v1.4.0 #17
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Release | |
| on: | |
| release: | |
| types: [created] | |
| workflow_dispatch: | |
| permissions: | |
| contents: write | |
| concurrency: | |
| group: release | |
| cancel-in-progress: false | |
| jobs: | |
| test: | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 10 | |
| strategy: | |
| matrix: | |
| node-version: ['24', '22', '20'] | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| - name: Setup Node | |
| uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0 | |
| with: | |
| node-version: ${{ matrix.node-version }} | |
| cache: 'npm' | |
| - name: Install dependencies | |
| run: npm ci | |
| - name: Run unit tests | |
| run: npm test | |
| build: | |
| needs: test | |
| strategy: | |
| matrix: | |
| include: | |
| - os: ubuntu-latest | |
| target: linux-x64 | |
| platform: linux | |
| arch: amd64 | |
| - os: ubuntu-latest | |
| target: linux-arm64 | |
| platform: linux | |
| arch: arm64 | |
| - os: macos-latest | |
| target: darwin-x64 | |
| platform: darwin | |
| arch: amd64 | |
| - os: macos-latest | |
| target: darwin-arm64 | |
| platform: darwin | |
| arch: arm64 | |
| - os: windows-latest | |
| target: windows-x64 | |
| platform: windows | |
| arch: amd64 | |
| runs-on: ${{ matrix.os }} | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0 | |
| with: | |
| bun-version: 1 | |
| - name: Install dependencies | |
| run: bun install --frozen-lockfile | |
| - name: Build TypeScript | |
| run: bun run build | |
| - name: Build binary | |
| shell: bash | |
| run: | | |
| BINARY_NAME="make-cli-${{ matrix.platform }}-${{ matrix.arch }}" | |
| if [ "${{ matrix.platform }}" = "windows" ]; then | |
| bun build dist/index.js --compile --target=bun-${{ matrix.target }} --outfile="${BINARY_NAME}.exe" | |
| else | |
| bun build dist/index.js --compile --target=bun-${{ matrix.target }} --outfile="${BINARY_NAME}" | |
| fi | |
| - name: Import Apple Developer ID cert | |
| if: matrix.platform == 'darwin' | |
| uses: apple-actions/import-codesign-certs@b610f78488812c1e56b20e6df63ec42d833f2d14 # v6.0.0 | |
| with: | |
| p12-file-base64: ${{ secrets.APPLE_DEVELOPER_ID_CERT_P12 }} | |
| p12-password: ${{ secrets.APPLE_DEVELOPER_ID_CERT_PASSWORD }} | |
| - name: Install Apple Developer ID intermediate CAs | |
| if: matrix.platform == 'darwin' | |
| shell: bash | |
| run: | | |
| set -euo pipefail | |
| curl -fsSL -o DeveloperIDG2CA.cer https://www.apple.com/certificateauthority/DeveloperIDG2CA.cer | |
| curl -fsSL -o DeveloperIDCA.cer https://www.apple.com/certificateauthority/DeveloperIDCA.cer | |
| for cert_file in DeveloperIDG2CA.cer DeveloperIDCA.cer; do | |
| if ! output=$(security import "${cert_file}" -k signing_temp.keychain 2>&1); then | |
| if echo "${output}" | grep -q "already exists"; then | |
| echo "${cert_file} already present in signing_temp.keychain" | |
| else | |
| echo "${output}" | |
| exit 1 | |
| fi | |
| fi | |
| done | |
| rm DeveloperIDG2CA.cer DeveloperIDCA.cer | |
| - name: Sign macOS binary | |
| if: matrix.platform == 'darwin' | |
| shell: bash | |
| env: | |
| BINARY_NAME: make-cli-${{ matrix.platform }}-${{ matrix.arch }} | |
| run: | | |
| set -euo pipefail | |
| codesign --remove-signature "${BINARY_NAME}" || true | |
| IDENTITY="$(security find-identity -v -p codesigning \ | |
| | awk -F'"' '/Developer ID Application/ { print $2; exit }')" | |
| if [ -z "${IDENTITY}" ]; then | |
| echo "::error::No valid 'Developer ID Application' identity found" | |
| exit 1 | |
| fi | |
| echo "Signing identity: ${IDENTITY}" | |
| codesign \ | |
| --force \ | |
| --options runtime \ | |
| --entitlements build/entitlements.mac.plist \ | |
| --timestamp \ | |
| --sign "${IDENTITY}" \ | |
| "${BINARY_NAME}" | |
| codesign --verify --strict --verbose "${BINARY_NAME}" | |
| codesign -dv --verbose=4 "${BINARY_NAME}" | |
| - name: Notarize macOS binary | |
| if: matrix.platform == 'darwin' | |
| shell: bash | |
| env: | |
| BINARY_NAME: make-cli-${{ matrix.platform }}-${{ matrix.arch }} | |
| APPLE_ID: ${{ secrets.APPLE_ID }} | |
| APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }} | |
| APPLE_APP_PASSWORD: ${{ secrets.APPLE_APP_PASSWORD }} | |
| run: | | |
| set -euo pipefail | |
| ZIP_PATH="${BINARY_NAME}.notarize.zip" | |
| ditto -c -k --keepParent "${BINARY_NAME}" "${ZIP_PATH}" | |
| xcrun notarytool submit "${ZIP_PATH}" \ | |
| --apple-id "${APPLE_ID}" \ | |
| --team-id "${APPLE_TEAM_ID}" \ | |
| --password "${APPLE_APP_PASSWORD}" \ | |
| --wait | |
| rm -f "${ZIP_PATH}" | |
| - name: Create tar.gz archive | |
| shell: bash | |
| run: | | |
| BINARY_NAME="make-cli-${{ matrix.platform }}-${{ matrix.arch }}" | |
| if [ "${{ matrix.platform }}" = "windows" ]; then | |
| tar -czvf "${BINARY_NAME}.tar.gz" "${BINARY_NAME}.exe" | |
| else | |
| tar -czvf "${BINARY_NAME}.tar.gz" "${BINARY_NAME}" | |
| fi | |
| - name: Upload artifact | |
| uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0 | |
| with: | |
| name: make-cli-${{ matrix.platform }}-${{ matrix.arch }}.tar.gz | |
| path: make-cli-*.tar.gz | |
| retention-days: 7 | |
| build-deb: | |
| needs: build | |
| if: github.event_name == 'release' | |
| runs-on: ubuntu-latest | |
| strategy: | |
| matrix: | |
| arch: [amd64, arm64] | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| - name: Download linux binary | |
| uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 | |
| with: | |
| name: make-cli-linux-${{ matrix.arch }}.tar.gz | |
| path: . | |
| - name: Extract binary | |
| run: | | |
| mkdir -p bin | |
| tar -xzvf "make-cli-linux-${{ matrix.arch }}.tar.gz" -C bin/ | |
| - name: Build Debian package | |
| run: | | |
| VERSION="${GITHUB_REF_NAME#v}" | |
| ./scripts/build-deb.sh "$VERSION" "${{ matrix.arch }}" | |
| - name: Upload artifact | |
| uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0 | |
| with: | |
| name: make-cli-linux-${{ matrix.arch }}.deb | |
| path: deb/*.deb | |
| retention-days: 7 | |
| release: | |
| needs: [build, build-deb] | |
| if: github.event_name == 'release' | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: write | |
| id-token: write | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0 | |
| with: | |
| bun-version: latest | |
| - name: Setup Node | |
| uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0 | |
| with: | |
| node-version: 24 | |
| registry-url: 'https://registry.npmjs.org' | |
| cache: 'npm' | |
| - name: Install dependencies | |
| run: bun install --frozen-lockfile | |
| - name: Build | |
| run: bun run build | |
| - name: Publish to npm | |
| run: npm publish --provenance --access public | |
| env: | |
| NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }} | |
| - name: Download all artifacts | |
| uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 | |
| with: | |
| path: artifacts/ | |
| - name: Create release | |
| uses: softprops/action-gh-release@153bb8e04406b158c6c84fc1615b65b24149a1fe # v2.6.1 | |
| with: | |
| files: | | |
| artifacts/**/* | |
| update-homebrew: | |
| needs: release | |
| if: github.event_name == 'release' | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0 | |
| with: | |
| bun-version: latest | |
| - name: Download artifacts | |
| uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 | |
| with: | |
| path: artifacts/ | |
| - name: Generate Homebrew formula | |
| run: | | |
| VERSION="${GITHUB_REF_NAME#v}" | |
| VERSION="$VERSION" ARTIFACTS_DIR="artifacts" bun run scripts/update-homebrew.ts | |
| - name: Push to homebrew-tap | |
| env: | |
| SSH_PRIVATE_KEY: ${{ secrets.HOMEBREW_TAP_DEPLOY_KEY }} | |
| run: | | |
| mkdir -p ~/.ssh | |
| echo "$SSH_PRIVATE_KEY" > ~/.ssh/deploy_key | |
| chmod 600 ~/.ssh/deploy_key | |
| ssh-keyscan github.com >> ~/.ssh/known_hosts | |
| git clone git@github.com:integromat/homebrew-tap.git tap --config core.sshCommand="ssh -i ~/.ssh/deploy_key" | |
| cp make-cli.rb tap/make-cli.rb | |
| cd tap | |
| git config user.name "make-cli-release-bot" | |
| git config user.email "make-cli-release-bot@make.com" | |
| git config core.sshCommand "ssh -i ~/.ssh/deploy_key" | |
| git add make-cli.rb | |
| git diff --staged --quiet || git commit -m "make-cli ${GITHUB_REF_NAME#v}" | |
| git push |