build_nudge_pr.yml

name: Build signed Nudge for pull requests

on:
  pull_request_target:
    types: [labeled]

jobs:
  build:
    runs-on: macos-14
    if: contains(github.event.pull_request.labels.*.name, 'safe-to-test')

    steps:
    - name: Checkout nudge repo
      uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
      with:
        ref: ${{ github.event.pull_request.head.sha }}
        fetch-depth: 0

    - name: Install Apple Xcode certificates
      uses: apple-actions/import-codesign-certs@63fff01cd422d4b7b855d40ca1e9d34d2de9427d # v3.0.0
      with:
        keychain-password: ${{ github.run_id }}
        p12-file-base64: ${{ secrets.APP_CERTIFICATES_P12_MAOS }}
        p12-password: ${{ secrets.APP_CERTIFICATES_P12_PASSWORD_MAOS }}

    - name: Install Apple Installer certificates
      uses: apple-actions/import-codesign-certs@63fff01cd422d4b7b855d40ca1e9d34d2de9427d # v3.0.0
      with:
        create-keychain: false # do not create a new keychain for this value
        keychain-password: ${{ github.run_id }}
        p12-file-base64: ${{ secrets.PKG_CERTIFICATES_P12_MAOS }}
        p12-password: ${{ secrets.PKG_CERTIFICATES_P12_PASSWORD_MAOS }}

    - name: Run build script
      run: ./build_nudge.zsh

    - name: get environment variables
      id: get_env_var
      run: |
         echo "NUDGE_VERSION=$(/bin/cat ./build_info.txt)" >> $GITHUB_ENV
         echo "NUDGE_MAIN_VERSION=$(/bin/cat ./build_info_main.txt)" >> $GITHUB_ENV

    - name: Upload zip archive
      uses: actions/upload-artifact@0b2256b8c012f0828dc542b3febcab082c67f72b # v4.3.4
      with:
        name: packages
        path: outputs/

    - name: Clean up PR safety tag
      if: always()
      id: clean_up_pr_safety_tag
      run: |
         /usr/bin/curl --silent --fail-with-body -X DELETE -H 'Accept: application/vnd.github.v3+json' -H 'Authorization: token ${{ github.token }}' 'https://api.github.com/repos/${{ github.repository }}/issues/${{ github.event.number }}/labels/safe-to-test'