Skip to content

chore: Install Apple dev certificate for signing macOS distributables. #1273

chore: Install Apple dev certificate for signing macOS distributables.

chore: Install Apple dev certificate for signing macOS distributables. #1273

name: Build, test, and deploy
on:
# Run this workflow every day at 3:00 UTC to update caches.
schedule: [cron: '0 3 * * *']
pull_request:
branches: ["master"]
push:
branches: ["master"]
tags: ["v*"]
# Cancel old PR builds when pushing new commits.
concurrency:
group: build-test-deploy-${{ github.event.pull_request.number || github.ref }}
cancel-in-progress: true
jobs:
################################################################################################
# Preparation jobs
################################################################################################
update-nightly-tag:
name: Update nightly release tag
runs-on: ubuntu-22.04
permissions:
contents: write
steps:
- uses: actions/checkout@v4
- name: Move nightly tag to head for nightly release
if: github.event_name == 'push' && github.ref == 'refs/heads/master'
run: git tag -f nightly && git push origin nightly -f
################################################################################################
# Static analysis and other checks
################################################################################################
clang-tidy:
name: Clang-Tidy
if: github.event_name == 'pull_request' || github.event_name == 'schedule'
runs-on: ubuntu-22.04
steps:
- uses: actions/checkout@v4
- name: Cache compiler output
uses: actions/cache@v4
with:
path: ".cache/ccache"
key: ${{ github.job }}-ccache
- name: Install docker-compose
run: sudo apt-get install -y docker-compose
- name: Run build
run: docker-compose run --rm fedora .ci-scripts/build-qtox-linux.sh --build-type Release --full --tidy
translation-check:
name: Check for translatable strings
if: github.event_name == 'pull_request'
runs-on: ubuntu-22.04
steps:
- uses: actions/checkout@v4
- name: Install deps
run: sudo apt-get update && sudo apt-get install qt6-l10n-tools
- name: Test for modified translatable strings
run: PATH="/usr/lib/qt6/bin:$PATH"
./tools/update-translation-files.sh ALL &&
git diff --exit-code
################################################################################################
# Build and test jobs (PR)
################################################################################################
build-alpine:
name: Alpine
if: github.event_name == 'pull_request' || github.event_name == 'schedule'
runs-on: ubuntu-22.04
strategy:
matrix:
features: [full]
build_type: [Debug]
steps:
- uses: actions/checkout@v4
- name: Cache compiler output
uses: actions/cache@v4
with:
path: ".cache/ccache"
key: ${{ github.job }}-ccache
- name: Install docker-compose
run: sudo apt-get install -y docker-compose
- name: Run build
run: docker-compose run --rm alpine .ci-scripts/build-qtox-linux.sh --build-type ${{ matrix.build_type }} --${{ matrix.features }}
build-alpine-static:
name: Alpine (static)
if: github.event_name == 'pull_request' || github.event_name == 'schedule'
runs-on: ubuntu-22.04
strategy:
matrix:
build_type: [Release]
steps:
- uses: actions/checkout@v4
- name: Cache compiler output
uses: actions/cache@v4
with:
path: ".cache/ccache"
key: ${{ github.job }}-ccache
- name: Install docker-compose
run: sudo apt-get install -y docker-compose
- name: Run build
