-
Notifications
You must be signed in to change notification settings - Fork 141
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
This is a minor reorganization of the new CI to be more modular and use more organized patterns. Rather than one large all-in-one workflow, items are now split slightly into discrete parts. Namely, there is a now a PR workflow called for PRs, and a push workflow called for pushes to the master branch, which in turn call constituent workflows for builds and releases. This enables a few conveniences: - Workflows are split into concurrency groups that will automatically cancel themselves. For example, if a PR is pushed multiple times in succession, CI will be automatically canceled for all but the most recent push. - Permissions are applied discretely and in a somewhat more organized way. The PR workflow simply has the "read" permission, while the master push workflow has the "write" permission. While the existing all-in-one workflow was not insecure, it relied on GitHub Actions failsafes (such as pulls from public forks not being granted write permissions nor secrets) in order to work properly, which has the side effect of making the workflow's logic somewhat more difficult to understand. - New workflows can hopefully be more easily created based on constituent parts. For example, the PR flow simply executes "build", while the push workflow simply executes "build" as well as "release". Future workflows could, for example, "build" and then call a new "test" workflow to execute the test harnesses using the built artifacts and report results. This can now be done without requiring as much delicate attention to the existing workflow logic. Future work: - Ideally our "build" workflow could be refactored into a composite action rather than a workflow. This would enable it to use defines created in the initial "pull" or "push" workflows more easily, allowing us to cleanly separate, for example, codesigning-related steps that install secrets on the build machine, from actual build steps/jobs. > [!NOTE] > This was tested on a local fork, but several minor changes were made, so it's opened as a draft until it can be double checked that nothing broke.
- Loading branch information
Showing
6 changed files
with
125 additions
and
82 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,17 @@ | ||
| name: Pull Request | ||
| run-name: ${{ github.event.pull_request.title }} PR run | ||
| on: | ||
| pull_request: | ||
| branches: [ '*' ] | ||
| types: [ opened, synchronize, reopened ] | ||
| permissions: | ||
| contents: read | ||
| concurrency: | ||
| group: '${{ github.workflow }} @ ${{ github.event.pull_request.head.label || github.head_ref || github.ref }}' | ||
| cancel-in-progress: true | ||
| jobs: | ||
| build-project: | ||
| name: Build | ||
| uses: ./.github/workflows/build_new.yml | ||
| permissions: | ||
| contents: read |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,24 @@ | ||
| name: Push | ||
| on: | ||
| push: | ||
| branches: [ master ] | ||
| tags: [ 'v*' ] | ||
| concurrency: | ||
| group: '${{ github.workflow }} @ ${{ github.head_ref || github.ref }}' | ||
| cancel-in-progress: true | ||
| permissions: | ||
| contents: write | ||
| jobs: | ||
| build: | ||
| name: Build ares | ||
| uses: ./.github/workflows/build_new.yml | ||
| secrets: inherit | ||
| with: | ||
| codesign: true | ||
| release: | ||
| name: Release | ||
| needs: build | ||
| secrets: inherit | ||
| uses: ./.github/workflows/release.yml | ||
| with: | ||
| notarize: true |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,63 @@ | ||
| name: Release | ||
| on: | ||
| workflow_call: | ||
| inputs: | ||
| notarize: | ||
| description: Notarize build (macOS only) | ||
| required: false | ||
| default: true | ||
| type: boolean | ||
| jobs: | ||
| release: | ||
| if: github.ref == 'refs/heads/master' || startsWith(github.ref, 'refs/tags/') | ||
| runs-on: macos-latest | ||
| steps: | ||
| - uses: actions/checkout@v4 | ||
| with: | ||
| path: 'src' | ||
| - name: Download Artifacts | ||
| uses: actions/download-artifact@v4 | ||
| with: | ||
| path: 'bin' | ||
| - name: "macOS: notarize" | ||
| if: inputs.notarize | ||
| run: | | ||
| ditto -c -k --keepParent ${{ github.workspace }}/bin/ares-macos-universal/ares.app /tmp/ares.zip | ||
| xcrun notarytool submit /tmp/ares.zip --apple-id "$MACOS_NOTARIZATION_USERNAME" --password "$MACOS_NOTARIZATION_PASSWORD" --team-id "$MACOS_NOTARIZATION_TEAMID" --wait | ||
| xcrun stapler staple ${{ github.workspace }}/bin/ares-macos-universal/ares.app | ||
| env: | ||
| MACOS_NOTARIZATION_USERNAME: ${{ secrets.MACOS_NOTARIZATION_USERNAME }} | ||
| MACOS_NOTARIZATION_PASSWORD: ${{ secrets.MACOS_NOTARIZATION_PASSWORD }} | ||
| MACOS_NOTARIZATION_TEAMID: ${{ secrets.MACOS_NOTARIZATION_TEAMID }} | ||
| - name: Package Artifacts | ||
| run: src/.github/scripts/package_artifacts.sh | ||
| - name: Check Release Tag ☑️ | ||
| id: check | ||
| run: | | ||
| if [[ ${GITHUB_REF_NAME} == master ]]; | ||
| then | ||
| echo "tag=nightly" >> $GITHUB_OUTPUT | ||
| now=$(date +'%Y-%m-%d') | ||
| versionName="nightly ${now}" | ||
| echo "versionName=${versionName}" >> $GITHUB_OUTPUT | ||
| else | ||
| echo "tag=${GITHUB_REF_NAME}" >> $GITHUB_OUTPUT | ||
| echo "versionName=${GITHUB_REF_NAME}" >> $GITHUB_OUTPUT | ||
| fi | ||
| - name: Create Release 🛫 | ||
| id: create_release | ||
| uses: softprops/action-gh-release@c062e08bd532815e2082a85e87e3ef29c3e6d191 | ||
| with: | ||
| draft: ${{ github.ref != 'refs/heads/master' }} | ||
| tag_name: ${{ steps.check.outputs.tag }} | ||
| name: ares ${{ steps.check.outputs.versionName }} | ||
| files: | | ||
| ${{ github.workspace }}/ares-macos-universal.zip | ||
| ${{ github.workspace }}/ares-macos-universal-dSYMs.zip | ||
| ${{ github.workspace }}/ares-windows-x64.zip | ||
| ${{ github.workspace }}/ares-windows-x64-PDBs.zip | ||
| ${{ github.workspace }}/ares-windows-clang-cl-x64.zip | ||
| ${{ github.workspace }}/ares-windows-clang-cl-x64-PDBs.zip | ||
| ${{ github.workspace }}/ares-windows-clang-cl-arm64.zip | ||
| ${{ github.workspace }}/ares-windows-clang-cl-arm64-PDBs.zip |