mirror of
https://github.com/ghostty-org/ghostty.git
synced 2026-07-31 20:59:02 +00:00
7aa9591746
Closes #12228 Supersedes #12388 **UPDATED** - Also check comments for additional details! This commit represents the majority of the work necessary to upgrade Ghostty to use Zig 0.16.0. At this point, all tests pass under Linux, but more work may be necessary to get them to build and function on other platforms. There are some parts of this update that deserve commentary, so that follows below: ## Expanded use of global state (IO/environment related) Global state, once generally only used by the C library, has now been expanded to be used across the project at large. The static local variable that holds the state has been moved private in its source container with all attributes that need to be accessed globally gated behind accessors, most of which guard on testing and send test copies instead. Use of the global state in non-testing scenarios asserts that the state has been initialized through `init` naturally through the optional assertion process. The rationale for this change is to have a location to store a general-purpose I/O implementation and environment variables, both of which are now provided through [Juicy Main](https://ziglang.org/download/0.16.0/release-notes.html#Juicy-Main) and hence can no longer be accessed or mutated through stdlib without use of lower-level system calls and hacks (some of which are employed, but sparingly). As the code matures, dependence on global state should naturally slim down. We do not allow global state to be used in libghostty-vt. There are comptime guards that prevent this should compilation of libghostty-vt end up pulling `global.zig`. This means that as per the last paragraph, work has already begun to de-couple the codebase from global state where necessary. Additionally, in some places where environment needs to be updated and where it can be done in an isolated fashion, environment maps are used - system-level injection of environment through the use of `setenv` or `unsetenv` now only happens during early initialization (and hopefully we can remove these in the future too, especially since they require re-synchronization of the higher-level environment primitives after this is done). ## The `lib/compat` Tree Some stdlib features that have been removed but still either seem they would be valuable to us or outright complex to move away from (particularly `SegmentedList`) have been extracted from 0.15.2, updated as needed, and placed in `src/lib/compat`. The intention again is to allow for piecemeal migration to more modern implementations or possibly straight local versions. This paradigm has also allowed us to add `std.Io.Condition.waitTimeout`, which incidentally was missed in the 0.16.0 shuffle and has been re-added for 0.17.0. We can remove this in favor of the upstream when we eventually migrate to that, obviously. Note that there was a lot more of this extracted code when this work was started, but a lot of said code has been removed (namely environment or process/fd-related functionality). ## translate-c Issues (functional on Linux, Darwin WIP) There have been a number of C translation issues that we have been working through through submitted patches and the great help from folks on the Arocc and Zig side. This is ongoing, with the remaining work to getting things fixed mainly focused on the MacOS side. Stay tuned for further developments. As mentioned at the top, follow comments for more details!
1061 lines
46 KiB
YAML
1061 lines
46 KiB
YAML
on:
|
|
workflow_run:
|
|
workflows: [Test]
|
|
types: [completed]
|
|
branches: [main]
|
|
|
|
workflow_dispatch:
|
|
inputs:
|
|
pr:
|
|
type: number
|
|
required: false
|
|
|
|
name: Release Tip
|
|
|
|
# We must only run one release workflow at a time to prevent corrupting
|
|
# our release artifacts.
|
|
concurrency:
|
|
group: ${{ github.workflow }}
|
|
cancel-in-progress: false
|
|
|
|
jobs:
|
|
setup:
|
|
if: |
|
|
github.event_name == 'workflow_dispatch' ||
|
|
(
|
|
github.repository_owner == 'ghostty-org' &&
|
|
github.ref_name == 'main'
|
|
)
|
|
runs-on: namespace-profile-ghostty-sm
|
|
outputs:
|
|
should_skip: ${{ steps.check.outputs.should_skip }}
|
|
build: ${{ steps.extract_build_info.outputs.build }}
|
|
commit: ${{ steps.extract_build_info.outputs.commit }}
|
|
commit_long: ${{ steps.extract_build_info.outputs.commit_long }}
|
|
steps:
|
|
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
|
|
with:
|
|
# Important so that build number generation works
|
|
fetch-depth: 0
|
|
- name: Setup Cache
|
|
uses: namespacelabs/nscloud-cache-action@c5f8dab7560444c4bf8dbc64f1b203431873c547 # v1.6.1
|
|
with:
|
|
path: |
|
|
/nix
|
|
- uses: cachix/install-nix-action@630ae543ea3a38a9a4166f03376c02c50f408342 # v31.11.0
|
|
with:
|
|
nix_path: nixpkgs=channel:nixos-unstable
|
|
- uses: cachix/cachix-action@5f2d7c5294214f71b873db4b969586b980625e71 # v17
|
|
with:
|
|
name: ghostty
|
|
authToken: "${{ secrets.CACHIX_AUTH_TOKEN }}"
|
|
- name: Extract build info
|
|
id: extract_build_info
|
|
run: |
|
|
GHOSTTY_BUILD=$(git rev-list --count HEAD)
|
|
GHOSTTY_COMMIT=$(git rev-parse --short HEAD)
|
|
GHOSTTY_COMMIT_LONG=$(git rev-parse HEAD)
