460 lines
14 KiB
YAML
460 lines
14 KiB
YAML
name: Build Flutter App
|
|
|
|
on:
|
|
workflow_dispatch:
|
|
|
|
jobs:
|
|
build-android:
|
|
runs-on: ubuntu-latest
|
|
permissions:
|
|
id-token: write
|
|
attestations: write
|
|
contents: read
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
|
|
- name: Setup Java
|
|
uses: actions/setup-java@v4
|
|
with:
|
|
distribution: "temurin"
|
|
java-version: "17"
|
|
|
|
- name: Setup Flutter
|
|
uses: subosito/flutter-action@v2
|
|
with:
|
|
channel: "stable"
|
|
cache: true
|
|
|
|
- name: Cache Pub dependencies
|
|
uses: actions/cache@v4
|
|
with:
|
|
path: |
|
|
~/.pub-cache
|
|
key: ${{ runner.os }}-pub-${{ hashFiles('**/pubspec.lock') }}
|
|
restore-keys: |
|
|
${{ runner.os }}-pub-
|
|
|
|
- name: Cache Gradle
|
|
uses: actions/cache@v4
|
|
with:
|
|
path: |
|
|
~/.gradle/caches
|
|
~/.gradle/wrapper
|
|
key: ${{ runner.os }}-gradle-${{ hashFiles('**/*.gradle*', '**/gradle-wrapper.properties') }}
|
|
restore-keys: |
|
|
${{ runner.os }}-gradle-
|
|
|
|
- name: Install dependencies
|
|
run: flutter pub get
|
|
|
|
- name: Configure Android signing
|
|
run: |
|
|
echo "${{ secrets.ANDROID_KEYSTORE_BASE64 }}" | base64 --decode > android/app/upload-keystore.jks
|
|
cat > android/key.properties << EOF
|
|
storePassword=${{ secrets.ANDROID_STORE_PASSWORD }}
|
|
keyPassword=${{ secrets.ANDROID_KEY_PASSWORD }}
|
|
keyAlias=${{ secrets.ANDROID_KEY_ALIAS }}
|
|
storeFile=upload-keystore.jks
|
|
EOF
|
|
|
|
- name: Build APK
|
|
run: flutter build apk --release --dart-define=ENABLE_UPDATE_CHECK=true
|
|
|
|
- name: Clean up keystore
|
|
if: always()
|
|
run: rm -f android/app/upload-keystore.jks android/key.properties
|
|
|
|
- name: Rename APK
|
|
run: |
|
|
cp build/app/outputs/flutter-apk/app-release.apk plezy-android.apk
|
|
|
|
- name: Attest APK
|
|
uses: actions/attest-build-provenance@v2
|
|
with:
|
|
subject-path: plezy-android.apk
|
|
|
|
- name: Upload APK
|
|
uses: actions/upload-artifact@v4
|
|
with:
|
|
name: android-apk
|
|
path: plezy-android.apk
|
|
|
|
build-ios:
|
|
runs-on: macos-26
|
|
permissions:
|
|
id-token: write
|
|
attestations: write
|
|
contents: read
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
|
|
- name: Setup Flutter
|
|
uses: subosito/flutter-action@v2
|
|
with:
|
|
channel: "stable"
|
|
cache: true
|
|
|
|
- name: Cache Pub dependencies
|
|
uses: actions/cache@v4
|
|
with:
|
|
path: |
|
|
~/.pub-cache
|
|
key: ${{ runner.os }}-pub-${{ hashFiles('**/pubspec.lock') }}
|
|
restore-keys: |
|
|
${{ runner.os }}-pub-
|
|
|
|
- name: Cache CocoaPods
|
|
uses: actions/cache@v4
|
|
with:
|
|
path: |
|
|
ios/Pods
|
|
~/Library/Caches/CocoaPods
|
|
~/.cocoapods
|
|
key: ${{ runner.os }}-pods-${{ hashFiles('**/Podfile.lock') }}
|
|
restore-keys: |
|
|
${{ runner.os }}-pods-
|
|
|
|
- name: Install dependencies
|
|
run: flutter pub get
|
|
|
|
- name: Build iOS (no codesign)
|
|
run: flutter build ios --release --no-codesign --dart-define=ENABLE_UPDATE_CHECK=true
|
|
|
|
- name: Create IPA
|
|
run: |
|
|
mkdir -p Payload
|
|
cp -r build/ios/iphoneos/Runner.app Payload/
|
|
zip -r plezy-ios.ipa Payload
|
|
|
|
- name: Attest IPA
|
|
