app" 2>&1 || {
|
|
||||||
echo "⚠️ Failed to sign nested app: $nested_app"
|
|
||||||
failed=$((failed + 1))
|
|
||||||
}
|
|
||||||
fi
|
|
||||||
done
|
|
||||||
fi
|
|
||||||
|
|
||||||
# Sign the main application
|
|
||||||
echo "Signing main application: $app_path"
|
|
||||||
codesign --force --options runtime --deep --sign "$certificate" --timestamp --entitlements "$entitlements_file" "$app_path" 2>&1 || {
|
|
||||||
echo "⚠️ Failed to sign main app: $app_path"
|
|
||||||
failed=$((failed + 1))
|
|
||||||
}
|
}
|
||||||
|
|
||||||
echo "✅ Signing completed: $counter files processed, $failed failures"
|
|
||||||
|
|
||||||
# Check signing status
|
|
||||||
echo "Verifying signatures..."
|
|
||||||
codesign -vvv --deep --strict "$app_path"
|
|
||||||
|
|
||||||
# Check Hardened Runtime and other security settings
|
|
||||||
echo "Checking security settings (Hardened Runtime, etc.):"
|
|
||||||
codesign -d --entitlements - "$app_path" | grep -i "runtime\|hardened\|security"
|
|
||||||
|
|
||||||
# Check CrashReportClient specifically (problematic file)
|
|
||||||
crash_reporter=$(find "$app_path" -path "*CrashReportClient.app/Contents/MacOS/CrashReportClient" -type f | head -1)
|
|
||||||
if [ -n "$crash_reporter" ]; then
|
|
||||||
echo "Checking CrashReportClient specifically:"
|
|
||||||
codesign -d --entitlements - "$crash_reporter" | grep -i "runtime\|hardened\|security"
|
|
||||||
fi
|
|
||||||
}
|
|
||||||
|
|
||||||
# Check libraries and perform post-processing if needed
|
# Check libraries and perform post-processing if needed
|
||||||
echo ""
|
echo ""
|
||||||
echo "🔍 Performing comprehensive signing and hardening of all binaries..."
|
echo "🔍 Performing comprehensive signing and hardening of all binaries..."
|
||||||
if [ -n "$APP_PATH" ] && [ -n "$ENTITLEMENTS_FILE" ]; then
|
|
||||||
# Sign all binary files recursively
|
# Sign all binary files recursively
|
||||||
sign_recursively "$APP_PATH" "$ENTITLEMENTS_FILE" "$CERTIFICATE_NAME"
|
sign_recursively "$APP_PATH" "$ENTITLEMENTS_FILE" "$CERTIFICATE_NAME"
|
||||||
|
|
||||||
@ -280,9 +300,15 @@ if [ -n "$APP_PATH" ] && [ -n "$ENTITLEMENTS_FILE" ]; then
|
|||||||
echo "xcrun notarytool submit \"$ZIP_PATH\" --apple-id \"YOUR_APPLE_ID\" --password \"APP_SPECIFIC_PASSWORD\" --team-id \"YOUR_TEAM_ID\" --wait"
|
echo "xcrun notarytool submit \"$ZIP_PATH\" --apple-id \"YOUR_APPLE_ID\" --password \"APP_SPECIFIC_PASSWORD\" --team-id \"YOUR_TEAM_ID\" --wait"
|
||||||
echo ""
|
echo ""
|
||||||
else
|
else
|
||||||
echo "❌ App path or entitlements file not found, cannot perform comprehensive signing"
|
# Skip signing locally - CI will handle it
|
||||||
echo "App path: $APP_PATH"
|
if [ "$RUNNING_IN_CI" = "true" ]; then
|
||||||
echo "Entitlements file: $ENTITLEMENTS_FILE"
|
echo "Skipping local signing - CI pipeline will handle signing and notarization"
|
||||||
|
else
|
||||||
|
echo "❌ Local signing skipped - certificate or entitlements file not available"
|
||||||
|
echo "App path: $APP_PATH"
|
||||||
|
echo "Entitlements file: $ENTITLEMENTS_FILE"
|
||||||
|
echo "Certificate: $CERTIFICATE_NAME"
|
||||||
|
fi
|
||||||
fi
|
fi
|
||||||
|
|
||||||
echo ""
|
echo ""
|
||||||
|
|||||||
Loading…
x
Reference in New Issue
Block a user