|
|
echo "build=$GHOSTTY_BUILD" >> $GITHUB_OUTPUT
|
|
echo "commit=$GHOSTTY_COMMIT" >> $GITHUB_OUTPUT
|
|
echo "commit_long=$GHOSTTY_COMMIT_LONG" >> $GITHUB_OUTPUT
|
|
# Classify what changed since the last tip. `build` matches any file that
|
|
# can reach the built artifact; `release_tip` re-adds release-tip.yml,
|
|
# which defines the build/tag/publish jobs. Everything else (all of
|
|
# .github plus docs and repo/lint/editor metadata) never changes the
|
|
# artifact. Skipped on manual dispatches, which always build.
|
|
- name: Detect changes since last tip
|
|
id: changes
|
|
if: github.event_name == 'workflow_run'
|
|
uses: dorny/paths-filter@7b450fff21473bca461d4b92ce414b9d0420d706 # v4.0.2
|
|
with:
|
|
token: ""
|
|
base: tip
|
|
predicate-quantifier: "every"
|
|
filters: |
|
|
build:
|
|
- '**'
|
|
- '!.github/**'
|
|
- '!README.md'
|
|
- '!CONTRIBUTING.md'
|
|
- '!HACKING.md'
|
|
- '!PACKAGING.md'
|
|
- '!AI_POLICY.md'
|
|
- '!AGENTS.md'
|
|
- '!CLAUDE.md'
|
|
- '!Doxyfile'
|
|
- '!DoxygenLayout.xml'
|
|
- '!LICENSE'
|
|
- '!CODEOWNERS'
|
|
- '!.clang-format'
|
|
- '!.editorconfig'
|
|
- '!.envrc'
|
|
- '!.gitattributes'
|
|
- '!.gitignore'
|
|
- '!.mailmap'
|
|
- '!.prettierignore'
|
|
- '!.shellcheckrc'
|
|
- '!.swiftlint.yml'
|
|
- '!typos.toml'
|
|
- '!valgrind.supp'
|
|
release_tip:
|
|
- '.github/workflows/release-tip.yml'
|
|
|
|
- name: Determine skip
|
|
id: check
|
|
run: |
|
|
if nix develop -c nu .github/scripts/ghostty-tip "$(git rev-parse HEAD)"; then
|
|
echo "Tip already built for this commit, skipping"
|
|
echo "should_skip=true" >> "$GITHUB_OUTPUT"
|
|
elif [ "${{ steps.changes.outputs.build }}" = "false" ] &&
|
|
[ "${{ steps.changes.outputs.release_tip }}" = "false" ]; then
|
|
echo "Only non-artifact files changed since the last tip, skipping"
|
|
echo "should_skip=true" >> "$GITHUB_OUTPUT"
|
|
else
|
|
echo "should_skip=false" >> "$GITHUB_OUTPUT"
|
|
fi
|
|
|
|
tag:
|
|
runs-on: namespace-profile-ghostty-sm
|
|
needs: [setup, build-macos]
|
|
if: needs.setup.outputs.should_skip != 'true'
|
|
steps:
|
|
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
|
|
- name: Tip Tag
|
|
run: |
|
|
git config user.name "github-actions[bot]"
|
|
git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
|
|
git tag -fa tip -m "Latest Continuous Release" ${GITHUB_SHA}
|
|
git push --force origin tip
|
|
|
|
sentry-dsym-debug-slow:
|
|
runs-on: namespace-profile-ghostty-sm
|
|
needs: [setup, build-macos-debug-slow]
|
|
if: needs.setup.outputs.should_skip != 'true'
|
|
env:
|
|
GHOSTTY_COMMIT_LONG: ${{ needs.setup.outputs.commit_long }}
|
|
steps:
|
|
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
|
|
|
|
- name: Install sentry-cli
|
|
run: |
|
|
curl -sL https://sentry.io/get-cli/ | bash
|
|
|
|
- name: Download dSYM
|
|
run: |
|
|
curl -L https://tip.files.ghostty.dev/${GHOSTTY_COMMIT_LONG}/ghostty-macos-universal-debug-slow-dsym.zip > dsym.zip
|
|
|
|
- name: Upload dSYM to Sentry
|
|
env:
|
|
SENTRY_AUTH_TOKEN: ${{ secrets.SENTRY_AUTH_TOKEN }}
|
|
run: |
|
|
sentry-cli dif upload --project ghostty --wait dsym.zip
|
|
|
|
sentry-dsym-debug-fast:
|
|
runs-on: namespace-profile-ghostty-sm
|
|
needs: [setup, build-macos-debug-fast]
|
|
if: needs.setup.outputs.should_skip != 'true'
|
|
env:
|
|
GHOSTTY_COMMIT_LONG: ${{ needs.setup.outputs.commit_long }}
