debug_macos.yml

#     Copyright 2024, MCSL Team, mailto:services@mcsl.com.cn
#
#     Part of "MCSL2", a simple and multifunctional Minecraft server launcher.
#
#     Licensed under the GNU General Public License, Version 3.0, with our
#     additional agreements. (the "License");
#     you may not use this file except in compliance with the License.
#     You may obtain a copy of the License at
#
#        https://github.com/MCSLTeam/MCSL2/raw/master/LICENSE
#
################################################################################
name: macOS Debug Build

on: workflow_dispatch

env:
  PYTHON_VERSION: "3.8"
  MACOS_CERTIFICATE_BASE64: ${{ secrets.MACOS_CERTIFICATE_BASE64 }}
  MACOS_CERTIFICATE_PASSWORD: ${{ secrets.MACOS_CERTIFICATE_PASSWORD }}
  MACOS_CODESIGN_IDENTITY: ${{ secrets.MACOS_CODESIGN_IDENTITY }}
  MACOS_KEYCHAIN_PASSWORD: ${{ secrets.MACOS_KEYCHAIN_PASSWORD }}
  APPLE_ID: ${{ secrets.APPLE_ID }}
  APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
  APPLE_APP_SPECIFIC_PASSWORD: ${{ secrets.APPLE_APP_SPECIFIC_PASSWORD }}

jobs:
  macOS:
    strategy:
      matrix:
        include:
          - architecture: arm64
            runner: macos-14
          - architecture: x64
            runner: macos-15-intel
    runs-on: ${{ matrix.runner }}
    steps:
      - name: Checkout Repo
        uses: actions/checkout@v6.0.3

      - name: Setup uv
        uses: astral-sh/setup-uv@v8.2.0
        with:
          enable-cache: true
          cache-dependency-glob: |
            pyproject.toml
            uv.lock

      - name: Install Python
        run: uv python install ${{ env.PYTHON_VERSION }}

      - name: Sync Dependencies
        run: uv sync --no-dev --locked

      - name: Build
        run: uv run deploy.py

      - name: Prepare app bundle
        run: |
          app="build/MCSL2.app"
          exe="$app/Contents/MacOS/MCSL2"
          chmod +x "$exe"
          rm -rf "build/MCSL2.build" "build/MCSL2.dist"
          find "$app" -name "__pycache__" -type d -prune -exec rm -rf {} +
          find "$app" -name "*.pyc" -delete
          find "$app" -name ".DS_Store" -delete

      - name: Import Apple signing certificate
        if: >-
          ${{
            env.MACOS_CERTIFICATE_BASE64 != ''
            && env.MACOS_CERTIFICATE_PASSWORD != ''
            && env.MACOS_CODESIGN_IDENTITY != ''
            && env.MACOS_KEYCHAIN_PASSWORD != ''
          }}
        run: |
          certificate_path="$RUNNER_TEMP/mcsl2-signing-certificate.p12"
          keychain_path="$RUNNER_TEMP/mcsl2-signing.keychain-db"

          echo "$MACOS_CERTIFICATE_BASE64" | base64 --decode > "$certificate_path"
          security create-keychain -p "$MACOS_KEYCHAIN_PASSWORD" "$keychain_path"
          security set-keychain-settings -lut 21600 "$keychain_path"
          security unlock-keychain -p "$MACOS_KEYCHAIN_PASSWORD" "$keychain_path"
          security import "$certificate_path" -P "$MACOS_CERTIFICATE_PASSWORD" -A -t cert -f pkcs12 -k "$keychain_path"
          security list-keychains -d user -s "$keychain_path"
          security set-key-partition-list -S apple-tool:,apple:,codesign: -s -k "$MACOS_KEYCHAIN_PASSWORD" "$keychain_path"

      - name: Sign app bundle
        if: >-
          ${{
            env.MACOS_CERTIFICATE_BASE64 != ''
            && env.MACOS_CERTIFICATE_PASSWORD != ''
            && env.MACOS_CODESIGN_IDENTITY != ''
            && env.MACOS_KEYCHAIN_PASSWORD != ''
          }}
        run: |
          app="build/MCSL2.app"
          codesign --force --deep --timestamp --options runtime --sign "$MACOS_CODESIGN_IDENTITY" "$app"
          codesign --verify --deep --strict --verbose=2 "$app"

