release: promote privacy and capture hardening #30
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Build & Validate | |
| on: | |
| push: | |
| branches: | |
| - main | |
| - develop | |
| pull_request: | |
| branches: | |
| - main | |
| workflow_dispatch: | |
| permissions: | |
| contents: read | |
| concurrency: | |
| group: build-validate-${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }} | |
| cancel-in-progress: true | |
| defaults: | |
| run: | |
| shell: bash | |
| jobs: | |
| leak-check: | |
| name: Public Safety Check | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 10 | |
| steps: | |
| - name: Check out source with full history | |
| run: | | |
| git init . | |
| git remote add origin "https://github.com/${GITHUB_REPOSITORY}.git" | |
| git fetch --no-tags origin "$GITHUB_REF" | |
| git checkout --detach FETCH_HEAD | |
| - name: Audit for private material | |
| run: bash .github/scripts/check-public-safety.sh | |
| lint: | |
| name: SwiftLint | |
| runs-on: macos-latest | |
| timeout-minutes: 15 | |
| steps: | |
| - name: Check out source | |
| run: | | |
| git init . | |
| git remote add origin "https://github.com/${GITHUB_REPOSITORY}.git" | |
| git fetch --no-tags --depth=1 origin "$GITHUB_REF" | |
| git checkout --detach FETCH_HEAD | |
| - name: Install SwiftLint | |
| run: brew install swiftlint | |
| - name: Lint | |
| run: swiftlint lint --strict | |
| test: | |
| name: Test | |
| runs-on: macos-latest | |
| timeout-minutes: 45 | |
| steps: | |
| - name: Check out source | |
| run: | | |
| git init . | |
| git remote add origin "https://github.com/${GITHUB_REPOSITORY}.git" | |
| git fetch --no-tags --depth=1 origin "$GITHUB_REF" | |
| git checkout --detach FETCH_HEAD | |
| # CI has no signing identity and needs none: the tests build unsigned. | |
| # Developer.xcconfig is gitignored, so it has to be written here. | |
| - name: Prepare CI developer config | |
| run: | | |
| cat > Configuration/Developer.xcconfig <<'EOF' | |
| #include "LocalDev.xcconfig" | |
| TRACEXY_TEAM_ID = | |
| CODE_SIGN_IDENTITY = | |
| DEVELOPMENT_TEAM = | |
| EOF | |
| - name: Select newest Xcode | |
| run: | | |
| latest="$(ls -1d /Applications/Xcode*.app 2>/dev/null | sort -V | tail -n 1)" | |
| if [ -z "$latest" ]; then | |
| echo "No Xcode app bundle found on runner." | |
| exit 1 | |
| fi | |
| sudo xcode-select -s "$latest/Contents/Developer" | |
| xcodebuild -version | |
| - name: Run tests | |
| run: | | |
| mkdir -p build/test-results | |
| xcodebuild -project Tracexy.xcodeproj \ | |
| -scheme Tracexy \ | |
| -destination 'platform=macOS' \ | |
| -parallel-testing-enabled NO \ | |
| -resultBundlePath build/test-results/Tracexy.xcresult \ | |
| CODE_SIGN_STYLE=Manual \ | |
| CODE_SIGNING_ALLOWED=NO \ | |
| CODE_SIGNING_REQUIRED=NO \ | |
| CODE_SIGN_IDENTITY="" \ | |
| DEVELOPMENT_TEAM="" \ | |
| PROVISIONING_PROFILE="" \ | |
| PROVISIONING_PROFILE_SPECIFIER="" \ | |
| test | |
| build: | |
| name: Build (Release, unsigned) | |
| needs: | |
| - lint | |
| - test | |
| runs-on: macos-latest | |
| timeout-minutes: 45 | |
| steps: | |
| - name: Check out source | |
| run: | | |
| git init . | |
| git remote add origin "https://github.com/${GITHUB_REPOSITORY}.git" | |
| git fetch --no-tags --depth=1 origin "$GITHUB_REF" | |
| git checkout --detach FETCH_HEAD | |
| - name: Prepare CI developer config | |
| run: | | |
| cat > Configuration/Developer.xcconfig <<'EOF' | |
| #include "LocalDev.xcconfig" | |
| TRACEXY_TEAM_ID = | |
| CODE_SIGN_IDENTITY = | |
| DEVELOPMENT_TEAM = | |
| EOF | |
| - name: Select newest Xcode | |
| run: | | |
| latest="$(ls -1d /Applications/Xcode*.app 2>/dev/null | sort -V | tail -n 1)" | |
| if [ -z "$latest" ]; then | |
| echo "No Xcode app bundle found on runner." | |
| exit 1 | |
| fi | |
| sudo xcode-select -s "$latest/Contents/Developer" | |
| xcodebuild -version | |
| - name: Build Release | |
| run: | | |
| xcodebuild -project Tracexy.xcodeproj \ | |
| -scheme Tracexy \ | |
| -configuration Release \ | |
| -derivedDataPath build/ci \ | |
| CODE_SIGN_STYLE=Manual \ | |
| CODE_SIGNING_ALLOWED=NO \ | |
| CODE_SIGNING_REQUIRED=NO \ | |
| CODE_SIGN_IDENTITY="" \ | |
| DEVELOPMENT_TEAM="" \ | |
| PROVISIONING_PROFILE="" \ | |
| PROVISIONING_PROFILE_SPECIFIER="" \ | |
| build |