Separated action workflows into build and build+release

.github/workflows/xcodebuild-nonappstore.yml → .github/workflows/build+release.yml

@@ -1,36 +1,48 @@
-name: Build Sign Notarize and Release Cleepp
+name: Draft Cleepp Release
 
 on:
+  on:
+    create:
   push:
-    branches:
-      - forkmain
-    paths-ignore:
-      - '.github/**'
+    branches: [forkmain]
+    tags:
+      - v*
   workflow_dispatch:
     branches:
       - forkmain
-    inputs:
-      buildRelease:
-        description: 'Also draft a release?'
-        required: true
-        type: boolean
-        default: false
 
 jobs:
   build:
-    name: Non-AppStore Cleep Build, Conditionally Release
-    runs-on: macos-14
+    name: Build Cleepp Non-AppStore Variant and Draft Release
+    runs-on: macos-14 # required to use Xcode 15, "macos-latest" is actually older and uses Xcode 14
+    if: contains(github.ref, 'refs/tags/v')
 
     steps:
       - name: Checkout
         uses: actions/checkout@v3
+
+      - name: Validate Tag
+        id: version
+        run: |
+          echo "Fetching version"
+          versnum=$(xcodebuild -scheme Cleepp -configuration Release -project Maccy.xcodeproj -showBuildSettings | sed -nr 's/^.*MARKETING_VERSION = (.*)$/\1/p')
+
+          echo "Found: $versnum"
+          echo "version=$versnum" >> $GITHUB_OUTPUT
+
+          echo "Validating event trigger (gihub.ref == ${{ github.ref }})"
+          if [[ "${{ github.ref }}" != "refs/tags/v$versnum" ]] ; then
+            echo "Aborting because not triggered by tag matching the current version"
+            exit 1
+          fi
+
       - name: Build
-        # requires "runs-on: macos-14" above to use Xcode 15, "macos-latest" is actually older and uses Xcode 14
         run: |
           xcodebuild clean build analyze -scheme Cleepp -configuration Release -project Maccy.xcodeproj -derivedDataPath . | xcpretty && exit ${PIPESTATUS[0]}
+
       - name: "Codesign app bundle"
         # Extract the secrets we defined earlier as environment variables
-        env: 
+        env:
           MACOS_CERTIFICATE: ${{ secrets.PROD_MACOS_CERTIFICATE }}
           MACOS_CERTIFICATE_PWD: ${{ secrets.PROD_MACOS_CERTIFICATE_PWD }}
           MACOS_CERTIFICATE_NAME: ${{ secrets.PROD_MACOS_CERTIFICATE_NAME }}
@@ -40,24 +52,25 @@ jobs:
           test -d Build/Products/Release/Cleepp.app || exit 1
           ls -ald Build/Products/Release/*.app
           exit 0 # !!! until the above env vars are correctly defined
-          
+
           # Turn our base64-encoded certificate back to a regular .p12 file
-          
+
           echo $MACOS_CERTIFICATE | base64 --decode > certificate.p12
-          
+
           # We need to create a new keychain, otherwise using the certificate will prompt
           # with a UI dialog asking for the certificate password, which we can't
           # use in a headless CI environment
-          
+
           security create-keychain -p "$MACOS_CI_KEYCHAIN_PWD" build.keychain 
           security default-keychain -s build.keychain
           security unlock-keychain -p "$MACOS_CI_KEYCHAIN_PWD" build.keychain
           security import certificate.p12 -k build.keychain -P "$MACOS_CERTIFICATE_PWD" -T /usr/bin/codesign
           security set-key-partition-list -S apple-tool:,apple:,codesign: -s -k "$MACOS_CI_KEYCHAIN_PWD" build.keychain
-          
+
           # We finally codesign our app bundle, specifying the Hardened runtime option
-          
+
           /usr/bin/codesign --force -s "$MACOS_CERTIFICATE_NAME" --options runtime Build/Products/Release/Cleepp.app -v
+
       - name: "Notarize app bundle"
         # Extract the secrets we defined earlier as environment variables
         env:
@@ -68,72 +81,47 @@ jobs:
           echo "Notarizing"
           test -d Build/Products/Release/Cleepp.app || exit 1
           exit 0 # !!! until the above env vars are correctly defined
-          
+
           # Store the notarization credentials so that we can prevent a UI password dialog
           # from blocking the CI
-          
+
           echo "Create keychain profile"
           xcrun notarytool store-credentials "notarytool-profile" --apple-id "$PROD_MACOS_NOTARIZATION_APPLE_ID" --team-id "$PROD_MACOS_NOTARIZATION_TEAM_ID" --password "$PROD_MACOS_NOTARIZATION_PWD"