      - name: Notarize app bundle
        if: >-
          ${{
            env.MACOS_CERTIFICATE_BASE64 != ''
            && env.MACOS_CERTIFICATE_PASSWORD != ''
            && env.MACOS_CODESIGN_IDENTITY != ''
            && env.MACOS_KEYCHAIN_PASSWORD != ''
            && env.APPLE_ID != ''
            && env.APPLE_TEAM_ID != ''
            && env.APPLE_APP_SPECIFIC_PASSWORD != ''
          }}
        run: |
          app="build/MCSL2.app"
          notarize_zip="$RUNNER_TEMP/MCSL2-${{ matrix.architecture }}-notarize.zip"

          ditto -c -k --keepParent "$app" "$notarize_zip"
          xcrun notarytool submit "$notarize_zip" \
            --apple-id "$APPLE_ID" \
            --team-id "$APPLE_TEAM_ID" \
            --password "$APPLE_APP_SPECIFIC_PASSWORD" \
            --wait
          xcrun stapler staple "$app"
          spctl --assess --type execute --verbose "$app"

      - name: Install DMG packaging tool
        run: npm install --global appdmg create-dmg

      - name: Create DMG
        run: |
          app_path="$PWD/build/MCSL2.app"
          dmg_path="build/MCSL2-macOS-${{ matrix.architecture }}.dmg"
          background_path="$PWD/macos-volume-bg.png"
          volume_icon_path="$PWD/macos-volume-icon.icns"

          if [ -f "$background_path" ]; then
            cat > "$RUNNER_TEMP/mcsl2-dmg.json" <<JSON
          {
            "title": "MCSL2",
            "icon": "$volume_icon_path",
            "background": "$background_path",
            "window": {
              "size": {
                "width": 480,
                "height": 540
              }
            },
            "contents": [
              {
                "x": 240,
                "y": 145,
                "type": "file",
                "path": "$app_path"
              },
              {
                "x": 240,
                "y": 405,
                "type": "link",
                "path": "/Applications"
              }
            ]
          }
          JSON
            appdmg "$RUNNER_TEMP/mcsl2-dmg.json" "$dmg_path"
          else
            create-dmg "$app_path" build --overwrite --no-code-sign
            generated_dmg="$(find build -maxdepth 1 -name '*.dmg' | head -n 1)"
            test -n "$generated_dmg"
            mv "$generated_dmg" "$dmg_path"
          fi

      - name: Sign DMG
        if: >-
          ${{
            env.MACOS_CERTIFICATE_BASE64 != ''
            && env.MACOS_CERTIFICATE_PASSWORD != ''
            && env.MACOS_CODESIGN_IDENTITY != ''
            && env.MACOS_KEYCHAIN_PASSWORD != ''
          }}
        run: |
          dmg_path="build/MCSL2-macOS-${{ matrix.architecture }}.dmg"
          codesign --force --timestamp --sign "$MACOS_CODESIGN_IDENTITY" "$dmg_path"
          codesign --verify --verbose=2 "$dmg_path"

      - name: Notarize DMG
        if: >-
          ${{
            env.MACOS_CERTIFICATE_BASE64 != ''
            && env.MACOS_CERTIFICATE_PASSWORD != ''
            && env.MACOS_CODESIGN_IDENTITY != ''
            && env.MACOS_KEYCHAIN_PASSWORD != ''
            && env.APPLE_ID != ''
            && env.APPLE_TEAM_ID != ''
            && env.APPLE_APP_SPECIFIC_PASSWORD != ''
          }}
        run: |
          dmg_path="build/MCSL2-macOS-${{ matrix.architecture }}.dmg"
          xcrun notarytool submit "$dmg_path" \
            --apple-id "$APPLE_ID" \
            --team-id "$APPLE_TEAM_ID" \
            --password "$APPLE_APP_SPECIFIC_PASSWORD" \
            --wait
          xcrun stapler staple "$dmg_path"
          spctl --assess --type open --context context:primary-signature --verbose "$dmg_path"

      - name: Upload Artifacts
        uses: actions/upload-artifact@v7.0.1
        with:
          name: MCSL2-macOS-${{ matrix.architecture }}
          path: |
            build/MCSL2.app
            build/MCSL2-macOS-${{ matrix.architecture }}.dmg