release #10
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: release | |
| on: | |
| push: | |
| tags: | |
| - "v*" | |
| workflow_dispatch: | |
| inputs: | |
| tag: | |
| description: "Tag to release (e.g. v0.1.0). Must already exist." | |
| required: true | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.ref }} | |
| cancel-in-progress: false | |
| permissions: | |
| contents: write | |
| actions: write | |
| id-token: write | |
| jobs: | |
| macos: | |
| # wisp-desktop links against APIs that ship only in macOS 26 (Tahoe), | |
| # so the build host has to be Tahoe too. macos-26 is the | |
| # GitHub-hosted Apple Silicon runner image for it. | |
| runs-on: macos-26 | |
| steps: | |
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| with: | |
| ref: ${{ github.event.inputs.tag || github.ref }} | |
| - name: Resolve tag and version | |
| id: meta | |
| run: | | |
| set -euo pipefail | |
| TAG="${{ github.event.inputs.tag || github.ref_name }}" | |
| VERSION="${TAG#v}" | |
| echo "tag=$TAG" >> "$GITHUB_OUTPUT" | |
| echo "version=$VERSION" >> "$GITHUB_OUTPUT" | |
| - name: Select Xcode | |
| run: | | |
| sudo xcode-select -s /Applications/Xcode.app/Contents/Developer | |
| xcrun swift --version | |
| xcrun --find metal | |
| - uses: ./.github/actions/setup-nix | |
| - uses: ./.github/actions/setup-rust-cache | |
| - name: Build wisp-desktop (release) | |
| run: nix develop .#ci --quiet --command cargo build -p wisp-desktop --release --locked | |
| - name: Assemble Wisp.app bundle | |
| run: | | |
| set -euo pipefail | |
| APP="Wisp.app" | |
| rm -rf "$APP" | |
| mkdir -p "$APP/Contents/MacOS" "$APP/Contents/Resources" | |
| cp target/release/wisp-desktop "$APP/Contents/MacOS/wisp-desktop" | |
| chmod +x "$APP/Contents/MacOS/wisp-desktop" | |
| cp apps/wisp-desktop/assets/AppIcon.icns "$APP/Contents/Resources/AppIcon.icns" | |
| sed "s/__VERSION__/${{ steps.meta.outputs.version }}/g" \ | |
| apps/wisp-desktop/Info.plist > "$APP/Contents/Info.plist" | |
| /usr/bin/plutil -lint "$APP/Contents/Info.plist" | |
| - name: Ad-hoc codesign | |
| # No Apple Developer ID yet; ad-hoc (`--sign -`) is enough to make | |
| # Gatekeeper let users open the app via right-click → Open. Once a | |
| # cert is available, swap in the real identity and add notarization. | |
| # | |
| # The entitlements file is required even for ad-hoc signing because | |
| # we enable hardened runtime (--options runtime). Without | |
| # `com.apple.security.device.audio-input`, AVCaptureDevice and | |
| # AVAudioApplication silently return "denied" for the mic | |
| # permission request — no OS prompt, no TCC entry. | |
| run: | | |
| set -euo pipefail | |
| codesign --force --deep --options runtime \ | |
| --entitlements apps/wisp-desktop/wisp-desktop.entitlements \ | |
| --sign - Wisp.app | |
| codesign --verify --verbose Wisp.app | |
| - name: Create DMG | |
| id: dmg | |
| run: | | |
| set -euo pipefail | |
| DMG="wisp-${{ steps.meta.outputs.version }}-aarch64-apple-darwin.dmg" | |
| STAGE="$(mktemp -d)" | |
| ditto Wisp.app "$STAGE/Wisp.app" | |
| ln -s /Applications "$STAGE/Applications" | |
| hdiutil create \ | |
| -volname "Wisp" \ | |
| -srcfolder "$STAGE" \ | |
| -ov -format UDZO \ | |
| "$DMG" | |
| echo "path=$DMG" >> "$GITHUB_OUTPUT" | |
| - name: Publish release | |
| uses: softprops/action-gh-release@718ea10b132b3b2eba29c1007bb80653f286566b # v3.0.1 | |
| with: | |
| tag_name: ${{ steps.meta.outputs.tag }} | |
| name: ${{ steps.meta.outputs.tag }} | |
| draft: false | |
| prerelease: false | |
| generate_release_notes: true | |
| fail_on_unmatched_files: true | |
| files: ${{ steps.dmg.outputs.path }} |