-          
+
           # We can't notarize an app bundle directly, but we need to compress it as an archive.
           # Therefore, we create a zip file containing our app bundle, so that we can send it to the
           # notarization service
-          
+
           echo "Creating temp notarization archive"
           ditto -c -k --keepParent "target/mac/Cleepp.app" "notarization.zip"
-          
+
           # Here we send the notarization request to the Apple's Notarization service, waiting for the result.
           # This typically takes a few seconds inside a CI environment, but it might take more depending on the App
           # characteristics. Visit the Notarization docs for more information and strategies on how to optimize it if
           # you're curious
-          
+
           echo "Notarize app"
           xcrun notarytool submit "notarization.zip" --keychain-profile "notarytool-profile" --wait
-          
+
           # Finally, we need to "attach the staple" to our executable, which will allow our app to be
           # validated by macOS even when an internet connection is not available.
           echo "Attach staple"
           xcrun stapler staple "Build/Products/Release/Cleepp.app"
-      - name: Extract Version Number
-        run: |
-          echo "Fetching version"
-          test -d Build/Products/Release/Cleepp.app || exit 1
-          test -f Build/Products/Release/Cleepp.app/Contents/Info.plist || exit 2
-          
-          VERSION=$(/usr/libexec/PlistBuddy -c 'Print :CFBundleShortVersionString' Build/Products/Release/Cleepp.app/Contents/Info.plist)
-          echo "Found: $VERSION"
-          echo "version=$VERSION" >> $GITHUB_OUTPUT
-
-          echo "Testing continuation conditions"
-          if [[ "${{ inputs.buildRelease }}" == "true" ]] ; then
-            echo "Will continue and draft release because flag set (buildRelease == ${{ inputs.buildRelease }})"
-            echo "continue=true" >> $GITHUB_OUTPUT
-          else
-            echo "Checking if triggered by tag matching version (gihub.ref == ${{ github.ref }}, buildRelease == ${{ inputs.buildRelease }})"
-            if [[ "${{ github.ref }}" == "refs/tags/v${{ steps.version.outputs.version }}" ]] ; then
-              echo "Will continue and draft release because tag matched version"
-              echo "continue=true" >> $GITHUB_OUTPUT
-            else
-              echo "Will not draft release because this was some other trigger"
-              echo "continue=false" >> $GITHUB_OUTPUT
-            fi
-          fi
-        id: version
+
       - name: Build Zip File
-        if: steps.version.outputs.continue == 'true'
         run: |
           echo "Making archive directory"
           test -d Build/Products/Release/Cleepp.app || exit 1
-          
+
           ARCHIVEDIR=Build/Products/Release/Cleepp\ ${{ steps.version.outputs.version }}
           mkdir "$ARCHIVEDIR"
           cp Designs/Cleepp/Cleepp\ download\ read\ me.rtf "$ARCHIVEDIR"/Cleepp\ version\ ${{ steps.version.outputs.version }}\ read\ me.rtf
           mv Build/Products/Release/Cleepp.app "$ARCHIVEDIR"
-          
+
           echo "Building ${ARCHIVEDIR}.zip"
           ditto -c -k --sequesterRsrc --keepParent "$ARCHIVEDIR" "${ARCHIVEDIR}.zip"
+
       - name: Draft Release
-        if: steps.version.outputs.continue == 'true'
         uses: softprops/action-gh-release@v2
         with:
           name: "Cleepp ${{ steps.version.outputs.version }}"

.github/workflows/build.yml

@@ -0,0 +1,29 @@
+name: Build Cleepp
+
+on:
+  push:
+    branches: [forkmain]
+    paths-ignore:
+      - ".github/**"
+      - ".git/**"
+      - ".gitignore"
+      - "Designs/**"
+      - "*Tests/**"
+      - "*.md"
+      - "*.toml"
+      - "*.xml"
+  workflow_dispatch:
+    branches: [forkmain]
+
+jobs:
+  build:
+    name: Build Cleepp Non-AppStore Variant
+    runs-on: macos-14 # required to use Xcode 15, "macos-latest" is actually older and uses Xcode 14
+    if: ${{ ! contains(github.ref, 'refs/tags') }}
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v3
+      - name: Build
+        run: |
+          xcodebuild clean build analyze -scheme Cleepp -configuration Release -project Maccy.xcodeproj -derivedDataPath . | xcpretty && exit ${PIPESTATUS[0]}