ci: big refac to finally rationalize the xcode mess

XCode project/workspace/configurations/target/pods have been in a mess for a while. Some changes done to address that:

* remove alt-tab-macos/ which was confusing
* ci/ becomes scripts/ as these can be used locally too
* added 3 xcconfig files to set aside important parameters so we stop passing flags around or modifying the huge pbxproj

.gitignore

@@ -2,8 +2,7 @@
 xcuserdata/
 xcshareddata/
 /node_modules/
-/build/
+/DerivedData/
 /Pods/
 
 .DS_Store
-

.travis.yml

@@ -6,25 +6,28 @@ node_js:
 cache: npm
 env:
   - IS_RELEASE=$(if [ "$TRAVIS_BRANCH" = "master" -a "$TRAVIS_PULL_REQUEST" = "false" ]; then echo true; fi)
+  - XCODE_BUILD_PATH="DerivedData/alt-tab-macos/Build/Products/Release"
+  - VERSION_FILE="VERSION.txt"
+  - CHANGELOG_DELTA_FILE="CHANGELOG_DELTA.txt"
+  - APP_NAME="$(awk -F ' = ' '/PRODUCT_NAME/ { print $2; }' < config/base.xcconfig)"
 install: true # disable default install
 script:
   - env | sort
   - npm ci
   - npx commitlint-travis
-  - if [ $IS_RELEASE ]; then ci/determine_version.sh; fi
-  - if [ $IS_RELEASE ]; then ci/set_version_in_app.sh; fi
-  - ci/build_release.sh
-  - if [ $IS_RELEASE ]; then ci/package_release.sh; fi
-  - if [ $IS_RELEASE ]; then ci/update_appcast.sh; fi
-  - if [ $IS_RELEASE ]; then ci/update_homebrew_cask.sh; fi
+  - if [ $IS_RELEASE ]; then scripts/determine_version_and_changelog.sh; fi
+  - if [ $IS_RELEASE ]; then scripts/set_version_in_app.sh; fi
+  - xcodebuild -workspace alt-tab-macos.xcworkspace -scheme Release
+  - if [ $IS_RELEASE ]; then scripts/package_and_notarize_release.sh; fi
+  - if [ $IS_RELEASE ]; then scripts/update_appcast.sh; fi
+  - if [ $IS_RELEASE ]; then scripts/update_homebrew_cask.sh; fi
   - if [ $IS_RELEASE ]; then npx semantic-release; fi
 deploy:
   provider: releases
   token:
     secure: wcAMT2rbXhhdk6lsc6EG9VZZkSW0BjOwjYSyXzHjKrgiXsQcZAzAsOkuisj8EfeYN9/uhpa8XX7f5KsdkE5reMqVGGWqdmJU4NnmK5Aew0LmBbzFHfffliQecVCzMmGYPmhPcDxAjidYxgCMrMbvQFaElc0WXdIsQNcaNieSkEgZw6TwGsTxgHXABD2e575K3SN/PPcq7Nx5mRZkURI7YLmo2KfsD2OPR4IcEXFpJRFbPcAZIpKaHUIC2VzpayJA93pBe+siwU150p04PzfSs/nTH/nUO9m24SUi6kAIzVN77cExvX+JDnQoVLz0V45L0iJjkKDTVb07rVOsfm6Pcuaaj2ZVXlpujSb7B5LDUIspUn/NnqMLOtzbSTuaGcx2u+zCcC0b17KooznilQ/sFq3YpeNdmjL4VL5fsw1hdpjcP6S9DqZ90TJZqy6xBQP5NubuJukH//BRilhWGfnq5rOFUlqrN8aApJ7gYry0K2rB8rVWWvA9cU+zX351iy0EERICEU6q3rQwq8gFUbdNATPJJgNg7n0PaNXSQTTF9VluZTRVUtMrpA0hWe7dn+Tvrvhrnhmqvccw3Qfw/i3SECIDHHtsjwLqHCx5gkz/xUdf7+t3k6x+r6Veua0Z3jvyVhdHprU47VTSUhM/n87EiKyNRuKa9IpA18eSlZ59exU=
   file_glob: true
-  file:
-    - build/Release/*.zip
+  file: "$XCODE_BUILD_PATH/*.zip"
   cleanup: false
   on:
     repo: lwouis/alt-tab-macos