run: docker-compose run --rm alpine-static .ci-scripts/build-qtox-linux-static.sh --build-type ${{ matrix.build_type }}
build-debian:
name: Debian
if: github.event_name == 'pull_request' || github.event_name == 'schedule'
runs-on: ubuntu-22.04
strategy:
matrix:
features: [minimal]
build_type: [Debug]
steps:
- uses: actions/checkout@v4
- name: Cache compiler output
uses: actions/cache@v4
with:
path: ".cache/ccache"
key: ${{ github.job }}-ccache
- name: Install docker-compose
run: sudo apt-get install -y docker-compose
- name: Run build
run: docker-compose run --rm debian .ci-scripts/build-qtox-linux.sh --build-type ${{ matrix.build_type }} --${{ matrix.features }}
build-fedora:
name: Fedora with ASAN
if: github.event_name == 'pull_request' || github.event_name == 'schedule'
runs-on: ubuntu-22.04
strategy:
matrix:
features: [full]
build_type: [Debug]
steps:
- uses: actions/checkout@v4
- name: Cache compiler output
uses: actions/cache@v4
with:
path: ".cache/ccache"
key: ${{ github.job }}-ccache
- name: Install docker-compose
run: sudo apt-get install -y docker-compose
- name: Run build
run: docker-compose run --rm fedora .ci-scripts/build-qtox-linux.sh --build-type ${{ matrix.build_type }} --${{ matrix.features }} --sanitize
build-ubuntu:
name: Ubuntu LTS
if: github.event_name == 'pull_request' || github.event_name == 'schedule'
runs-on: ubuntu-22.04
strategy:
matrix:
features: [full]
build_type: [Release]
steps:
- uses: actions/checkout@v4
- name: Cache compiler output
uses: actions/cache@v4
with:
path: ".cache/ccache"
key: ${{ github.job }}-ccache
- name: Install docker-compose
run: sudo apt-get install -y docker-compose
- name: Run build
run: docker-compose run --rm ubuntu_lts .ci-scripts/build-qtox-linux.sh --build-type ${{ matrix.build_type }} --${{ matrix.features }}
- name: Code coverage
run: |
# https://github.com/actions/runner/issues/491
if [ "${{ matrix.build_type }}" == "Release" ] && [ "${{ matrix.features }}" == "full" ]; then
docker-compose run --rm ubuntu_lts .ci-scripts/lcov.sh
# Upload report to codecov.io
bash <(curl -s https://codecov.io/bash) -f coverage.info || echo "Codecov did not collect coverage reports"
fi
################################################################################################
# Build, test, and deploy jobs (PR and push)
################################################################################################
build-android:
name: Android
runs-on: ubuntu-22.04
needs: [update-nightly-tag]
permissions:
contents: write
strategy:
matrix:
arch: [armeabi-v7a, arm64-v8a]
build_type: [Debug, Release]
version: [6.2.4, 6.8.1]
exclude:
- arch: ${{ github.event_name == 'pull_request' && !contains(github.event.pull_request.labels.*.name, 'packaging') && 'armeabi-v7a' }}
- build_type: ${{ (github.event_name == 'pull_request' && !contains(github.event.pull_request.labels.*.name, 'packaging') || contains(github.ref, 'refs/tags/v')) && 'Debug' }}
- version: ${{ github.event_name == 'pull_request' && !contains(github.event.pull_request.labels.*.name, 'packaging') && '6.8.1' }}
steps:
- name: Compute values for remaining steps
id: computed
run: |
ARTIFACT_TYPE="$(echo '${{ matrix.build_type }}' | tr '[:upper:]' '[:lower:]')"
echo "artifact_type=$ARTIFACT_TYPE" >>$GITHUB_OUTPUT
if [ "${{ matrix.version }}" == "6.2.4" ]; then
SUFFIX="-android7"
echo "built_apk=_build/android-build/build/outputs/apk/debug/android-build-debug.apk" >>$GITHUB_OUTPUT
else
SUFFIX=""