uses: actions/attest-build-provenance@v2
|
|
with:
|
|
subject-path: plezy-ios.ipa
|
|
|
|
- name: Upload IPA
|
|
uses: actions/upload-artifact@v4
|
|
with:
|
|
name: ios-ipa
|
|
path: plezy-ios.ipa
|
|
|
|
build-macos:
|
|
runs-on: macos-26
|
|
permissions:
|
|
id-token: write
|
|
attestations: write
|
|
contents: read
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
|
|
- name: Setup Flutter
|
|
uses: subosito/flutter-action@v2
|
|
with:
|
|
channel: "stable"
|
|
cache: true
|
|
|
|
- name: Cache Pub dependencies
|
|
uses: actions/cache@v4
|
|
with:
|
|
path: |
|
|
~/.pub-cache
|
|
key: ${{ runner.os }}-pub-${{ hashFiles('**/pubspec.lock') }}
|
|
restore-keys: |
|
|
${{ runner.os }}-pub-
|
|
|
|
- name: Cache CocoaPods
|
|
uses: actions/cache@v4
|
|
with:
|
|
path: |
|
|
macos/Pods
|
|
~/Library/Caches/CocoaPods
|
|
~/.cocoapods
|
|
key: ${{ runner.os }}-macos-pods-${{ hashFiles('**/Podfile.lock') }}
|
|
restore-keys: |
|
|
${{ runner.os }}-macos-pods-
|
|
|
|
- name: Install dependencies
|
|
run: flutter pub get
|
|
|
|
- name: Build macOS
|
|
run: flutter build macos --release --dart-define=ENABLE_UPDATE_CHECK=true
|
|
|
|
- name: Import Code Signing Certificate
|
|
env:
|
|
MACOS_CERTIFICATE_BASE64: ${{ secrets.MACOS_CERTIFICATE_BASE64 }}
|
|
MACOS_CERTIFICATE_PASSWORD: ${{ secrets.MACOS_CERTIFICATE_PASSWORD }}
|
|
KEYCHAIN_PASSWORD: ${{ secrets.KEYCHAIN_PASSWORD }}
|
|
run: |
|
|
# Create temporary keychain
|
|
KEYCHAIN_PATH=$RUNNER_TEMP/build.keychain
|
|
security create-keychain -p "$KEYCHAIN_PASSWORD" $KEYCHAIN_PATH
|
|
security set-keychain-settings -lut 21600 $KEYCHAIN_PATH
|
|
security unlock-keychain -p "$KEYCHAIN_PASSWORD" $KEYCHAIN_PATH
|
|
|
|
# Import certificate to keychain
|
|
CERTIFICATE_PATH=$RUNNER_TEMP/certificate.p12
|
|
echo "$MACOS_CERTIFICATE_BASE64" | base64 --decode -o $CERTIFICATE_PATH
|
|
security import $CERTIFICATE_PATH -k $KEYCHAIN_PATH -P "$MACOS_CERTIFICATE_PASSWORD" -T /usr/bin/codesign
|
|
security set-key-partition-list -S apple-tool:,apple:,codesign: -s -k "$KEYCHAIN_PASSWORD" $KEYCHAIN_PATH
|
|
|
|
# Add keychain to search list
|
|
security list-keychains -d user -s $KEYCHAIN_PATH login.keychain
|
|
|
|
- name: Sign Application
|
|
env:
|
|
APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
|
|
run: |
|
|
# Find the identity
|
|
IDENTITY=$(security find-identity -v -p codesigning | grep "Developer ID Application" | head -1 | grep -o '".*"' | tr -d '"')
|
|
echo "Signing with identity: $IDENTITY"
|
|
|
|
APP_PATH="build/macos/Build/Products/Release/plezy.app"
|
|
|
|
# Sign all frameworks and dylibs first (inside-out signing)
|
|
find "$APP_PATH/Contents/Frameworks" -name "*.framework" -o -name "*.dylib" | while read framework; do
|
|
echo "Signing: $framework"
|
|
codesign --force --sign "$IDENTITY" --timestamp --options runtime "$framework"
|
|
done
|
|
|
|
# Sign the app bundle itself
|
|
echo "Signing app bundle: $APP_PATH"
|
|
codesign --force --sign "$IDENTITY" --timestamp --options runtime --entitlements macos/Runner/Release.entitlements "$APP_PATH"
|
|
|
|
- name: Verify Signature
|
|
run: |
|
|
APP_PATH="build/macos/Build/Products/Release/plezy.app"
|
|
echo "Verifying signature..."
