1- name : Deployment Release for ARM64 - Run manually!
2-
1+ name : Deployment for Arm64
32on :
3+ push :
4+ branches :
5+ - main
6+ - main-release
7+ paths-ignore :
8+ - ' docs/**'
9+ - ' src/test/**'
10+ - ' README.md'
11+ tags :
12+ - ' *'
13+ pull_request :
14+ merge_group :
415 workflow_dispatch :
516 inputs :
617 notarization :
718 type : boolean
8- required : true
9- default : true
10- push :
11- branches :
12- - arm64mac-release
13- - updateArm64Notarization
19+ required : false
20+ default : false
1421
1522env :
1623 SpringerNatureAPIKey : ${{ secrets.SpringerNatureAPIKey }}
3037 strategy :
3138 fail-fast : false
3239 matrix :
33- os : [self-hosted]
3440 include :
35- - os : self-hosted
41+ - os : macos-14
3642 displayName : macOS (Arm64)
3743 suffix : ' _arm64'
3844 runs-on : ${{ matrix.os }}
4248 id : checksecrets
4349 shell : bash
4450 run : |
45- [ -n "$BUILDJABREFPRIVATEKEY" ] || exit 1
51+ [ -n "$BUILDJABREFPRIVATEKEY" ] || exit 1
4652 env :
47- BUILDJABREFPRIVATEKEY : ${{ secrets.buildJabRefPrivateKey }}
53+ BUILDJABREFPRIVATEKEY : ${{ secrets.buildJabRefPrivateKey }}
4854 - name : Fetch all history for all tags and branches
4955 uses : actions/checkout@v4
5056 with :
@@ -66,29 +72,27 @@ jobs:
6672 - name : Clean up keychain
6773 run : |
6874 security delete-keychain signing_temp.keychain ${{runner.temp}}/keychain/notarization.keychain || true
69- - name : Setup OSX key chain on macOS
75+ - name : Setup OSX key chain on macOS-arm
76+ if : (steps.checksecrets.outputs.secretspresent == 'YES')
7077 uses : apple-actions/import-codesign-certs@v2
7178 with :
7279 p12-file-base64 : ${{ secrets.OSX_SIGNING_CERT }}
7380 p12-password : ${{ secrets.OSX_CERT_PWD }}
7481 keychain-password : jabref
7582 - name : Setup OSX key chain on OSX for app id cert
83+ if : (steps.checksecrets.outputs.secretspresent == 'YES')
7684 uses : apple-actions/import-codesign-certs@v2
7785 with :
7886 p12-file-base64 : ${{ secrets.OSX_SIGNING_CERT_APPLICATION }}
7987 p12-password : ${{ secrets.OSX_CERT_PWD }}
8088 create-keychain : false
8189 keychain-password : jabref
82- - name : Create notarization keychain
83- run : |
84- mkdir ${{runner.temp}}/keychain
85- security create-keychain -p jabref ${{runner.temp}}/keychain/notarization.keychain
86- security set-keychain-settings ${{runner.temp}}/keychain/notarization.keychain
8790 - name : Setup Gradle
8891 uses : gradle/gradle-build-action@v3
8992 - name : Prepare merged jars and modules dir (macOS)
9093 run : ./gradlew -i -PprojVersion="${{ steps.gitversion.outputs.AssemblySemVer }}" -PprojVersionInfo="${{ steps.gitversion.outputs.InformationalVersion }}" prepareModulesDir
9194 - name : Build dmg (macOS)
95+ if : (steps.checksecrets.outputs.secretspresent == 'YES')
9296 shell : bash
9397 run : |
9498 jpackage \
@@ -113,6 +117,7 @@ jobs:
113117 --file-associations buildres/mac/bibtexAssociations.properties \
114118 --jlink-options --bind-services
115119 - name : Build pkg (macOS)
120+ if : (steps.checksecrets.outputs.secretspresent == 'YES')
116121 shell : bash
117122 run : |
118123 jpackage \
@@ -137,32 +142,85 @@ jobs:
137142 --file-associations buildres/mac/bibtexAssociations.properties \
138143 --jlink-options --bind-services
139144 - name : Rename files with arm64 suffix as well
145+ if : (steps.checksecrets.outputs.secretspresent == 'YES')
140146 shell : bash
141147 run : |
142148 mv build/distribution/JabRef-${{ steps.gitversion.outputs.Major }}.${{ steps.gitversion.outputs.Minor }}.dmg build/distribution/JabRef-${{ steps.gitversion.outputs.Major }}.${{ steps.gitversion.outputs.Minor }}-arm64.dmg
143149 mv build/distribution/JabRef-${{ steps.gitversion.outputs.Major }}.${{ steps.gitversion.outputs.Minor }}.pkg build/distribution/JabRef-${{ steps.gitversion.outputs.Major }}.${{ steps.gitversion.outputs.Minor }}-arm64.pkg
150+ - name : Setup rsync (macOS)
151+ if : ${{ (!startsWith(github.ref, 'refs/heads/gh-readonly-queue')) && (steps.checksecrets.outputs.secretspresent == 'YES') && ((matrix.os == 'macos-14') && !((startsWith(github.ref, 'refs/tags/') || inputs.notarization == true))) }}
152+ run : brew install rsync
153+ - name : Setup SSH key
154+ if : ${{ (steps.checksecrets.outputs.secretspresent == 'YES') && (!startsWith(github.ref, 'refs/heads/gh-readonly-queue')) && ((matrix.os != 'macos-14') || !((startsWith(github.ref, 'refs/tags/') || (inputs.notarization == true)))) }}
155+ run : |
156+ echo "${{ secrets.buildJabRefPrivateKey }}" > sshkey
157+ chmod 600 sshkey
158+ - name : Upload to builds.jabref.org (linux, macOS)
159+ # macOS: Negated condition of "Upload to GitHub workflow artifacts store (macOS)"
160+ # Reason: We either upload the non-notarized files - or notarize the files later (and upload these later)
161+ # needs to be on one line; multi line does not work
162+ if : ${{ (!startsWith(github.ref, 'refs/heads/gh-readonly-queue')) && (steps.checksecrets.outputs.secretspresent == 'YES') && ((matrix.os == 'ubuntu-latest') || ((matrix.os == 'macos-14') && !((startsWith(github.ref, 'refs/tags/') || inputs.notarization == true)))) }}
163+ shell : bash
164+ run : |
165+ rsync -rt --chmod=Du=rwx,Dg=rx,Do=rx,Fu=rw,Fg=r,Fo=r --itemize-changes --stats --rsync-path="mkdir -p /var/www/builds.jabref.org/www/${{ steps.gitversion.outputs.branchName }} && rsync" -e 'ssh -p 9922 -i sshkey -o StrictHostKeyChecking=no' build/distribution/ jrrsync@build-upload.jabref.org:/var/www/builds.jabref.org/www/${{ steps.gitversion.outputs.branchName }}/
166+ - name : Upload to GitHub workflow artifacts store (macOS)
167+ if : (matrix.os == 'macos-14') && (steps.checksecrets.outputs.secretspresent == 'YES') && (startsWith(github.ref, 'refs/tags/') || inputs.notarization == true)
168+ uses : actions/upload-artifact@v4
169+ with :
170+ # tbn = to-be-notarized
171+ name : JabRef-macOS-arm-tbn
172+ path : build/distribution
173+ compression-level : 0 # no compression
174+ - name : Upload to GitHub workflow artifacts store
175+ if : (steps.checksecrets.outputs.secretspresent != 'YES')
176+ uses : actions/upload-artifact@v4
177+ with :
178+ # tbn = to-be-notarized
179+ name : JabRef-${{ matrix.os }}
180+ path : build/distribution
181+ compression-level : 0 # no compression
182+
183+ notarize : # outsourced in a separate job to be able to rerun if this fails for timeouts
184+ name : macOS notarization-arm
185+ runs-on : macos-14
186+ needs : [build]
187+ if : ${{ startsWith(github.ref, 'refs/tags/') || inputs.notarization == true }}
188+ steps :
189+ - name : Check secrets presence
190+ id : checksecrets
191+ shell : bash
192+ run : |
193+ if [ "$BUILDJABREFPRIVATEKEY" == "" ]; then
194+ echo "secretspresent=NO" >> $GITHUB_OUTPUT
195+ else
196+ echo "secretspresent=YES" >> $GITHUB_OUTPUT
197+ fi
198+ env :
199+ BUILDJABREFPRIVATEKEY : ${{ secrets.buildJabRefPrivateKey }}
200+ - name : Download from GitHub workflow artifacts store (macOS)
201+ if : (steps.checksecrets.outputs.secretspresent == 'YES')
202+ uses : actions/download-artifact@master
203+ with :
204+ name : JabRef-macOS-arm-tbn
205+ path : build/distribution/
144206 - name : Notarize dmg
145- if : (startsWith(github.ref, 'refs/tags/') || (${{ inputs.notarization }}) )
207+ if : (steps.checksecrets.outputs.secretspresent == 'YES' )
146208 shell : bash
147209 run : |
