fix(docs): treat exact beta listings in vulnerable_version_range as a… #299
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Pre-release | |
| on: | |
| push: | |
| branches: | |
| - main | |
| permissions: | |
| contents: read | |
| jobs: | |
| build-and-notarize: | |
| runs-on: macos-26 | |
| permissions: | |
| id-token: write | |
| contents: write | |
| attestations: write | |
| outputs: | |
| hashes: ${{ steps.hash.outputs.hashes }} | |
| release_name: ${{ steps.version.outputs.name }} | |
| provenance_name: clearancekit-${{ steps.version.outputs.name }}.dmg.intoto.jsonl | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| with: | |
| fetch-depth: 0 | |
| fetch-tags: true | |
| - name: Compute version name | |
| id: version | |
| run: | | |
| MARKETING_VERSION=$(grep -m1 'MARKETING_VERSION' clearancekit.xcodeproj/project.pbxproj | grep -oE '[0-9]+\.[0-9]+') | |
| SHORT_HASH=$(git rev-parse --short HEAD) | |
| LAST_MINOR=$(git tag --list "v${MARKETING_VERSION}.*" \ | |
| | grep -v -- '-beta-' \ | |
| | grep -E "^v${MARKETING_VERSION//./\\.}\.[0-9]+(-[0-9a-f]+)?$" \ | |
| | sed -E "s/^v${MARKETING_VERSION//./\\.}\.([0-9]+).*/\1/" \ | |
| | sort -n \ | |
| | tail -1 \ | |
| || true) | |
| NEXT_MINOR=$(( ${LAST_MINOR:-0} + 1 )) | |
| echo "name=v${MARKETING_VERSION}.${NEXT_MINOR}-beta-${SHORT_HASH}" >> "$GITHUB_OUTPUT" | |
| - name: Test | |
| run: | | |
| xcodebuild test \ | |
| -scheme clearancekitTests \ | |
| -destination 'platform=macOS' | |
| - name: Import Developer ID certificate | |
| env: | |
| P12_BASE64: ${{ secrets.DEVELOPER_ID_CERT_P12 }} | |
| P12_PASSWORD: ${{ secrets.DEVELOPER_ID_CERT_PASSWORD }} | |
| KEYCHAIN_PASSWORD: ${{ secrets.KEYCHAIN_PASSWORD }} | |
| run: | | |
| security create-keychain -p "$KEYCHAIN_PASSWORD" build.keychain | |
| security default-keychain -s build.keychain | |
| security unlock-keychain -p "$KEYCHAIN_PASSWORD" build.keychain | |
| security set-keychain-settings -t 3600 -u build.keychain | |
| echo "$P12_BASE64" | base64 --decode > certificate.p12 | |
| security import certificate.p12 \ | |
| -k build.keychain \ | |
| -P "$P12_PASSWORD" \ | |
| -T /usr/bin/codesign \ | |
| -T /usr/bin/productbuild | |
| security set-key-partition-list \ | |
| -S apple-tool:,apple: \ | |
| -s -k "$KEYCHAIN_PASSWORD" build.keychain | |
| rm certificate.p12 | |
| - name: Install provisioning profiles | |
| env: | |
| PP_APP_BASE64: ${{ secrets.PROVISIONING_PROFILE_APP }} | |
| PP_EXT_BASE64: ${{ secrets.PROVISIONING_PROFILE_OPFILTER }} | |
| run: | | |
| mkdir -p ~/Library/MobileDevice/Provisioning\ Profiles | |
| echo "$PP_APP_BASE64" | base64 --decode \ | |
| > ~/Library/MobileDevice/Provisioning\ Profiles/clearancekit.provisionprofile | |
| echo "$PP_EXT_BASE64" | base64 --decode \ | |
| > ~/Library/MobileDevice/Provisioning\ Profiles/opfilter.provisionprofile | |
| - name: Archive | |
| run: | | |
| xcodebuild archive \ | |
| -project clearancekit.xcodeproj \ | |
| -scheme clearancekit \ | |
| -configuration Release \ | |
| -archivePath build/clearancekit.xcarchive \ | |
| CODE_SIGN_STYLE=Manual \ | |
| DEVELOPMENT_TEAM=37KMK6XFTT | |
| - name: Export | |
| run: | | |
| xcodebuild -exportArchive \ | |
| -archivePath build/clearancekit.xcarchive \ | |
| -exportPath build/export \ | |
| -exportOptionsPlist ExportOptions.plist | |
| - name: Package DMG | |
| run: | | |
| hdiutil create \ | |
| -volname "clearancekit" \ | |
| -size 200m \ | |
| -fs HFS+ \ | |
| -layout SPUD \ | |
| -ov \ | |
| build/clearancekit-staging.dmg | |
| hdiutil attach -readwrite -noverify build/clearancekit-staging.dmg | |
| MOUNT="/Volumes/clearancekit" | |
| cp -R "build/export/clearancekit.app" "$MOUNT/" | |
| ln -s /Applications "$MOUNT/Applications" | |
| osascript <<APPLESCRIPT | |
| tell application "Finder" | |
| tell disk "clearancekit" | |
| open | |
| set current view of container window to icon view | |
| set toolbar visible of container window to false | |
| set statusbar visible of container window to false | |