README.md

@@ -64,7 +64,7 @@ This project has minimal dependency on Xcode-only features (e.g. InterfaceBuilde
 * `pod install` to fetch the dependencies with [CocoaPods](https://cocoapods.org/)
 * `xcodebuild -workspace alt-tab-macos.xcworkspace -scheme Release` to build the .app
 
-Note that on debug builds, to avoid having to re-check the `System Preferences > Security & Privacy` permissions on every build, we use a code-signing certificate. You can generate one on your local machine in one step by running `ci/generate_debug_certificate.sh`.
+Note that on debug builds, to avoid having to re-check the `System Preferences > Security & Privacy` permissions on every build, we use a code-signing certificate. You can generate one on your local machine in one step by running `scripts/generate_selfsigned_codesign_certificate.sh`.
 
 If you want to contribute a PR, please run `npm install` once. It will add the pre-commit hook to ensure that your commits follow the convention and will pass the PR.
 

config/base.xcconfig

@@ -0,0 +1,13 @@
+// docs: https://help.apple.com/xcode/#/dev745c5c974
+
+PRODUCT_NAME = AltTab
+PRODUCT_BUNDLE_IDENTIFIER = com.lwouis.alt-tab-macos
+MACOSX_DEPLOYMENT_TARGET = 10.12
+SWIFT_VERSION = 4.2
+INFOPLIST_FILE = Info.plist
+CODE_SIGN_ENTITLEMENTS = alt_tab_macos.entitlements
+ENABLE_HARDENED_RUNTIME = YES // for notorization
+IDEDerivedDataPathOverride = DerivedData
+FRAMEWORK_SEARCH_PATHS = $(inherited) /System/Library/PrivateFrameworks // for SkyLight.framework
+LD_RUNPATH_SEARCH_PATHS = $(inherited) @executable_path/../Frameworks // for accessing swift dylibs at runtime
+SWIFT_ACTIVE_COMPILATION_CONDITIONS = DEBUG // for macros like `#if DEBUG`

config/debug.xcconfig

@@ -0,0 +1,6 @@
+// docs: https://help.apple.com/xcode/#/dev745c5c974
+
+#include "Pods/Target Support Files/Pods-alt-tab-macos/Pods-alt-tab-macos.debug.xcconfig"
+#include "base.xcconfig"
+
+CODE_SIGN_IDENTITY = Local Self-Signed

config/release.xcconfig

@@ -0,0 +1,8 @@
+// docs: https://help.apple.com/xcode/#/dev745c5c974
+
+#include "Pods/Target Support Files/Pods-alt-tab-macos/Pods-alt-tab-macos.release.xcconfig"
+#include "base.xcconfig"
+
+CODE_SIGN_IDENTITY = Developer ID Application: Louis Pontoise (QXD7GW8FHY)
+OTHER_CODE_SIGN_FLAGS = --timestamp // for notorization
+CODE_SIGN_INJECT_BASE_ENTITLEMENTS = NO // for notorization

ci/determine_version.sh → scripts/determine_version_and_changelog.sh

@@ -6,5 +6,5 @@ semanticRelease=$(npx semantic-release --dry-run --ci false)
 version=$(echo "$semanticRelease" | sed -nE 's/.+The next release version is (.+)/\1/p')
 changelogDelta=$(echo "$semanticRelease" | sed -n '/Release note for version/,$p' | sed '1d')
 
-echo "$version" > VERSION.txt
-echo "$changelogDelta" > CHANGELOG_DELTA.txt
+echo "$version" > $VERSION_FILE
+echo "$changelogDelta" > $CHANGELOG_DELTA_FILE

ci/build_release.sh → scripts/import_codesign_certificate_into_keychain.sh

@@ -17,5 +17,3 @@ echo "$APPLE_P12_CERTIFICATE" | base64 --decode > $certificateFile.p12
 # import p12 into Keychain
 security import $certificateFile.p12 -P "$APPLE_P12_CERTIFICATE_PASSWORD" -T /usr/bin/codesign
 security set-key-partition-list -S apple-tool:,apple: -s -k $keychainPassword $keychain
-# build release .app
-xcodebuild CODE_SIGN_IDENTITY="Developer ID Application: Louis Pontoise (QXD7GW8FHY)" -workspace alt-tab-macos.xcworkspace -scheme Release