|
|
steps:
|
|
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
|
|
|
|
- name: Install sentry-cli
|
|
run: |
|
|
curl -sL https://sentry.io/get-cli/ | bash
|
|
|
|
- name: Download dSYM
|
|
run: |
|
|
curl -L https://tip.files.ghostty.dev/${GHOSTTY_COMMIT_LONG}/ghostty-macos-universal-debug-fast-dsym.zip > dsym.zip
|
|
|
|
- name: Upload dSYM to Sentry
|
|
env:
|
|
SENTRY_AUTH_TOKEN: ${{ secrets.SENTRY_AUTH_TOKEN }}
|
|
run: |
|
|
sentry-cli dif upload --project ghostty --wait dsym.zip
|
|
|
|
sentry-dsym:
|
|
runs-on: namespace-profile-ghostty-sm
|
|
needs: [setup, build-macos]
|
|
if: needs.setup.outputs.should_skip != 'true'
|
|
env:
|
|
GHOSTTY_COMMIT_LONG: ${{ needs.setup.outputs.commit_long }}
|
|
steps:
|
|
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
|
|
|
|
- name: Install sentry-cli
|
|
run: |
|
|
curl -sL https://sentry.io/get-cli/ | bash
|
|
|
|
- name: Download dSYM
|
|
run: |
|
|
curl -L https://tip.files.ghostty.dev/${GHOSTTY_COMMIT_LONG}/ghostty-macos-universal-dsym.zip > dsym.zip
|
|
|
|
- name: Upload dSYM to Sentry
|
|
env:
|
|
SENTRY_AUTH_TOKEN: ${{ secrets.SENTRY_AUTH_TOKEN }}
|
|
run: |
|
|
sentry-cli dif upload --project ghostty --wait dsym.zip
|
|
|
|
source-tarball:
|
|
needs: [setup]
|
|
if: |
|
|
needs.setup.outputs.should_skip != 'true' &&
|
|
(
|
|
github.event_name == 'workflow_dispatch' ||
|
|
(
|
|
github.repository_owner == 'ghostty-org' &&
|
|
github.ref_name == 'main'
|
|
)
|
|
)
|
|
runs-on: namespace-profile-ghostty-sm
|
|
env:
|
|
ZIG_LOCAL_CACHE_DIR: /zig/local-cache
|
|
ZIG_GLOBAL_CACHE_DIR: /zig/global-cache
|
|
steps:
|
|
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
|
|
- name: Setup Cache
|
|
uses: namespacelabs/nscloud-cache-action@c5f8dab7560444c4bf8dbc64f1b203431873c547 # v1.6.1
|
|
with:
|
|
path: |
|
|
/nix
|
|
/zig
|
|
- uses: cachix/install-nix-action@630ae543ea3a38a9a4166f03376c02c50f408342 # v31.11.0
|
|
with:
|
|
nix_path: nixpkgs=channel:nixos-unstable
|
|
- uses: cachix/cachix-action@5f2d7c5294214f71b873db4b969586b980625e71 # v17
|
|
with:
|
|
name: ghostty
|
|
authToken: "${{ secrets.CACHIX_AUTH_TOKEN }}"
|
|
- name: Create Tarball
|
|
run: |
|
|
rm -rf zig-out/dist
|
|
nix develop -c zig build distcheck
|
|
cp zig-out/dist/*.tar.gz ghostty-source.tar.gz
|
|
|
|
- name: Sign Tarball
|
|
run: |
|
|
echo -n "${{ secrets.MINISIGN_KEY }}" > minisign.key
|
|
echo -n "${{ secrets.MINISIGN_PASSWORD }}" > minisign.password
|
|
nix develop -c minisign -S -m ghostty-source.tar.gz -s minisign.key < minisign.password
|
|
|
|
- name: Update Release
|
|
uses: softprops/action-gh-release@3d0d9888cb7fd7b750713d6e236d1fcb99157228 # v3.0.2
|
|
with:
|
|
name: 'Ghostty Tip ("Nightly")'
|
|
prerelease: true
|
|
tag_name: tip
|
|
target_commitish: ${{ github.sha }}
|
|
files: |
|
|
ghostty-source.tar.gz
|
|
ghostty-source.tar.gz.minisig
|
|
token: ${{ secrets.GH_RELEASE_TOKEN }}
|
|
|
|
source-tarball-lib-vt:
|
|
needs: [setup]
|
|
if: |
|
|
needs.setup.outputs.should_skip != 'true' &&
|
|
(
|
|
github.event_name == 'workflow_dispatch' ||
|
|
(
|
|
github.repository_owner == 'ghostty-org' &&
|
|
github.ref_name == 'main'
|
|
)
|
|
)
|
|
runs-on: namespace-profile-ghostty-sm
|
|
env:
|
|
GHOSTTY_COMMIT_LONG: ${{ needs.setup.outputs.commit_long }}
|
|
ZIG_LOCAL_CACHE_DIR: /zig/local-cache
|
|
ZIG_GLOBAL_CACHE_DIR: /zig/global-cache
|
|
steps:
|
|
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
|
|
- name: Setup Cache
|
|
uses: namespacelabs/nscloud-cache-action@c5f8dab7560444c4bf8dbc64f1b203431873c547 # v1.6.1
|
|
with:
|
|
path: |
|
|
/nix
|
|
/zig
|
|
- uses: cachix/install-nix-action@630ae543ea3a38a9a4166f03376c02c50f408342 # v31.11.0
|
|
with:
|
|
nix_path: nixpkgs=channel:nixos-unstable
|
|
- uses: cachix/cachix-action@5f2d7c5294214f71b873db4b969586b980625e71 # v17
|
|
with:
|
|
name: ghostty
|
|
authToken: "${{ secrets.CACHIX_AUTH_TOKEN }}"
|
|
- name: Create Tarball
|
|
run: |
|
|
rm -rf zig-out/dist
|
|
nix develop -c zig build dist -Demit-lib-vt=true
|
|
cp zig-out/dist/*.tar.gz libghostty-vt-source.tar.gz
|
|
|
|
- name: Sign Tarball
|
|
run: |
|
|
echo -n "${{ secrets.MINISIGN_KEY }}" > minisign.key
|
|
echo -n "${{ secrets.MINISIGN_PASSWORD }}" > minisign.password
|
|
nix develop -c minisign -S -m libghostty-vt-source.tar.gz -s minisign.key < minisign.password
|
|
|
|
- name: Update Release
|
|
uses: softprops/action-gh-release@3d0d9888cb7fd7b750713d6e236d1fcb99157228 # v3.0.2
|
|
with:
|
|
name: 'Ghostty Tip ("Nightly")'
|
|
prerelease: true
|
|
tag_name: tip
|
|
target_commitish: ${{ github.sha }}
|
|
files: |
|
|
libghostty-vt-source.tar.gz
|
|
libghostty-vt-source.tar.gz.minisig
|
|
token: ${{ secrets.GH_RELEASE_TOKEN }}
|
|
|
|
- name: Prep R2 Storage
|
|
run: |
|
|
mkdir -p blob/${GHOSTTY_COMMIT_LONG}
|
|
cp libghostty-vt-source.tar.gz blob/${GHOSTTY_COMMIT_LONG}/libghostty-vt-source.tar.gz
|
|
- name: Upload to R2
|
|
uses: ryand56/r2-upload-action@b801a390acbdeb034c5e684ff5e1361c06639e7c # v1.4
|
|
with:
|
|
r2-account-id: ${{ secrets.CF_R2_TIP_ACCOUNT_ID }}
|
|
r2-access-key-id: ${{ secrets.CF_R2_TIP_AWS_KEY }}
|
|
r2-secret-access-key: ${{ secrets.CF_R2_TIP_SECRET_KEY }}
|
|
r2-bucket: ghostty-tip
|
|
source-dir: blob
|
|
destination-dir: ./
|
|
|
|
- name: Echo Release URLs
|
|
run: |
|
|
echo "Release URLs:"
|
|
echo " Source Tarball: https://tip.files.ghostty.org/${GHOSTTY_COMMIT_LONG}/libghostty-vt-source.tar.gz"
|
|
|
|
build-lib-vt-xcframework:
|
|
needs: [setup]
|
|
if: |
|
|
needs.setup.outputs.should_skip != 'true' &&
|
|
(
|
|
github.event_name == 'workflow_dispatch' ||
|
|
(
|
|
github.repository_owner == 'ghostty-org' &&
|
|
github.ref_name == 'main'
|
|
)
|
|
)
|
|
runs-on: namespace-profile-ghostty-macos-tahoe
|
|
env:
|
|
GHOSTTY_COMMIT_LONG: ${{ needs.setup.outputs.commit_long }}
|
|
ZIG_LOCAL_CACHE_DIR: /Users/runner/zig/local-cache
|
|
ZIG_GLOBAL_CACHE_DIR: /Users/runner/zig/global-cache
|
|
steps:
|
|
- name: Checkout code
|
|
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
|
|
|
|
- name: Setup Cache
|
|
uses: namespacelabs/nscloud-cache-action@c5f8dab7560444c4bf8dbc64f1b203431873c547 # v1.6.1
|
|
with:
|
|
cache: |
|
|
xcode
|
|
path: |
|
|
/Users/runner/zig
|
|
|
|
# TODO(tahoe): https://github.com/NixOS/nix/issues/13342
|
|
- uses: DeterminateSystems/nix-installer-action@main
|
|
with:
|
|
determinate: true
|
|
- uses: cachix/cachix-action@5f2d7c5294214f71b873db4b969586b980625e71 # v17
|
|
with:
|
|
name: ghostty
|
|
authToken: "${{ secrets.CACHIX_AUTH_TOKEN }}"
|
|
|
|
- name: Xcode Select
|
|
run: sudo xcode-select -s /Applications/Xcode_26.6.app
|
|
|
|
- name: Build XCFramework
|
|
run: nix develop -c zig build -Demit-lib-vt -Doptimize=ReleaseFast
|
|
|
|
- name: Zip XCFramework
|
|
run: |
|
|
cd zig-out/lib
|
|
zip -9 -r ../../ghostty-vt.xcframework.zip ghostty-vt.xcframework
|
|
|
|
- name: Sign XCFramework
|
|
run: |
|
|
echo -n "${{ secrets.MINISIGN_KEY }}" > minisign.key
|
|
echo -n "${{ secrets.MINISIGN_PASSWORD }}" > minisign.password
|
|
nix develop -c minisign -S -m ghostty-vt.xcframework.zip -s minisign.key < minisign.password
|
|
|
|
- name: Update Release
|
|
uses: softprops/action-gh-release@3d0d9888cb7fd7b750713d6e236d1fcb99157228 # v3.0.2
|
|
with:
|
|
name: 'Ghostty Tip ("Nightly")'
|
|
prerelease: true
|
|
tag_name: tip
|
|
target_commitish: ${{ github.sha }}
|
|
files: |
|
|
ghostty-vt.xcframework.zip
|
|
ghostty-vt.xcframework.zip.minisig
|
|
token: ${{ secrets.GH_RELEASE_TOKEN }}
|
|
|
|
- name: Prep R2 Storage
|
|
run: |
|
|
mkdir -p blob/${GHOSTTY_COMMIT_LONG}
|
|
cp ghostty-vt.xcframework.zip blob/${GHOSTTY_COMMIT_LONG}/ghostty-vt.xcframework.zip
|
|
- name: Upload to R2
|
|
uses: ryand56/r2-upload-action@b801a390acbdeb034c5e684ff5e1361c06639e7c # v1.4
|
|
with:
|
|
r2-account-id: ${{ secrets.CF_R2_TIP_ACCOUNT_ID }}
|
|
r2-access-key-id: ${{ secrets.CF_R2_TIP_AWS_KEY }}
|
|
r2-secret-access-key: ${{ secrets.CF_R2_TIP_SECRET_KEY }}
|
|
r2-bucket: ghostty-tip
|
|
source-dir: blob
|
|
destination-dir: ./
|
|
|
|
- name: Echo Release URLs
|
|
run: |
|
|
echo "Release URLs:"
|
|
echo " XCFramework: https://tip.files.ghostty.org/${GHOSTTY_COMMIT_LONG}/ghostty-vt.xcframework.zip"
|
|
|
|
build-macos:
|
|
needs: [setup]
|
|
if: |
|
|
needs.setup.outputs.should_skip != 'true' &&
|
|
(
|
|
github.event_name == 'workflow_dispatch' ||
|
|
(
|
|
github.repository_owner == 'ghostty-org' &&
|
|
github.ref_name == 'main'
|
|
)
|
|
)
|
|
|
|
runs-on: namespace-profile-ghostty-macos-tahoe
|
|
timeout-minutes: 90
|
|
env:
|
|
GHOSTTY_BUILD: ${{ needs.setup.outputs.build }}
|
|
GHOSTTY_COMMIT: ${{ needs.setup.outputs.commit }}
|
|
GHOSTTY_COMMIT_LONG: ${{ needs.setup.outputs.commit_long }}
|
|
ZIG_LOCAL_CACHE_DIR: /Users/runner/zig/local-cache
|
|
ZIG_GLOBAL_CACHE_DIR: /Users/runner/zig/global-cache
|
|
steps:
|
|
- name: Checkout code
|
|
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
|
|
with:
|
|
# Important so that build number generation works
|
|
fetch-depth: 0
|
|
|
|
- name: Setup Cache
|
|
uses: namespacelabs/nscloud-cache-action@c5f8dab7560444c4bf8dbc64f1b203431873c547 # v1.6.1
|
|
with:
|
|
cache: |
|
|
xcode
|
|
path: |
|
|
/Users/runner/zig
|
|
|
|
# TODO(tahoe): https://github.com/NixOS/nix/issues/13342
|
|
- uses: DeterminateSystems/nix-installer-action@main
|
|
with:
|
|
determinate: true
|
|
- uses: cachix/cachix-action@5f2d7c5294214f71b873db4b969586b980625e71 # v17
|
|
with:
|
|
name: ghostty
|
|
authToken: "${{ secrets.CACHIX_AUTH_TOKEN }}"
|
|
|
|
- name: XCode Select
|
|
run: sudo xcode-select -s /Applications/Xcode_26.6.app
|
|
|
|
- name: Xcode Version
|
|
run: xcodebuild -version
|
|
|
|
# Setup Sparkle
|
|
- name: Setup Sparkle
|
|
env:
|
|
SPARKLE_VERSION: 2.9.0
|
|
run: |
|
|
mkdir -p .action/sparkle
|
|
cd .action/sparkle
|
|
curl -L https://github.com/sparkle-project/Sparkle/releases/download/${SPARKLE_VERSION}/Sparkle-for-Swift-Package-Manager.zip > sparkle.zip