148- xcrun notarytool store-credentials "notarytool-profile" --apple-id "vorstand@jabref.org" --team-id "6792V39SK3" --password "${{ secrets.OSX_NOTARIZATION_APP_PWD }}" --keychain ${{runner.temp}}/keychain/notarization.keychain
149- xcrun notarytool submit build/distribution/JabRef-${{ steps.gitversion .outputs.Major }}.${{ steps.gitversion .outputs.Minor }}-arm64.dmg --keychain-profile "notarytool-profile" --keychain ${{runner.temp}}/keychain/notarization.keychain --wait
150- xcrun stapler staple build/distribution/JabRef-${{ steps.gitversion .outputs.Major }}.${{ steps.gitversion .outputs.Minor }}-arm64.dmg
210+ xcrun notarytool store-credentials "notarytool-profile" --apple-id "vorstand@jabref.org" --team-id "6792V39SK3" --password "${{ secrets.OSX_NOTARIZATION_APP_PWD }}"
211+ xcrun notarytool submit build/distribution/JabRef-${{ needs.build .outputs.major }}.${{ needs.build .outputs.minor }}-arm64.dmg --keychain-profile "notarytool-profile" --wait
212+ xcrun stapler staple build/distribution/JabRef-${{ needs.build .outputs.major }}.${{ needs.build .outputs.minor }}-arm64.dmg
151213 - name : Notarize pkg
152- if : (startsWith(github.ref, 'refs/tags/') || (${{ inputs.notarization }}) )
214+ if : (steps.checksecrets.outputs.secretspresent == 'YES' )
153215 shell : bash
154216 run : |
155- xcrun notarytool store-credentials "notarytool-profile" --apple-id "vorstand@jabref.org" --team-id "6792V39SK3" --password "${{ secrets.OSX_NOTARIZATION_APP_PWD }}" --keychain ${{runner.temp}}/keychain/notarization.keychain
156- xcrun notarytool submit build/distribution/JabRef-${{ steps.gitversion .outputs.Major }}.${{ steps.gitversion .outputs.Minor }}-arm64.pkg --keychain-profile "notarytool-profile" --keychain ${{runner.temp}}/keychain/notarization.keychain --wait
157- xcrun stapler staple build/distribution/JabRef-${{ steps.gitversion .outputs.Major }}.${{ steps.gitversion .outputs.Minor }}-arm64.pkg
158- - name : Upload with rsync
159- if : ${{ !startsWith(github.ref, 'refs/heads/gh-readonly-queue') }}
217+ xcrun notarytool store-credentials "notarytool-profile" --apple-id "vorstand@jabref.org" --team-id "6792V39SK3" --password "${{ secrets.OSX_NOTARIZATION_APP_PWD }}"
218+ xcrun notarytool submit build/distribution/JabRef-${{ needs.build .outputs.major }}.${{ needs.build .outputs.minor }}-arm64.pkg --keychain-profile "notarytool-profile" --wait
219+ xcrun stapler staple build/distribution/JabRef-${{ needs.build .outputs.major }}.${{ needs.build .outputs.minor }}-arm64.pkg
220+ - name : Upload to builds.jabref.org
221+ if : (steps.checksecrets.outputs.secretspresent == 'YES')
160222 shell : bash
161223 run : |
162- rsync -Pavz --itemize-changes --stats --partial-dir=/tmp/partial --rsync-path="mkdir -p /var/www/builds.jabref.org/www/${{ steps.gitversion.outputs.branchName }} && rsync" -e 'ssh -p 9922 -i ~/.ssh/id_rsa' build/distribution/ jrrsync@build-upload.jabref.org:/var/www/builds.jabref.org/www/${{ steps.gitversion.outputs.branchName }}/
163- - name : Upload to GitHub workflow artifacts store
164- if : ${{ !startsWith(github.ref, 'refs/heads/gh-readonly-queue') }}
165- uses : actions/upload-artifact@v4
166- with :
167- name : JabRef-${{ matrix.displayName }}
168- path : build/distribution
224+ echo "${{ secrets.buildJabRefPrivateKey }}" > sshkey
225+ chmod 600 sshkey
226+ rsync -rt --chmod=Du=rwx,Dg=rx,Do=rx,Fu=rw,Fg=r,Fo=r --itemize-changes --stats --rsync-path="mkdir -p /var/www/builds.jabref.org/www/${{ needs.build.outputs.branchname }} && rsync" -e 'ssh -p 9922 -i sshkey -o StrictHostKeyChecking=no' build/distribution/ jrrsync@build-upload.jabref.org:/var/www/builds.jabref.org/www/${{ needs.build.outputs.branchname }}/
0 commit comments