scripts/package_and_notarize_release.sh

@@ -0,0 +1,43 @@
+#!/usr/bin/env bash
+
+set -exu
+
+version="$(cat $VERSION_FILE)"
+appFile="$APP_NAME.app"
+zipName="$APP_NAME-$version.zip"
+bundleId="$(awk -F ' = ' '/PRODUCT_BUNDLE_IDENTIFIER/ { print $2; }' < config/base.xcconfig)"
+
+cd "$XCODE_BUILD_PATH"
+ditto -c -k --keepParent "$appFile" "$zipName"
+
+# request notarization
+requestUUID=$(xcrun altool \
+  --notarize-app \
+  --verbose \
+  -ITunesTransport DAV \
+  --primary-bundle-id "$bundleId" \
+  --username "$APPLE_ID" \
+  --password "$APPLE_PASSWORD" \
+  --file "$zipName" 2>&1 |
+  tee /dev/tty |
+  awk '/RequestUUID/ { print $NF; }')
+if [[ $requestUUID == "" ]]; then exit 1; fi
+
+# poll notarization status until done
+requestStatus="in progress"
+while [[ "$requestStatus" == "in progress" ]]; do
+  sleep 10
+  requestLogs=$(xcrun altool \
+    --notarization-info "$requestUUID" \
+    --username "$APPLE_ID" \
+    --password "$APPLE_PASSWORD" 2>&1)
+  requestStatus=$(echo "$requestLogs" | awk -F ': ' '/Status:/ { print $2; }')
+done
+if [[ $requestStatus != "success" ]]; then
+  echo "$requestLogs" | awk -F ': ' '/LogFileURL:/ { print $2; }' | xargs curl
+  exit 1
+fi
+
+# staple build
+xcrun stapler staple "$appFile"
+ditto -c -k --keepParent "$appFile" "$zipName"

ci/set_version_in_app.sh → scripts/set_version_in_app.sh

@@ -2,6 +2,6 @@
 
 set -exu
 
-version="$(cat VERSION.txt)"
+version="$(cat $VERSION_FILE)"
 # set the version in the app meta-data for the AppStore and app "Get Info" panel
-sed -i '' -e "s/#VERSION#/$version/" alt-tab-macos/Info.plist
+sed -i '' -e "s/#VERSION#/$version/" Info.plist

ci/update_appcast.sh → scripts/update_appcast.sh

@@ -2,13 +2,12 @@
 
 set -exu
 
-version="$(cat VERSION.txt)"
-changelogDelta="$(npx marked < CHANGELOG_DELTA.txt)"
+version="$(cat $VERSION_FILE)"
+changelogDelta="$(npx marked < $CHANGELOG_DELTA_FILE)"
 date="$(date +'%a, %d %b %Y %H:%M:%S %z')"
-minimumSystemVersion="$(sed -En 's/MACOSX_DEPLOYMENT_TARGET = (.+);/\1/p' alt-tab-macos.xcodeproj/project.pbxproj | head -n 1 | awk '{$1=$1};1')"
-version="$(cat VERSION.txt)"
-zipName="AltTab-$version.zip"
-edSignatureAndLength=$(Pods/Sparkle/bin/sign_update -s $SPARKLE_ED_PRIVATE_KEY "build/Release/$zipName")
+minimumSystemVersion="$(awk -F ' = ' '/MACOSX_DEPLOYMENT_TARGET/ { print $2; }' < config/base.xcconfig)"
+zipName="$APP_NAME-$version.zip"
+edSignatureAndLength=$(Pods/Sparkle/bin/sign_update -s $SPARKLE_ED_PRIVATE_KEY "$XCODE_BUILD_PATH/$zipName")
 
 echo "
     <item>

ci/update_homebrew_cask.sh → scripts/update_homebrew_cask.sh

@@ -2,6 +2,6 @@
 
 set -exu
 
-version="$(cat VERSION.txt)"
+version="$(cat $VERSION_FILE)"
 
 cask-repair --cask-version "$version" alt-tab