CodexNotes/.github/workflows/ci.yml at main · jiangsir-tech/CodexNotes · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
name: CI

on:
  push:
  pull_request:

permissions:
  contents: read

jobs:
  test:
    name: Test (${{ matrix.name }})
    runs-on: ${{ matrix.os }}
    timeout-minutes: 20
    strategy:
      fail-fast: false
      matrix:
        include:
          - name: Xcode 15.4 arm64
            os: macos-14
            developer_directory: /Applications/Xcode_15.4.app/Contents/Developer
            architecture: arm64
          - name: Current arm64
            os: macos-26
            developer_directory: ""
            architecture: arm64
          - name: macOS 15 Intel
            os: macos-15-intel
            developer_directory: ""
            architecture: x86_64

    steps:
      - name: Check out repository
        uses: actions/checkout@v6

      - name: Select Xcode
        if: matrix.developer_directory != ''
        run: sudo xcode-select --switch "${{ matrix.developer_directory }}"

      - name: Verify runner architecture
        env:
          EXPECTED_ARCHITECTURE: ${{ matrix.architecture }}
        run: |
          actual_architecture="$(uname -m)"
          if [[ "$actual_architecture" != "$EXPECTED_ARCHITECTURE" ]]; then
            echo "Expected $EXPECTED_ARCHITECTURE runner, got $actual_architecture." >&2
            exit 1
          fi

      - name: Report toolchain
        run: |
          xcodebuild -version
          swift --version
          xcrun --show-sdk-version

      - name: Verify localizations
        run: zsh scripts/verify-localizations.sh

      - name: Run tests
        run: COPYFILE_DISABLE=1 swift test

  universal-package:
    name: Package (Universal)
    runs-on: macos-14
    timeout-minutes: 25

    steps:
      - name: Check out repository
        uses: actions/checkout@v6

      - name: Select Xcode 15.4
        run: sudo xcode-select --switch /Applications/Xcode_15.4.app/Contents/Developer

      - name: Report packaging toolchain
        run: |
          xcodebuild -version
          swift --version
          xcrun --show-sdk-version

      - name: Package Universal app without release credentials
        env:
          CODEX_NOTES_INSTALL_LOCAL: "0"
          COPYFILE_DISABLE: "1"
        run: zsh scripts/package-app.sh

      - name: Verify Universal archive and all code slices
        env:
          EXTRACT_DIRECTORY: ${{ runner.temp }}/codexnotes-universal
        run: |
          mkdir -p "$EXTRACT_DIRECTORY"
          ditto -x -k dist/CodexNotes.zip "$EXTRACT_DIRECTORY"
          app_path="$EXTRACT_DIRECTORY/CodexNotes.app"
          test -d "$app_path"
          zsh scripts/verify-universal-app.sh "$app_path"
          codesign \
            --verify \
            --deep \
            --strict \
            --all-architectures \
            --verbose=2 \
            "$app_path"

      - name: Reject an app with one architecture removed
        env:
          EXTRACT_DIRECTORY: ${{ runner.temp }}/codexnotes-universal
          NEGATIVE_DIRECTORY: ${{ runner.temp }}/codexnotes-missing-slice
        run: |
          mkdir -p "$NEGATIVE_DIRECTORY"
          negative_app="$NEGATIVE_DIRECTORY/CodexNotes.app"
          ditto "$EXTRACT_DIRECTORY/CodexNotes.app" "$negative_app"

          executable="$negative_app/Contents/MacOS/CodexNotesProbe"
          thin_executable="$NEGATIVE_DIRECTORY/CodexNotesProbe-arm64"
          lipo "$executable" -remove x86_64 -output "$thin_executable"
          mv "$thin_executable" "$executable"
          chmod 755 "$executable"
          if [[ "$(lipo -archs "$executable")" != "arm64" ]]; then
            echo "Failed to construct the arm64-only negative fixture." >&2
            exit 1
          fi

          codesign --force --deep --sign - "$negative_app"
          codesign \
            --verify \
            --deep \
            --strict \
            --all-architectures \
            --verbose=2 \
            "$negative_app"

          if zsh scripts/verify-universal-app.sh "$negative_app"; then
            echo "Universal verifier accepted an app missing x86_64." >&2
            exit 1
          fi