|
|
codesign -dvvv "$APP_PATH"
|
|
codesign --verify --deep --strict --verbose=2 "$APP_PATH"
|
|
|
|
- name: Notarize Application
|
|
env:
|
|
APPLE_ID: ${{ secrets.APPLE_ID }}
|
|
APPLE_APP_SPECIFIC_PASSWORD: ${{ secrets.APPLE_APP_SPECIFIC_PASSWORD }}
|
|
APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
|
|
run: |
|
|
APP_PATH="build/macos/Build/Products/Release/plezy.app"
|
|
|
|
# Create a temporary ZIP for notarization submission
|
|
echo "Creating ZIP for notarization..."
|
|
ditto -c -k --keepParent "$APP_PATH" notarization.zip
|
|
|
|
# Submit for notarization
|
|
echo "Submitting to Apple's notary service..."
|
|
xcrun notarytool submit notarization.zip \
|
|
--apple-id "$APPLE_ID" \
|
|
--password "$APPLE_APP_SPECIFIC_PASSWORD" \
|
|
--team-id "$APPLE_TEAM_ID" \
|
|
--wait
|
|
|
|
# Staple the notarization ticket to the app
|
|
echo "Stapling notarization ticket..."
|
|
xcrun stapler staple "$APP_PATH"
|
|
|
|
# Verify stapling
|
|
echo "Verifying notarization..."
|
|
xcrun stapler validate "$APP_PATH"
|
|
|
|
- name: Create ZIP
|
|
run: |
|
|
cd build/macos/Build/Products/Release
|
|
ditto -c -k --sequesterRsrc --keepParent plezy.app $GITHUB_WORKSPACE/plezy-macos.zip
|
|
|
|
- name: Attest macOS ZIP
|
|
uses: actions/attest-build-provenance@v2
|
|
with:
|
|
subject-path: plezy-macos.zip
|
|
|
|
- name: Upload macOS ZIP
|
|
uses: actions/upload-artifact@v4
|
|
with:
|
|
name: macos-zip
|
|
path: plezy-macos.zip
|
|
|
|
build-windows:
|
|
runs-on: windows-latest
|
|
permissions:
|
|
id-token: write
|
|
attestations: write
|
|
contents: read
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
|
|
- name: Setup Flutter
|
|
uses: subosito/flutter-action@v2
|
|
with:
|
|
channel: "stable"
|
|
cache: true
|
|
|
|
- name: Cache Pub dependencies
|
|
uses: actions/cache@v4
|
|
with:
|
|
path: |
|
|
~\AppData\Local\Pub\Cache
|
|
key: ${{ runner.os }}-pub-${{ hashFiles('**/pubspec.lock') }}
|
|
restore-keys: |
|
|
${{ runner.os }}-pub-
|
|
|
|
- name: Install dependencies
|
|
run: flutter pub get
|
|
|
|
- name: Build Windows
|
|
run: flutter build windows --release --dart-define=ENABLE_UPDATE_CHECK=true
|
|
|
|
- name: Build Windows Installer
|
|
run: .\windows\build-installer.ps1
|
|
|
|
- name: Attest Windows artifacts
|
|
uses: actions/attest-build-provenance@v2
|
|
with:
|
|
subject-path: |
|
|
plezy-windows-portable.zip
|
|
plezy-windows-installer.exe
|
|
|
|
- name: Upload Portable Archive
|
|
uses: actions/upload-artifact@v4
|
|
with:
|
|
name: windows-portable
|
|
path: plezy-windows-portable.zip
|
|
|
|
- name: Upload Installer
|
|
uses: actions/upload-artifact@v4
|
|
with:
|
|
name: windows-installer
|
|
path: plezy-windows-installer.exe
|
|
|
|
build-linux:
|
|
runs-on: ubuntu-latest
|
|
permissions:
|
|
id-token: write
|
|
attestations: write
|
|
contents: read
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
|
|
- name: Setup Flutter
|
|
uses: subosito/flutter-action@v2
|
|
with:
|
|
channel: "stable"
|
|
cache: true
|
|
|
|
- name: Cache Pub dependencies
|
|
uses: actions/cache@v4
|
|
with:
|
|
path: |
|
|
~/.pub-cache
|
|
key: ${{ runner.os }}-pub-${{ hashFiles('**/pubspec.lock') }}
|
|
restore-keys: |
|
|
${{ runner.os }}-pub-
|
|
|
|
- name: Cache APT packages
|
|
uses: awalsh128/cache-apt-pkgs-action@latest
