First attempt at build & deploy for macOS with signing and notarisation

.github/workflows/build_and_deploy.yaml

@@ -0,0 +1,91 @@
+name: Build and Deploy
+on:
+  # XXX: REMOVE BEFORE PR LANDS
+  push:
+    branches: [ t3chguy/notarize1 ]
+  # Nightly build
+  schedule:
+    - cron: '0 11 * * *'
+  # Manual nightly & release
+  workflow_dispatch:
+    inputs:
+      mode:
+        description: What type of build to trigger. Release builds should be ran from the `master` branch.
+        required: true
+        default: nightly
+        type: choice
+        options:
+          - nightly
+          - release
+      deploy:
+        description: Whether to deploy artifacts
+        required: true
+        type: boolean
+        default: true
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+jobs:
+  fetch:
+    uses: ./.github/workflows/build_prepare.yaml
+    with:
+      config: "element.io/${{ inputs.mode }}'
+      version: ${{ inputs.mode == 'nightly' && 'develop' || '' }}
+
+#  windows:
+#    needs: fetch
+#    name: Windows
+#    uses: ./.github/workflows/build_windows.yaml
+#    secrets: inherit
+#    strategy:
+#      matrix:
+#        arch: [ x64, x86 ]
+#    with:
+#      arch: ${{ matrix.arch }}
+
+#  linux:
+#    needs: fetch
+#    name: Linux
+#    uses: ./.github/workflows/build_linux.yaml
+#    secrets: inherit
+#    strategy:
+#      matrix:
+#        sqlcipher: [ system, static ]
+#    with:
+#      sqlcipher: ${{ matrix.sqlcipher }}
+
+  macos:
+    needs: fetch
+    name: macOS
+    uses: ./.github/workflows/build_macos.yaml
+    secrets: inherit
+    with:
+      sign: true
+      deploy-mode: true
+      base-url: https://packages.element.io/${{ inputs.mode == 'nightly' && 'nightly' || 'desktop' }}
+      # TODO this needs to be dynamic
+      version: 2022121309
+
+  deploy:
+    needs:
+#      - windows
+#      - linux
+      - macos
+    name: Deploy
+    if: inputs.deploy
+    environment: develop
+    steps:
+      - name: Download artifacts
+        uses: actions/download-artifact@v3
+        with:
+          name: packages.element.io
+
+      - name: Deploy artifacts
+        run: aws s3 cp --recursive packages.element.io/ s3://$R2_BUCKET/ --endpoint-url $R2_URL --region auto
+        env:
+          # XXX: UPDATE THIS BEFORE LANDING THE PR
+          R2_BUCKET: 'packages-element-io-test'
+          R2_URL: ${{ secrets.CF_R2_S3_API }}
+          AWS_ACCESS_KEY_ID: ${{ secrets.CF_R2_ACCESS_KEY_ID }}
+          AWS_SECRET_ACCESS_KEY: ${{ secrets.CF_R2_TOKEN }}
+

.github/workflows/build_macos.yaml

@@ -1,8 +1,37 @@
 on:
   workflow_call:
+    secrets:
+      APPLE_ID:
+        required: false
+      APPLE_ID_PASSWORD:
+        required: false
+      APPLE_TEAM_ID:
+        required: false
+      APPLE_CSC_KEY_PASSWORD:
+        required: false
+      APPLE_CSC_LINK:
+        required: false
+    inputs:
+      version:
+        type: string
+        required: false
+        description: "Version string to override the one in package.json, used for non-release builds"
+      sign:
+        type: string
+        required: false
+        description: "Whether to sign & notarise the build, requires 'develop' environment"
+      deploy-mode:
+        type: string
+        required: false
+        description: "Whether to arrange artifacts in the arrangement needed for deployment, skipping unrelated ones"
+      base-url:
+        type: string
+        required: false
+        description: "The URL to which the output will be deployed, required if deploy-mode is enabled."
 jobs:
   build:
     runs-on: macos-latest
+    environment: ${{ inputs.sign && "develop" }}
     steps:
       - uses: actions/checkout@v3
 
@@ -34,12 +63,56 @@ jobs:
       - name: Build Natives
         run: "yarn build:native:universal"
 
+      - name: Generate Nightly build config
+        if: inputs.version
+        run: scripts/generate-builder-config.ts --nightly "${{ inputs.version }}"
+
       - name: Build App
         run: "yarn build:universal --publish never"
+        env:
+          NOTARIZE_APPLE_ID: ${{ secrets.APPLE_ID }}
+          NOTARIZE_APPLE_ID_PASSWORD: ${{ secrets.APPLE_ID_PASSWORD }}
+          NOTARIZE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
+          CSC_KEY_PASSWORD: ${{ secrets.APPLE_CSC_KEY_PASSWORD }}
+          CSC_LINK: ${{ secrets.APPLE_CSC_LINK }}
+
+      - name: Prepare artifacts for deployment
+        if: inputs.deploy-mode
+        run: |
+          mv dist _dist
+          mkdir -p dist/install/macos dist/update/macos
+          mv _dist/*.dmg _dist/*-mac.zip dist/
+
+          PKG_JSON_VERSION=$(cat package.json | jq -r .version)
+          VERSION="${{ inputs.version }}"
+          LATEST=$(find dist -type f -iname "*-mac.zip" | xargs -0 -n1 -- basename)
+          URL="${{ inputs.base-url }}/update/macos/$LATEST"
+
+          jq -n --arg version "${VERSION:-$PKG_JSON_VERSION}" --arg url "$URL" '
+            {
+              currentRelease: $version,
+              releases: [{
+                version: $version,
+                updateTo: {
+                  version: $version,
+                  url: $url,
+                },
+              }],
+            }
+          ' > dist/update/macos/releases.json
+          jq -n --arg version "${VERSION:-$PKG_JSON_VERSION}" --arg url "$URL" '
+            { url: $url }
+          ' > dist/update/macos/releases-legacy.json
+
+      - name: Prepare release latest symlink
+        if: inputs.deploy-mode && inputs.version == ''
+        run: |
+          LATEST=$(find dist -type f -iname "*.dmg" | xargs -0 -n1 -- basename)
+          ln -s "dist/install/macos/$LATEST" dist/install/macos/Element.dmg
 
       - name: Upload Artifacts
         uses: actions/upload-artifact@v3
         with:
-          name: macos
+          name: ${{ inputs.deploy-mode && 'packages.element.io' || 'macos' }}
           path: dist
           retention-days: 1

.github/workflows/packages_index.yaml

@@ -5,14 +5,20 @@ on:
     branches: [ develop ]
     paths:
       - 'packages.element.io/**'
-  # Trigger a daily rebuild for nightlies
+  # Trigger a daily rebuild for (mac-mini built) Nightly builds
   schedule:
     - cron: '0 11 * * *'
+  # Trigger after Nightly builds are deployed
+  workflow_run:
+    workflows: [ "Build and Deploy" ]
+    types:
+      - completed
   # Manual trigger for rebuilding for releases
   workflow_dispatch: { }
 jobs:
   deploy:
     name: "Deploy"
+    if: github.event != 'workflow_run' || github.event.workflow_run.conclusion == 'success'
     runs-on: ubuntu-latest
     environment: develop
     env: