release.yml

name: release
on: push

jobs:
  release:
    runs-on: macos-latest
    steps:
      - name: Checkout repository
        uses: actions/checkout@v3
      - name: Install the Apple certificate and provisioning profile
        uses: apple-actions/import-codesign-certs@v1
        with:
          keychain: app-signing
          p12-file-base64: ${{ secrets.BUILD_CERTIFICATE_BASE64 }}
          p12-password: ${{ secrets.P12_PASSWORD }}
      - name: Get Sparkle key
        env:
          PRIVATE_SPARKLE_KEY: ${{ secrets.PRIVATE_SPARKLE_KEY }}
        run: 'echo "${{ env.PRIVATE_SPARKLE_KEY }}" | base64 -d -o eddsa_private.key'
      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: '3.11'
          cache: 'pip'
      - name: Install Python Requirements
        run: |
          python -m pip install --upgrade pip
          python -m pip install requests xmltodict
      - name: Install Brew Requirements
        run: brew install coreutils pandoc
      - name: Setup Sparkle
        env:
          SPARKLE_VERSION: '2.5.0'
          SPARKLE_HASH: '06a59e6bfd3c57b79e004b4f6bf6d65fde05ed3a23678dadecfd3f6ed01d5c6b'
        run: |
          curl -L "https://github.com/sparkle-project/Sparkle/releases/download/${{ env.SPARKLE_VERSION }}/Sparkle-${{ env.SPARKLE_VERSION }}.tar.xz" -o Sparkle.tar.xz
          if [[ '${{ env.SPARKLE_HASH }}' != "$(sha256sum Sparkle.tar.xz | cut -d " " -f 1)" ]]; then
              echo "Sparkle download hash does not match!"
              exit 1
          fi
          mkdir sparkle && cd sparkle
          tar -xf ../Sparkle.tar.xz
      - name: Build app
        run: |
          xcodebuild -project Hackintool.xcodeproj -target Hackintool -configuration Release build ARCHS='x86_64 arm64' -verbose CONFIGURATION_BUILD_DIR=build
          rm -rf build/EagerLinkingTBDs
          rm -rf build/Hackintool.app.dSYM
          rm -rf build/Hackintool.build
          rm -rf build/SharedPrecompiledHeaders
          rm -rf build/XCBuildData
          rm -rf build/*.swiftmodule
          rm -rf build/SwiftExplicitPrecompiledModules
          rm -rf build/ExplicitPrecompiledModules
      - name: Sign nested code
        # Developer ID sign everything inside the app with a secure timestamp: the bundled
        # tools and kexts (unsigned, or patched so their signature broke), and Sparkle's
        # helpers, which Xcode leaves ad-hoc signed. Sign inside out, then re-seal the app.
        # (Not notarized: Apple only accepts bundled kexts signed with a kext-signing cert.)
        run: |
          ID="Developer ID Application: Benjamin Baker (9AM8849YMD)"
          RESOURCES=build/Hackintool.app/Contents/Resources
          codesign -f -s "$ID" -o runtime --timestamp $RESOURCES/Utilities/iasl
          codesign -f -s "$ID" --timestamp $RESOURCES/DisplayMergeNub/DisplayMergeNub
          codesign -f -s "$ID" --timestamp $RESOURCES/Kexts/AppleAHCIPortHotplug.kext
          codesign -f -s "$ID" --timestamp $RESOURCES/Kexts/AppleIntelInfo.kext
          SPARKLE=build/Hackintool.app/Contents/Frameworks/Sparkle.framework
          codesign -f -s "$ID" -o runtime --timestamp $SPARKLE/Versions/B/XPCServices/Installer.xpc
          codesign -f -s "$ID" -o runtime --timestamp --preserve-metadata=entitlements $SPARKLE/Versions/B/XPCServices/Downloader.xpc
          codesign -f -s "$ID" -o runtime --timestamp $SPARKLE/Versions/B/Autoupdate
          codesign -f -s "$ID" -o runtime --timestamp $SPARKLE/Versions/B/Updater.app
          codesign -f -s "$ID" -o runtime --timestamp $SPARKLE
          codesign -f -s "$ID" -o runtime --timestamp --preserve-metadata=entitlements,requirements build/Hackintool.app
          codesign --verify --deep --strict --verbose=2 build/Hackintool.app
      - name: Get version
        id: version
        run: |
          output=$(xcodebuild -project Hackintool.xcodeproj -configuration Release -showBuildSettings | grep MARKETING_VERSION | tr -d 'MARKETING_VERSION = ')
          echo "::set-output name=result::$output"
      - name: Compress Files
        # ditto keeps the symlinks inside Sparkle.framework; zip turned them into copies,
        # which broke the framework's code signature.
        run: ditto -c -k --sequesterRsrc --keepParent build/Hackintool.app build/Hackintool.zip
      - name: Clean up
        run: rm -R build/Hackintool.app
      - name: Generate appcast.xml
        run: sparkle/bin/generate_appcast --ed-key-file eddsa_private.key -o build/appcast.xml build
      - name: Upload to Artifacts
        uses: actions/upload-artifact@v4
        with:
          name: Artifacts
          path: build/*
      - name: Upload to Release
        # Only master publishes a release (and the appcast users update from);
        # other branches just build and upload to the workflow's artifacts.
        if: github.ref == 'refs/heads/master'
        uses: svenstaro/upload-release-action@v2
        with:
          repo_token: ${{ secrets.GITHUB_TOKEN }}
          file: build/*
          tag: ${{ steps.version.outputs.result }}
          overwrite: true
          file_glob: true
      - name: Clean up keychain and provisioning profile
        if: ${{ always() }}
        run: |
          security delete-keychain app-signing.keychain
          rm -f eddsa_private.key