|
|
unzip sparkle.zip
|
|
echo "$(pwd)/bin" >> $GITHUB_PATH
|
|
|
|
# GhosttyKit is the framework that is built from Zig for our native
|
|
# Mac app to access. Build this in release mode.
|
|
- name: Build GhosttyKit
|
|
run: nix develop -c zig build -Doptimize=ReleaseFast -Demit-macos-app=false
|
|
|
|
# The native app is built with native XCode tooling. This also does
|
|
# codesigning. IMPORTANT: this must NOT run in a Nix environment.
|
|
# Nix breaks xcodebuild so this has to be run outside.
|
|
- name: Build Ghostty.app
|
|
run: |
|
|
cd macos
|
|
xcodebuild -target Ghostty -configuration Release \
|
|
COMPILATION_CACHE_CAS_PATH=/Users/runner/Library/Developer/Xcode/DerivedData/CompilationCache.noindex \
|
|
COMPILATION_CACHE_KEEP_CAS_DIRECTORY=YES
|
|
|
|
# We inject the "build number" as simply the number of commits since HEAD.
|
|
# This will be a monotonically always increasing build number that we use.
|
|
- name: Update Info.plist
|
|
env:
|
|
SPARKLE_KEY_PUB: ${{ secrets.PROD_MACOS_SPARKLE_KEY_PUB }}
|
|
run: |
|
|
# Version Info
|
|
/usr/libexec/PlistBuddy -c "Set :GhosttyCommit $GHOSTTY_COMMIT" "macos/build/Release/Ghostty.app/Contents/Info.plist"
|
|
/usr/libexec/PlistBuddy -c "Set :CFBundleVersion $GHOSTTY_BUILD" "macos/build/Release/Ghostty.app/Contents/Info.plist"
|
|
/usr/libexec/PlistBuddy -c "Set :CFBundleShortVersionString $GHOSTTY_COMMIT" "macos/build/Release/Ghostty.app/Contents/Info.plist"
|
|
|
|
# Updater
|
|
/usr/libexec/PlistBuddy -c "Set :SUPublicEDKey $SPARKLE_KEY_PUB" "macos/build/Release/Ghostty.app/Contents/Info.plist"
|
|
/usr/libexec/PlistBuddy -c "Delete :SUEnableAutomaticChecks" "macos/build/Release/Ghostty.app/Contents/Info.plist"
|
|
|
|
- name: Codesign app bundle
|
|
env:
|
|
MACOS_CERTIFICATE: ${{ secrets.PROD_MACOS_CERTIFICATE }}
|
|
MACOS_CERTIFICATE_PWD: ${{ secrets.PROD_MACOS_CERTIFICATE_PWD }}
|
|
MACOS_CERTIFICATE_NAME: ${{ secrets.PROD_MACOS_CERTIFICATE_NAME }}
|
|
MACOS_CI_KEYCHAIN_PWD: ${{ secrets.PROD_MACOS_CI_KEYCHAIN_PWD }}
|
|
run: |
|
|
# Turn our base64-encoded certificate back to a regular .p12 file
|
|
echo $MACOS_CERTIFICATE | base64 --decode > certificate.p12
|
|
|
|
# We need to create a new keychain, otherwise using the certificate will prompt
|
|
# with a UI dialog asking for the certificate password, which we can't
|
|
# use in a headless CI environment
|
|
security create-keychain -p "$MACOS_CI_KEYCHAIN_PWD" build.keychain
|
|
security default-keychain -s build.keychain
|
|
security unlock-keychain -p "$MACOS_CI_KEYCHAIN_PWD" build.keychain
|
|
security import certificate.p12 -k build.keychain -P "$MACOS_CERTIFICATE_PWD" -T /usr/bin/codesign
|
|
security set-key-partition-list -S apple-tool:,apple:,codesign: -s -k "$MACOS_CI_KEYCHAIN_PWD" build.keychain
|
|
|
|
# Codesign Sparkle. Some notes here:
|
|
# - The XPC services aren't used since we don't sandbox Ghostty,
|
|
# but since they're part of the build, they still need to be
|
|
# codesigned.
|
|
# - The binaries in the "Versions" folders need to NOT be symlinks.
|
|
/usr/bin/codesign --verbose -f -s "$MACOS_CERTIFICATE_NAME" -o runtime "macos/build/Release/Ghostty.app/Contents/Frameworks/Sparkle.framework/Versions/B/XPCServices/Downloader.xpc"
|
|
/usr/bin/codesign --verbose -f -s "$MACOS_CERTIFICATE_NAME" -o runtime "macos/build/Release/Ghostty.app/Contents/Frameworks/Sparkle.framework/Versions/B/XPCServices/Installer.xpc"
|
|
/usr/bin/codesign --verbose -f -s "$MACOS_CERTIFICATE_NAME" -o runtime "macos/build/Release/Ghostty.app/Contents/Frameworks/Sparkle.framework/Versions/B/Autoupdate"
|
|
/usr/bin/codesign --verbose -f -s "$MACOS_CERTIFICATE_NAME" -o runtime "macos/build/Release/Ghostty.app/Contents/Frameworks/Sparkle.framework/Versions/B/Updater.app"
|
|
/usr/bin/codesign --verbose -f -s "$MACOS_CERTIFICATE_NAME" -o runtime "macos/build/Release/Ghostty.app/Contents/Frameworks/Sparkle.framework"
|
|
/usr/bin/codesign --verbose -f -s "$MACOS_CERTIFICATE_NAME" -o runtime "macos/build/Release/Ghostty.app/Contents/PlugIns/DockTilePlugin.plugin"
|
|
|
|
# Codesign the app bundle
|
|
/usr/bin/codesign --verbose -f -s "$MACOS_CERTIFICATE_NAME" -o runtime --entitlements "macos/Ghostty.entitlements" macos/build/Release/Ghostty.app
|
|
|
|
- name: Create DMG
|
|
env:
|
|
MACOS_CERTIFICATE_NAME: ${{ secrets.PROD_MACOS_CERTIFICATE_NAME }}
|
|
run: |
|
|
npm install --global create-dmg
|
|
create-dmg \
|
|
--identity="$MACOS_CERTIFICATE_NAME" \
|
|
./macos/build/Release/Ghostty.app \
|
|
./
|
|
mv ./Ghostty*.dmg ./Ghostty.dmg
|
|
|
|
- name: "Notarize DMG"
|
|
env:
|
|
APPLE_NOTARIZATION_ISSUER: ${{ secrets.APPLE_NOTARIZATION_ISSUER }}
|
|
APPLE_NOTARIZATION_KEY_ID: ${{ secrets.APPLE_NOTARIZATION_KEY_ID }}
|
|
APPLE_NOTARIZATION_KEY: ${{ secrets.APPLE_NOTARIZATION_KEY }}
|
|
run: |
|
|
# Store the notarization credentials so that we can prevent a UI password dialog
|
|
# from blocking the CI
|
|
echo "Create keychain profile"
|
|
echo "$APPLE_NOTARIZATION_KEY" > notarization_key.p8
|
|
xcrun notarytool store-credentials "notarytool-profile" --key notarization_key.p8 --key-id "$APPLE_NOTARIZATION_KEY_ID" --issuer "$APPLE_NOTARIZATION_ISSUER"