|
|
with:
|
|
packages: clang cmake ninja-build pkg-config libgtk-3-dev liblzma-dev libstdc++-12-dev libasound2-dev libmpv-dev mpv keybinder-3.0
|
|
version: 1.0
|
|
|
|
- name: Install Linux dependencies
|
|
run: |
|
|
sudo apt-get update
|
|
sudo apt-get install -y clang cmake ninja-build pkg-config libgtk-3-dev liblzma-dev libstdc++-12-dev libasound2-dev libmpv-dev mpv keybinder-3.0
|
|
|
|
- name: Install dependencies
|
|
run: flutter pub get
|
|
|
|
- name: Build Linux
|
|
run: flutter build linux --release --dart-define=ENABLE_UPDATE_CHECK=true
|
|
|
|
- name: Create Archive
|
|
run: |
|
|
cd build/linux/x64/release/bundle
|
|
tar -czf $GITHUB_WORKSPACE/plezy-linux.tar.gz *
|
|
|
|
- name: Attest Linux tarball
|
|
uses: actions/attest-build-provenance@v2
|
|
with:
|
|
subject-path: plezy-linux.tar.gz
|
|
|
|
- name: Upload Linux App
|
|
uses: actions/upload-artifact@v4
|
|
with:
|
|
name: linux-app
|
|
path: plezy-linux.tar.gz
|
|
|
|
build-flatpak:
|
|
runs-on: ubuntu-latest
|
|
permissions:
|
|
id-token: write
|
|
attestations: write
|
|
contents: read
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
|
|
- name: Replace version placeholders
|
|
run: |
|
|
# Extract version from pubspec.yaml (e.g., "1.3.1+10" -> "1.3.1")
|
|
VERSION=$(grep '^version:' pubspec.yaml | sed 's/version: //' | sed 's/+.*//' | tr -d ' ')
|
|
DATE=$(date -u +%Y-%m-%d)
|
|
|
|
echo "Version: $VERSION"
|
|
echo "Date: $DATE"
|
|
|
|
# Replace placeholders in metainfo.xml
|
|
sed -i "s/{{VERSION}}/$VERSION/g" linux/com.edde746.plezy.metainfo.xml
|
|
sed -i "s/{{DATE}}/$DATE/g" linux/com.edde746.plezy.metainfo.xml
|
|
|
|
- name: Preprocess Flatpak manifest with flatpak-flutter
|
|
run: |
|
|
docker run --rm \
|
|
-v "$PWD":/usr/src/flatpak \
|
|
-u $(id -u):$(id -g) \
|
|
theappgineer/flatpak-flutter:latest \
|
|
linux/com.edde746.plezy.yml
|
|
|
|
- name: Build Flatpak
|
|
uses: flatpak/flatpak-github-actions/flatpak-builder@v6
|
|
with:
|
|
bundle: plezy.flatpak
|
|
manifest-path: linux/com.edde746.plezy.yml
|
|
cache-key: flatpak-builder-${{ github.sha }}
|
|
|
|
- name: Attest Flatpak
|
|
uses: actions/attest-build-provenance@v2
|
|
with:
|
|
subject-path: plezy.flatpak
|
|
|
|
- name: Upload Flatpak
|
|
uses: actions/upload-artifact@v4
|
|
with:
|
|
name: linux-flatpak
|
|
path: plezy.flatpak
|
|
|
|
create-release:
|
|
needs: [build-android, build-ios, build-macos, build-windows, build-linux, build-flatpak]
|
|
runs-on: ubuntu-latest
|
|
permissions:
|
|
contents: write
|
|
steps:
|
|
- name: Download all artifacts
|
|
uses: actions/download-artifact@v4
|
|
with:
|
|
path: artifacts
|
|
|
|
- name: Display structure of downloaded files
|
|
run: ls -R artifacts
|
|
|
|
- name: Create Release
|
|
uses: softprops/action-gh-release@v1
|
|
with:
|
|
files: |
|
|
artifacts/android-apk/plezy-android.apk
|
|
artifacts/ios-ipa/plezy-ios.ipa
|
|
artifacts/macos-zip/plezy-macos.zip
|
|
artifacts/windows-portable/plezy-windows-portable.zip
|
|
artifacts/windows-installer/plezy-windows-installer.exe
|
|
artifacts/linux-app/plezy-linux.tar.gz
|
|
artifacts/linux-flatpak/plezy.flatpak
|
|
draft: true
|
|
prerelease: false
|
|
generate_release_notes: true
|
|
env:
|
|
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|