echo "built_apk=_build/android-build/build/outputs/apk/$ARTIFACT_TYPE/android-build-$ARTIFACT_TYPE-signed.apk" >>$GITHUB_OUTPUT
fi
echo "suffix=$SUFFIX" >>$GITHUB_OUTPUT
echo "nightly_apk=qTox-nightly-${{ matrix.arch }}-$ARTIFACT_TYPE$SUFFIX.apk" >>$GITHUB_OUTPUT
- uses: actions/checkout@v4
- name: Cache compiler output
uses: actions/cache@v4
with:
path: ".cache/ccache"
key: ${{ github.job }}-${{ matrix.arch }}-${{ matrix.build_type }}-${{ matrix.version }}-ccache
- name: Install docker-compose
run: sudo apt-get install -y docker-compose
- name: Run build
run: docker-compose run --rm "android_builder.${{ matrix.arch }}.${{ steps.computed.outputs.artifact_type }}_${{ matrix.version }}" ./android/cross-compile/build.sh --arch "${{ matrix.arch }}" --build-type "${{ matrix.build_type }}"
- name: Upload Android apk
uses: actions/upload-artifact@v4
with:
name: qTox-${{ github.sha }}-${{ matrix.arch }}-${{ steps.computed.outputs.artifact_type }}${{ steps.computed.outputs.suffix }}.apk
path: ${{ steps.computed.outputs.built_apk }}
- name: Get tag name for Android release file name
if: contains(github.ref, 'refs/tags/v')
id: get_version
run: |
VERSION="$(echo $GITHUB_REF | cut -d / -f 3)"
echo "release_apk=qTox-$VERSION-${{ matrix.arch }}-${{ steps.computed.outputs.artifact_type }}${{ steps.computed.outputs.suffix }}.apk" >>$GITHUB_OUTPUT
- name: Rename Android APK for release upload
if: contains(github.ref, 'refs/tags/v')
run: |
cp "${{ steps.computed.outputs.built_apk }}" "${{ steps.get_version.outputs.release_apk }}"
sha256sum "${{ steps.get_version.outputs.release_apk }}" > "${{ steps.get_version.outputs.release_apk }}.sha256"
- name: Upload to versioned release
if: contains(github.ref, 'refs/tags/v')
uses: ncipollo/release-action@v1
with:
allowUpdates: true
draft: true
token: ${{ secrets.GITHUB_TOKEN }}
artifacts: "${{ steps.get_version.outputs.release_apk }},${{ steps.get_version.outputs.release_apk }}.sha256"
- name: Rename Android APK for nightly upload
if: github.event_name == 'push' && github.ref == 'refs/heads/master'
run: |
cp "${{ steps.computed.outputs.built_apk }}" "${{ steps.computed.outputs.nightly_apk }}"
sha256sum "${{ steps.computed.outputs.nightly_apk }}" > "${{ steps.computed.outputs.nightly_apk }}.sha256"
- name: Upload to nightly release
uses: ncipollo/release-action@v1
if: github.event_name == 'push' && github.ref == 'refs/heads/master'
with:
allowUpdates: true
tag: nightly
omitBodyDuringUpdate: true
omitNameDuringUpdate: true
prerelease: true
replacesArtifacts: true
token: ${{ secrets.GITHUB_TOKEN }}
artifacts: "${{ steps.computed.outputs.nightly_apk }},${{ steps.computed.outputs.nightly_apk }}.sha256"
build-flatpak:
name: Flatpak
runs-on: ubuntu-22.04
needs: [update-nightly-tag]
permissions:
contents: write
steps:
- uses: actions/checkout@v4
- name: Cache flatpak-builder cache
uses: actions/cache@v4
with:
path: ".flatpak-builder"
key: ${{ github.job }}
- name: Install docker-compose
run: sudo apt-get install -y docker-compose
- name: Point flathub descriptor at current path
run: flatpak/localize_flathub_descriptor.py flatpak/io.github.qtox.qTox.json flatpak/io.github.qtox.qTox.json
- name: Run build
run: docker-compose run --rm flatpak ./flatpak/build.sh
- name: Upload flatpak
uses: actions/upload-artifact@v4
with:
name: qTox-${{ github.sha }}.x86_64.flatpak
path: qtox.flatpak
- name: Get tag name for flatpak release file name
if: contains(github.ref, 'refs/tags/v')
id: get_version
run: |
VERSION="$(echo $GITHUB_REF | cut -d / -f 3)"