| set the bounds of container window to {400, 100, 1000, 500} | |
| set viewOptions to the icon view options of container window | |
| set arrangement of viewOptions to not arranged | |
| set icon size of viewOptions to 128 | |
| set background color of viewOptions to {61166, 61166, 61166} | |
| set position of item "clearancekit.app" of container window to {175, 190} | |
| set position of item "Applications" of container window to {425, 190} | |
| close | |
| open | |
| update without registering applications | |
| delay 2 | |
| close | |
| end tell | |
| end tell | |
| APPLESCRIPT | |
| hdiutil detach "$MOUNT" | |
| hdiutil convert build/clearancekit-staging.dmg \ | |
| -format UDZO \ | |
| -o "build/clearancekit-${{ steps.version.outputs.name }}.dmg" | |
| rm build/clearancekit-staging.dmg | |
| - name: Notarize DMG | |
| env: | |
| ASC_KEY_ID: ${{ secrets.ASC_API_KEY_ID }} | |
| ASC_ISSUER_ID: ${{ secrets.ASC_API_ISSUER_ID }} | |
| ASC_PRIVATE_KEY: ${{ secrets.ASC_API_PRIVATE_KEY }} | |
| run: | | |
| echo "$ASC_PRIVATE_KEY" > AuthKey.p8 | |
| xcrun notarytool submit \ | |
| "build/clearancekit-${{ steps.version.outputs.name }}.dmg" \ | |
| --key AuthKey.p8 \ | |
| --key-id "$ASC_KEY_ID" \ | |
| --issuer "$ASC_ISSUER_ID" \ | |
| --wait \ | |
| --timeout 30m | |
| rm AuthKey.p8 | |
| xcrun stapler staple "build/clearancekit-${{ steps.version.outputs.name }}.dmg" | |
| - name: Attest build provenance | |
| id: attest | |
| uses: actions/attest-build-provenance@a2bbfa25375fe432b6a289bc6b6cd05ecd0c4c32 # v4.1.0 | |
| with: | |
| subject-path: build/clearancekit-${{ steps.version.outputs.name }}.dmg | |
| - name: Stage Sigstore bundle as release asset | |
| env: | |
| VERSION_NAME: ${{ steps.version.outputs.name }} | |
| run: | | |
| cp "${{ steps.attest.outputs.bundle-path }}" \ | |
| "build/clearancekit-${VERSION_NAME}.dmg.sigstore" | |
| - name: Compute artifact hashes for SLSA provenance | |
| id: hash | |
| env: | |
| VERSION_NAME: ${{ steps.version.outputs.name }} | |
| run: | | |
| cd build | |
| HASHES=$(shasum -a 256 "clearancekit-${VERSION_NAME}.dmg" | base64 | tr -d '\n') | |
| echo "hashes=${HASHES}" >> "$GITHUB_OUTPUT" | |
| - name: Upload DMG and Sigstore bundle as workflow artifact | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 | |
| with: | |
| name: release-assets | |
| path: | | |
| build/clearancekit-${{ steps.version.outputs.name }}.dmg | |
| build/clearancekit-${{ steps.version.outputs.name }}.dmg.sigstore | |
| if-no-files-found: error | |
| retention-days: 1 | |
| provenance: | |
| needs: build-and-notarize | |
| permissions: | |
| id-token: write | |
| contents: write | |
| actions: read | |
| uses: slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@f7dd8c54c2067bafc12ca7a55595d5ee9b75204a # v2.1.0 | |
| with: | |
| base64-subjects: ${{ needs.build-and-notarize.outputs.hashes }} | |
| provenance-name: ${{ needs.build-and-notarize.outputs.provenance_name }} | |
| compile-generator: true | |
| publish: | |
| needs: [build-and-notarize, provenance] | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: write | |
| env: | |
| VERSION_NAME: ${{ needs.build-and-notarize.outputs.release_name }} | |
| steps: | |
| - name: Download DMG and Sigstore bundle | |
| uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 | |
| with: | |
| name: release-assets | |
| path: artifacts | |
| - name: Download SLSA provenance | |
| uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 | |
| with: | |
| name: ${{ needs.build-and-notarize.outputs.provenance_name }} | |
| path: artifacts | |
| - name: Create GitHub pre-release | |
| env: | |
| GH_TOKEN: ${{ github.token }} | |
| run: | | |
| gh release create "$VERSION_NAME" \ | |
| "artifacts/clearancekit-${VERSION_NAME}.dmg" \ | |
| "artifacts/clearancekit-${VERSION_NAME}.dmg.sigstore" \ | |
| "artifacts/clearancekit-${VERSION_NAME}.dmg.intoto.jsonl" \ | |
| --repo "$GITHUB_REPOSITORY" \ | |
| --prerelease \ | |
| --generate-notes \ | |
| --title "$VERSION_NAME" |