|
|
rm notarization_key.p8
|
|
|
|
# Here we send the notarization request to the Apple's Notarization service, waiting for the result.
|
|
# This typically takes a few seconds inside a CI environment, but it might take more depending on the App
|
|
# characteristics. Visit the Notarization docs for more information and strategies on how to optimize it if
|
|
# you're curious
|
|
echo "Notarize dmg"
|
|
xcrun notarytool submit "Ghostty.dmg" --keychain-profile "notarytool-profile" --wait
|
|
|
|
# Finally, we need to "attach the staple" to our executable, which will allow our app to be
|
|
# validated by macOS even when an internet connection is not available. We do this to
|
|
# both the app and the dmg
|
|
echo "Attach staple"
|
|
xcrun stapler staple "Ghostty.dmg"
|
|
xcrun stapler staple "macos/build/Release/Ghostty.app"
|
|
|
|
# Zip up the app and symbols
|
|
- name: Zip App
|
|
run: |
|
|
cd macos/build/Release
|
|
zip -9 -r --symlinks ../../../ghostty-macos-universal.zip Ghostty.app
|
|
zip -9 -r --symlinks ../../../ghostty-macos-universal-dsym.zip Ghostty.app.dSYM/
|
|
|
|
# Update Release
|
|
- name: Release
|
|
uses: softprops/action-gh-release@3d0d9888cb7fd7b750713d6e236d1fcb99157228 # v3.0.2
|
|
with:
|
|
name: 'Ghostty Tip ("Nightly")'
|
|
prerelease: true
|
|
tag_name: tip
|
|
target_commitish: ${{ github.sha }}
|
|
files: |
|
|
ghostty-macos-universal.zip
|
|
Ghostty.dmg
|
|
token: ${{ secrets.GH_RELEASE_TOKEN }}
|
|
|
|
# Create our appcast for Sparkle
|
|
- name: Generate Appcast
|
|
if: |
|
|
github.repository_owner == 'ghostty-org' &&
|
|
github.ref_name == 'main'
|
|
env:
|
|
SPARKLE_KEY: ${{ secrets.PROD_MACOS_SPARKLE_KEY }}
|
|
run: |
|
|
echo $SPARKLE_KEY > signing.key
|
|
sign_update -f signing.key Ghostty.dmg > sign_update.txt
|
|
curl -L https://tip.files.ghostty.org/appcast.xml > appcast.xml
|
|
python3 ./dist/macos/update_appcast_tip.py
|
|
test -f appcast_new.xml
|
|
|
|
# Upload our binaries first
|
|
- name: Prep R2 Storage
|
|
run: |
|
|
mkdir blob
|
|
mkdir -p blob/${GHOSTTY_COMMIT_LONG}
|
|
cp ghostty-macos-universal.zip blob/${GHOSTTY_COMMIT_LONG}/ghostty-macos-universal.zip
|
|
cp ghostty-macos-universal-dsym.zip blob/${GHOSTTY_COMMIT_LONG}/ghostty-macos-universal-dsym.zip
|
|
cp Ghostty.dmg blob/${GHOSTTY_COMMIT_LONG}/Ghostty.dmg
|
|
|
|
- name: Upload to R2
|
|
uses: ryand56/r2-upload-action@b801a390acbdeb034c5e684ff5e1361c06639e7c # v1.4
|
|
with:
