Skip to content

Build Munki Beta Release (Manual) #1

Build Munki Beta Release (Manual)

Build Munki Beta Release (Manual) #1

name: Build Munki Beta Release (Manual)
env:
APP_SIGNING_IDENTITY: "Developer ID Application: Mac Admins Open Source (T4SK8ZXCXG)"
INSTALLER_SIGNING_IDENTITY: "Developer ID Installer: Mac Admins Open Source (T4SK8ZXCXG)"
NOTARY_APP_PASSWORD: ${{ secrets.NOTARY_APP_PASSWORD_MAOS }}
REVISION: 9e541a8e1a4ccd8df54df03c6e5495ebdb23b6f3 # hardcoded for now until we figure out how we want to tackle this - v6.5.0b1
XCODE_PATH: "/Applications/Xcode_15.2.app"
on: [workflow_dispatch]
jobs:
build:
runs-on: macos-13
steps:
- name: Checkout repo
uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
with:
fetch-depth: 0
path: munki-builds
- name: Checkout munki repo
uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
with:
fetch-depth: 0
path: munki
ref: ${{env.REVISION}}
repository: munki/munki
- name: Install Apple Xcode certificates
uses: apple-actions/import-codesign-certs@8f3fb608891dd2244cdab3d69cd68c0d37a7fe93 # v2.0.0
with:
keychain-password: ${{ github.run_id }}
p12-file-base64: ${{ secrets.APP_CERTIFICATES_P12_MAOS }}
p12-password: ${{ secrets.APP_CERTIFICATES_P12_PASSWORD_MAOS }}
- name: Install Apple Installer certificates
uses: apple-actions/import-codesign-certs@8f3fb608891dd2244cdab3d69cd68c0d37a7fe93 # v2.0.0
with:
create-keychain: false # do not create a new keychain for this value
keychain-password: ${{ github.run_id }}
p12-file-base64: ${{ secrets.PKG_CERTIFICATES_P12_MAOS }}
p12-password: ${{ secrets.PKG_CERTIFICATES_P12_PASSWORD_MAOS }}
- name: Set Xcode Version
run: sudo xcode-select -s "$XCODE_PATH"
- name: Build munki package
run: |
cd ./munki
./code/tools/make_munki_mpkg.sh -p -S "$APP_SIGNING_IDENTITY" -s "$INSTALLER_SIGNING_IDENTITY"
echo "MUNKI_PKG_PATH=$(find . -type f -name "*.pkg")" >> $GITHUB_ENV
echo "MUNKI_VERSION=$(find . -type f -name "*.pkg" | sed 's/[^\-]*-//' | sed 's/\.[^.]*$//')" >> $GITHUB_ENV
- name: Notarize and staple package
id: notarize_and_staple
run: |
"$XCODE_PATH/Contents/Developer/usr/bin/notarytool" store-credentials --apple-id "[email protected]" --team-id "T4SK8ZXCXG" --password "$NOTARY_APP_PASSWORD" munki
"$XCODE_PATH/Contents/Developer/usr/bin/notarytool" submit "./munki/$MUNKI_PKG_PATH" --keychain-profile "munki" --wait
"$XCODE_PATH/Contents/Developer/usr/bin/stapler" staple "./munki/$MUNKI_PKG_PATH"
- name: Generate changelog
if: ${{ false }} # disable job or now
id: changelog
uses: metcalfc/changelog-generator@afdcb9470aebdb2252c0c95a1c130723c9e21f3a # v4.1
with:
myToken: ${{ secrets.GITHUB_TOKEN }}
reverse: 'true'
- name: Create Release
id: create_release
uses: softprops/action-gh-release@de2c0eb89ae2a093876385947365aca7b0e5f844 # v0.1.15
with:
name: Munki v${{env.MUNKI_VERSION}} Beta
tag_name: v${{env.MUNKI_VERSION}}
draft: false
prerelease: true
token: ${{ secrets.GITHUB_TOKEN }}
body: |
This is a signed and notarized build of munki betas
files: ${{github.workspace}}/munki/*.pkg