echo "release_flatpak=qTox-$VERSION.x86_64.flatpak" >>$GITHUB_OUTPUT
- name: Rename flatpak for release upload
if: contains(github.ref, 'refs/tags/v')
run: |
cp qtox.flatpak "${{ steps.get_version.outputs.release_flatpak }}"
sha256sum "${{ steps.get_version.outputs.release_flatpak }}" > "${{ steps.get_version.outputs.release_flatpak }}.sha256"
- name: Upload to versioned release
if: contains(github.ref, 'refs/tags/v')
uses: ncipollo/release-action@v1
with:
allowUpdates: true
draft: true
token: ${{ secrets.GITHUB_TOKEN }}
artifacts: "${{ steps.get_version.outputs.release_flatpak }},${{ steps.get_version.outputs.release_flatpak }}.sha256"
- name: Rename flatpak for nightly upload
if: github.event_name == 'push' && github.ref == 'refs/heads/master'
run: |
cp qtox.flatpak qTox-nightly.flatpak
sha256sum qTox-nightly.flatpak > qTox-nightly.flatpak.sha256
- name: Upload to nightly release
uses: ncipollo/release-action@v1
if: github.event_name == 'push' && github.ref == 'refs/heads/master'
with:
allowUpdates: true
tag: nightly
omitBodyDuringUpdate: true
omitNameDuringUpdate: true
prerelease: true
replacesArtifacts: true
token: ${{ secrets.GITHUB_TOKEN }}
artifacts: "qTox-nightly.flatpak,qTox-nightly.flatpak.sha256"
build-macos-distributable:
name: macOS distributable
needs: update-nightly-tag
strategy:
matrix:
arch: [arm64, x86_64]
exclude:
- arch: ${{ github.event_name == 'pull_request' && !contains(github.event.pull_request.labels.*.name, 'packaging') && 'x86_64' }}
runs-on: ${{ matrix.arch == 'arm64' && 'macos-14' || 'macos-13' }}
permissions:
contents: write
steps:
- uses: actions/checkout@v4
- name: Fetch build scripts
run: git clone --depth=1 https://github.com/TokTok/dockerfiles ".ci-scripts/dockerfiles"
- name: Cache compiler output
uses: actions/cache@v4
with:
path: ".cache/ccache"
key: ${{ github.job }}-${{ matrix.arch }}-ccache
- name: Cache dependencies (only Qt)
id: cache-qt
uses: actions/cache@v4
with:
path: |
.ci-scripts/dockerfiles/local-deps/qt
key: ${{ github.job }}-${{ matrix.arch }}-qt
- name: Cache dependencies (except Qt)
id: cache-deps
uses: actions/cache@v4
with:
path: |
.ci-scripts/dockerfiles/local-deps/bin
.ci-scripts/dockerfiles/local-deps/include
.ci-scripts/dockerfiles/local-deps/lib
.ci-scripts/dockerfiles/local-deps/share
key: ${{ github.job }}-${{ matrix.arch }}-local-deps
- name: Homebrew dependencies to build dependencies
run: |
brew bundle --file ./macos/Brewfile-DepBuildDeps
sed -i '' -e 's/MAXIMUM_UNMOUNTING_ATTEMPTS=3/MAXIMUM_UNMOUNTING_ATTEMPTS=15/' "$(realpath "$(which create-dmg)")"
- name: Set up ccache
run: ccache --set-config=max_size=200M --set-config=cache_dir="$PWD/.cache/ccache" && ccache --show-config
- name: Build dependencies (only Qt)
if: steps.cache-qt.outputs.cache-hit != 'true'
run: .ci-scripts/build-macos-qt.sh ${{ matrix.arch }}
- name: Build dependencies (except Qt)
if: steps.cache-deps.outputs.cache-hit != 'true'
run: .ci-scripts/build-macos-deps.sh ${{ matrix.arch }}
- name: Install the Apple certificate
# if: github.event_name == 'push'
env:
BUILD_CERTIFICATE_BASE64: ${{ secrets.APPLE_BUILD_CERTIFICATE_BASE64 }}
P12_PASSWORD: ${{ secrets.APPLE_P12_PASSWORD }}
KEYCHAIN_PASSWORD: ${{ secrets.APPLE_KEYCHAIN_PASSWORD }}
run: .github/scripts/install_apple_cert >/dev/null
- name: Build qTox
run: .ci-scripts/build-qtox-macos.sh dist ${{ matrix.arch }}
- name: Upload dmg
uses: actions/upload-artifact@v4
with:
name: qTox-${{ github.sha }}-${{ matrix.arch }}.dmg