|
|
r2-account-id: ${{ secrets.CF_R2_TIP_ACCOUNT_ID }}
|
|
r2-access-key-id: ${{ secrets.CF_R2_TIP_AWS_KEY }}
|
|
r2-secret-access-key: ${{ secrets.CF_R2_TIP_SECRET_KEY }}
|
|
r2-bucket: ghostty-tip
|
|
source-dir: blob
|
|
destination-dir: ./
|
|
|
|
# Now upload our appcast. This ensures that the appcast never
|
|
# gets out of sync with the binaries.
|
|
- name: Prep R2 Storage for Appcast
|
|
if: |
|
|
github.repository_owner == 'ghostty-org' &&
|
|
github.ref_name == 'main'
|
|
run: |
|
|
rm -r blob
|
|
mkdir blob
|
|
cp appcast_new.xml blob/appcast.xml
|
|
|
|
- name: Upload Appcast to R2
|
|
if: |
|
|
github.repository_owner == 'ghostty-org' &&
|
|
github.ref_name == 'main'
|
|
uses: ryand56/r2-upload-action@b801a390acbdeb034c5e684ff5e1361c06639e7c # v1.4
|
|
with:
|
|
r2-account-id: ${{ secrets.CF_R2_TIP_ACCOUNT_ID }}
|
|
r2-access-key-id: ${{ secrets.CF_R2_TIP_AWS_KEY }}
|
|
r2-secret-access-key: ${{ secrets.CF_R2_TIP_SECRET_KEY }}
|
|
r2-bucket: ghostty-tip
|
|
source-dir: blob
|
|
destination-dir: ./
|
|
|
|
- name: Show and Save Release URLs
|
|
run: |
|
|
cat << EOF | tee release-urls.txt
|
|
Release URLs:
|
|
App Bundle: https://tip.files.ghostty.org/${GHOSTTY_COMMIT_LONG}/ghostty-macos-universal.zip
|
|
Debug Symbols: https://tip.files.ghostty.org/${GHOSTTY_COMMIT_LONG}/ghostty-macos-universal-dsym.zip
|
|
DMG: https://tip.files.ghostty.org/${GHOSTTY_COMMIT_LONG}/Ghostty.dmg
|
|
EOF
|
|
|
|
- name: Upload Release URLs
|
|
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v6.0
|
|
with:
|
|
name: release-urls-${{ inputs.pr || '0' }}
|
|
path: release-urls.txt
|
|
retention-days: 2
|
|
|
|
build-macos-debug-slow:
|
|
needs: [setup]
|
|
if: |
|
|
needs.setup.outputs.should_skip != 'true' &&
|
|
(
|
|
github.event_name == 'workflow_dispatch' ||
|
|
(
|
|
github.repository_owner == 'ghostty-org' &&
|
|
github.ref_name == 'main'
|
|
)
|
|
)
|
|
|
|
runs-on: namespace-profile-ghostty-macos-tahoe
|
|
timeout-minutes: 90
|
|
env:
|
|
GHOSTTY_BUILD: ${{ needs.setup.outputs.build }}
|
|
GHOSTTY_COMMIT: ${{ needs.setup.outputs.commit }}
|
|
GHOSTTY_COMMIT_LONG: ${{ needs.setup.outputs.commit_long }}
|
|
ZIG_LOCAL_CACHE_DIR: /Users/runner/zig/local-cache
|
|
ZIG_GLOBAL_CACHE_DIR: /Users/runner/zig/global-cache
|
|
steps:
|
|
- name: Checkout code
|
|
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
|
|
with:
|
|
# Important so that build number generation works
|
|
fetch-depth: 0
|
|
|
|
- name: Setup Cache
|
|
uses: namespacelabs/nscloud-cache-action@c5f8dab7560444c4bf8dbc64f1b203431873c547 # v1.6.1
|
|
with:
|
|
cache: |
|
|
xcode
|
|
path: |
|
|
/Users/runner/zig
|
|
|
|
# TODO(tahoe): https://github.com/NixOS/nix/issues/13342
|
|
- uses: DeterminateSystems/nix-installer-action@main
|
|
with:
|
|
determinate: true
|
|
- uses: cachix/cachix-action@5f2d7c5294214f71b873db4b969586b980625e71 # v17
|
|
with:
|
|
name: ghostty
|
|
authToken: "${{ secrets.CACHIX_AUTH_TOKEN }}"
|
|
|
|
- name: XCode Select
|
|
run: sudo xcode-select -s /Applications/Xcode_26.6.app
|
|
|
|
- name: Xcode Version
|
|
run: xcodebuild -version
|
|
|
|
# Setup Sparkle
|
|
- name: Setup Sparkle
|
|
env:
|
|
SPARKLE_VERSION: 2.9.0
|
|
run: |
|
|
mkdir -p .action/sparkle
|
|
cd .action/sparkle
|
|
curl -L https://github.com/sparkle-project/Sparkle/releases/download/${SPARKLE_VERSION}/Sparkle-for-Swift-Package-Manager.zip > sparkle.zip
|
|
unzip sparkle.zip
|
|
echo "$(pwd)/bin" >> $GITHUB_PATH
|
|
|
|
# GhosttyKit is the framework that is built from Zig for our native
|
|
# Mac app to access. Build this in release mode.
|
|
- name: Build GhosttyKit
|
|
run: nix develop -c zig build -Doptimize=Debug -Demit-macos-app=false
|
|
|
|
# The native app is built with native XCode tooling. This also does
|
|
# codesigning. IMPORTANT: this must NOT run in a Nix environment.
|
|
# