ci: fix no team id #3
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Nightly | |
| on: | |
| push: | |
| branches: | |
| - main | |
| workflow_dispatch: | |
| permissions: | |
| contents: write | |
| concurrency: | |
| group: nightly | |
| cancel-in-progress: true | |
| env: | |
| SCHEME: EasyTier | |
| BUILD_CONFIGURATION: Release | |
| IPA_NAME: EasyTier-nightly-trollstore.ipa | |
| TEAM_ID: M2G6355ZK7 | |
| jobs: | |
| build-and-release: | |
| name: Build and publish TrollStore IPA | |
| runs-on: macos-26 | |
| timeout-minutes: 90 | |
| steps: | |
| - name: Check out repository | |
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| - name: Select Xcode and install build dependencies | |
| shell: bash | |
| run: | | |
| set -euo pipefail | |
| echo "ARCHIVE_PATH=${RUNNER_TEMP}/EasyTier.xcarchive" >> "${GITHUB_ENV}" | |
| echo "PACKAGE_PATH=${RUNNER_TEMP}/package" >> "${GITHUB_ENV}" | |
| echo "EXPORT_PATH=${RUNNER_TEMP}/export" >> "${GITHUB_ENV}" | |
| sudo xcode-select --switch /Applications/Xcode_26.6.app/Contents/Developer | |
| xcodebuild -version | |
| rustup target add aarch64-apple-ios | |
| if ! command -v protoc >/dev/null 2>&1; then | |
| brew install protobuf | |
| fi | |
| rustc --version | |
| protoc --version | |
| - name: Archive unsigned Release build | |
| shell: bash | |
| run: | | |
| set -euo pipefail | |
| xcodebuild archive \ | |
| -project EasyTier.xcodeproj \ | |
| -scheme "${SCHEME}" \ | |
| -configuration "${BUILD_CONFIGURATION}" \ | |
| -destination "generic/platform=iOS" \ | |
| -archivePath "${ARCHIVE_PATH}" \ | |
| CODE_SIGNING_ALLOWED=NO \ | |
| CODE_SIGNING_REQUIRED=NO \ | |
| AD_HOC_CODE_SIGNING_ALLOWED=NO \ | |
| CODE_SIGN_IDENTITY="" \ | |
| DEVELOPMENT_TEAM="${TEAM_ID}" \ | |
| CURRENT_PROJECT_VERSION="${GITHUB_RUN_NUMBER}" | |
| - name: Ad-hoc sign app for TrollStore | |
| shell: bash | |
| run: | | |
| set -euo pipefail | |
| APP_PATH="${ARCHIVE_PATH}/Products/Applications/EasyTier.app" | |
| TUNNEL_PATH="${APP_PATH}/PlugIns/EasyTierNetworkExtension.appex" | |
| WIDGET_PATH="${APP_PATH}/PlugIns/EasyTierWidgetExtension.appex" | |
| APP_ENTITLEMENTS="${RUNNER_TEMP}/EasyTier.signing.entitlements" | |
| TUNNEL_ENTITLEMENTS="${RUNNER_TEMP}/EasyTierNetworkExtension.signing.entitlements" | |
| WIDGET_ENTITLEMENTS="${RUNNER_TEMP}/EasyTierWidgetExtension.signing.entitlements" | |
| create_signing_entitlements() { | |
| local source_path="$1" | |
| local bundle_path="$2" | |
| local output_path="$3" | |
| local bundle_identifier | |
| local application_identifier | |
| bundle_identifier="$( | |
| /usr/libexec/PlistBuddy \ | |
| -c "Print :CFBundleIdentifier" \ | |
| "${bundle_path}/Info.plist" | |
| )" | |
| application_identifier="${TEAM_ID}.${bundle_identifier}" | |
| cp "${source_path}" "${output_path}" | |
| /usr/libexec/PlistBuddy \ | |
| -c "Add :application-identifier string ${application_identifier}" \ | |
| -c "Add :com.apple.developer.team-identifier string ${TEAM_ID}" \ | |
| -c "Add :keychain-access-groups array" \ | |
| -c "Add :keychain-access-groups:0 string ${application_identifier}" \ | |
| "${output_path}" | |
| } | |
| create_signing_entitlements \ | |
| EasyTier/EasyTier.entitlements \ | |
| "${APP_PATH}" \ | |
| "${APP_ENTITLEMENTS}" | |
| create_signing_entitlements \ | |
| EasyTierNetworkExtension/EasyTierNetworkExtension.entitlements \ | |
| "${TUNNEL_PATH}" \ | |
| "${TUNNEL_ENTITLEMENTS}" | |
| create_signing_entitlements \ | |
| EasyTierWidgetExtension/EasyTierWidgetExtension.entitlements \ | |
| "${WIDGET_PATH}" \ | |
| "${WIDGET_ENTITLEMENTS}" | |
| codesign \ | |
| --force \ | |
| --sign - \ | |
| --timestamp=none \ | |
| --generate-entitlement-der \ | |
| --entitlements "${WIDGET_ENTITLEMENTS}" \ | |
| "${WIDGET_PATH}" | |
| codesign \ | |
| --force \ | |
| --sign - \ | |
| --timestamp=none \ | |
| --generate-entitlement-der \ | |
| --entitlements "${TUNNEL_ENTITLEMENTS}" \ | |
| "${TUNNEL_PATH}" | |
| codesign \ | |
| --force \ | |
| --sign - \ | |
| --timestamp=none \ | |
| --generate-entitlement-der \ | |
| --entitlements "${APP_ENTITLEMENTS}" \ | |
| "${APP_PATH}" | |
| - name: Package TrollStore IPA | |
| shell: bash | |
| run: | | |
| set -euo pipefail | |
| APP_PATH="${ARCHIVE_PATH}/Products/Applications/EasyTier.app" | |
| mkdir -p "${PACKAGE_PATH}/Payload" "${EXPORT_PATH}" | |
| cp -R "${APP_PATH}" "${PACKAGE_PATH}/Payload/EasyTier.app" | |
| ( | |
| cd "${PACKAGE_PATH}" | |
| /usr/bin/zip -qry "${EXPORT_PATH}/${IPA_NAME}" Payload | |
| ) | |
| - name: Upload workflow artifact | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 | |
| with: | |
| name: EasyTier-nightly-trollstore-${{ github.run_number }} | |
| path: ${{ runner.temp }}/export/EasyTier-nightly-trollstore.ipa | |
| if-no-files-found: error | |
| retention-days: 14 | |
| - name: Update rolling nightly release | |
| env: | |
| GH_TOKEN: ${{ github.token }} | |
| shell: bash | |
| run: | | |
| set -euo pipefail | |
| BUILD_TIME="$(date -u '+%Y-%m-%d %H:%M:%S UTC')" | |
| SHORT_SHA="${GITHUB_SHA:0:7}" | |
| RELEASE_NOTES="${RUNNER_TEMP}/nightly-release-notes.md" | |
| { | |
| echo "Automated Release build from [\`${SHORT_SHA}\`](${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}/commit/${GITHUB_SHA})." | |
| echo | |
| echo "- Build configuration: \`${BUILD_CONFIGURATION}\`" | |
| echo "- Code signing: ad-hoc with Xcode Team ID \`${TEAM_ID}\` and complete app/extension entitlements" | |
| echo "- Built: ${BUILD_TIME}" | |
| echo "- Workflow run: [#${GITHUB_RUN_NUMBER}](${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}/actions/runs/${GITHUB_RUN_ID})" | |
| echo | |
| echo "> This credentials-free IPA is prepared for TrollStore. Normal iOS installation still requires signing with an Apple provisioning profile." | |
| } > "${RELEASE_NOTES}" | |
| git tag --force nightly "${GITHUB_SHA}" | |
| git push --force origin refs/tags/nightly | |
| if gh release view nightly >/dev/null 2>&1; then | |
| gh release edit nightly \ | |
| --target "${GITHUB_SHA}" \ | |
| --title "EasyTier Nightly (${SHORT_SHA})" \ | |
| --notes-file "${RELEASE_NOTES}" \ | |
| --prerelease \ | |
| --latest=false | |
| gh release upload nightly \ | |
| "${EXPORT_PATH}/${IPA_NAME}" \ | |
| --clobber | |
| gh release delete-asset nightly \ | |
| EasyTier-nightly-unsigned.ipa \ | |
| --yes 2>/dev/null || true | |
| gh release delete-asset nightly \ | |
| EasyTier-nightly-unsigned.ipa.sha256 \ | |
| --yes 2>/dev/null || true | |
| else | |
| gh release create nightly \ | |
| "${EXPORT_PATH}/${IPA_NAME}" \ | |
| --verify-tag \ | |
| --target "${GITHUB_SHA}" \ | |
| --title "EasyTier Nightly (${SHORT_SHA})" \ | |
| --notes-file "${RELEASE_NOTES}" \ | |
| --prerelease \ | |
| --latest=false | |
| fi |