path: qTox-${{ matrix.arch }}.dmg
- name: Upload to versioned release
if: contains(github.ref, 'refs/tags/v')
uses: ncipollo/release-action@v1
with:
allowUpdates: true
draft: true
token: ${{ secrets.GITHUB_TOKEN }}
artifacts: "qTox-${{ matrix.arch }}.dmg,qTox-${{ matrix.arch }}.dmg.sha256"
- name: Rename artifact for nightly upload
if: github.event_name == 'push' && github.ref == 'refs/heads/master'
run: |
cp qTox-${{ matrix.arch }}.dmg qTox-nightly-${{ matrix.arch }}.dmg
cp qTox-${{ matrix.arch }}.dmg.sha256 qTox-nightly-${{ matrix.arch }}.dmg.sha256
- name: Upload to nightly release
uses: ncipollo/release-action@v1
if: github.event_name == 'push' && github.ref == 'refs/heads/master'
with:
allowUpdates: true
tag: nightly
omitBodyDuringUpdate: true
omitNameDuringUpdate: true
prerelease: true
replacesArtifacts: true
token: ${{ secrets.GITHUB_TOKEN }}
artifacts: "qTox-nightly-${{ matrix.arch }}.dmg,qTox-nightly-${{ matrix.arch }}.dmg.sha256"
test-macos-distributable:
name: Test macOS distributable
needs: build-macos-distributable
strategy:
matrix:
arch: [arm64, x86_64]
exclude:
- arch: ${{ github.event_name == 'pull_request' && !contains(github.event.pull_request.labels.*.name, 'packaging') && 'x86_64' }}
runs-on: ${{ matrix.arch == 'arm64' && 'macos-14' || 'macos-13' }}
permissions:
contents: write
steps:
- name: Download artifact from macOS distributable (${{ matrix.arch }})
uses: actions/download-artifact@v4
with:
name: qTox-${{ github.sha }}-${{ matrix.arch }}.dmg
path: qTox.dmg
- name: Install 7zip
run: brew install 7zip
- name: Unpack dmg
run: 7zz x qTox.dmg qtox.app
- name: Run qTox
run: qtox.app/Contents/MacOS/qTox --help
build-macos-user:
name: macOS user
if: github.event_name == 'pull_request' || github.event_name == 'schedule'
strategy:
matrix:
arch: [arm64, x86_64]
exclude:
- arch: ${{ github.event_name == 'pull_request' && !contains(github.event.pull_request.labels.*.name, 'packaging') && 'arm64' }}
runs-on: ${{ matrix.arch == 'arm64' && 'macos-14' || 'macos-13' }}
steps:
- uses: actions/checkout@v4
- name: Fetch build scripts
run: git clone --depth=1 https://github.com/TokTok/dockerfiles ".ci-scripts/dockerfiles"
- name: Cache compiler output
uses: actions/cache@v4
with:
path: ".cache/ccache"
key: ${{ github.job }}-${{ matrix.arch }}-ccache
- name: Homebrew
run: |
brew bundle --file ./macos/Brewfile
sed -i '' -e 's/MAXIMUM_UNMOUNTING_ATTEMPTS=3/MAXIMUM_UNMOUNTING_ATTEMPTS=15/' "$(realpath "$(which create-dmg)")"
- name: Set up ccache
run: ccache --set-config=max_size=200M --set-config=cache_dir="$PWD/.cache/ccache" && ccache --show-config
- name: Install toxcore
run: .ci-scripts/dockerfiles/qtox/build_toxcore_linux.sh sudo
- name: Build qTox
run: .ci-scripts/build-qtox-macos.sh user ${{ matrix.arch }}
build-windows:
name: Windows
runs-on: ubuntu-22.04
needs: [update-nightly-tag]
permissions:
contents: write
strategy:
matrix:
arch: [i686, x86_64]
build_type: [Debug, Release]
exclude:
- arch: ${{ github.event_name == 'pull_request' && !contains(github.event.pull_request.labels.*.name, 'packaging') && 'i686' }}
- build_type: ${{ (github.event_name == 'pull_request' && !contains(github.event.pull_request.labels.*.name, 'packaging') || contains(github.ref, 'refs/tags/v')) && 'Debug' }}
steps:
- uses: actions/checkout@v4
- name: Cache compiler output
uses: actions/cache@v4
with:
path: ".cache/ccache"
key: ${{ github.job }}-${{ matrix.arch }}-${{ matrix.build_type }}-ccache
- name: Install docker-compose
run: sudo apt-get install -y docker-compose
- name: Run build
run: docker-compose run --rm windows_builder.${{ matrix.arch }} ./windows/cross-compile/build.sh --arch ${{ matrix.arch }} --build-type ${{ matrix.build_type }} --run-tests --src-dir /qtox
- name: Upload installer
if: matrix.build_type == 'release'
uses: actions/upload-artifact@v4
with:
name: setup-qtox-${{ matrix.arch }}-${{ matrix.build_type }}.exe
path: package-prefix/setup-qtox.exe
- name: Upload zip
uses: actions/upload-artifact@v4
with:
name: qtox-${{ matrix.arch }}-${{ matrix.build_type }}.zip
path: install-prefix/qtox-${{ matrix.arch }}-${{ matrix.build_type }}.zip
- name: Rename exe for release upload
if: contains(github.ref, 'refs/tags/v')
run: |
cp package-prefix/setup-qtox.exe setup-qtox-${{ matrix.arch }}-release.exe
sha256sum setup-qtox-${{ matrix.arch }}-release.exe > setup-qtox-${{ matrix.arch }}-release.exe.sha256
- name: Upload to versioned release
if: contains(github.ref, 'refs/tags/v')
uses: ncipollo/release-action@v1
with:
allowUpdates: true
draft: true
token: ${{ secrets.GITHUB_TOKEN }}
artifacts: "setup-qtox-${{ matrix.arch }}-release.exe,setup-qtox-${{ matrix.arch }}-release.exe.sha256"
- name: Rename zip for nightly upload
if: github.event_name == 'push' && github.ref == 'refs/heads/master'
run: |
cp install-prefix/qtox-${{ matrix.arch }}-${{ matrix.build_type }}.zip qtox-nightly-${{ matrix.arch }}-${{ matrix.build_type }}.zip
sha256sum qtox-nightly-${{ matrix.arch }}-${{ matrix.build_type }}.zip > qtox-nightly-${{ matrix.arch }}-${{ matrix.build_type }}.zip.sha256
- name: Upload zip to nightly release
if: github.event_name == 'push' && github.ref == 'refs/heads/master'
uses: ncipollo/release-action@v1
with:
allowUpdates: true
tag: nightly
omitBodyDuringUpdate: true
omitNameDuringUpdate: true
prerelease: true
replacesArtifacts: true
token: ${{ secrets.GITHUB_TOKEN }}
artifacts: "qtox-nightly-${{ matrix.arch }}-${{ matrix.build_type }}.zip,qtox-nightly-${{ matrix.arch }}-${{ matrix.build_type }}.zip.sha256"
- name: Rename exe for nightly upload
if: github.event_name == 'push' && github.ref == 'refs/heads/master' && matrix.build_type == 'release'
run: |
cp package-prefix/setup-qtox.exe qtox-nightly-${{ matrix.arch }}-${{ matrix.build_type }}.exe
sha256sum qtox-nightly-${{ matrix.arch }}-${{ matrix.build_type }}.exe > qtox-nightly-${{ matrix.arch }}-${{ matrix.build_type }}.exe.sha256
- name: Upload exe to nightly release
if: github.event_name == 'push' && github.ref == 'refs/heads/master' && matrix.build_type == 'release'
uses: ncipollo/release-action@v1
with:
allowUpdates: true
tag: nightly
omitBodyDuringUpdate: true
omitNameDuringUpdate: true
prerelease: true
replacesArtifacts: true
token: ${{ secrets.GITHUB_TOKEN }}
artifacts: "qtox-nightly-${{ matrix.arch }}-${{ matrix.build_type }}.exe,qtox-nightly-${{ matrix.arch }}-${{ matrix.build_type }}.exe.sha256"
################################################################################################
# Documentation/website jobs
################################################################################################
build-docs:
name: Docs
runs-on: ubuntu-22.04
env:
DOXYGEN_CONFIG_FILE: doxygen.conf
steps:
- uses: actions/checkout@v4
with:
fetch-depth: 0
- name: Run
run: .ci-scripts/build-docs.sh
- name: Deploy
if: github.ref == 'refs/heads/master' && github.repository_owner == 'qTox'
env:
access_key: ${{ secrets.DOXYGEN_DEPLOY_KEY }}
run: .ci-scripts/deploy-docs.sh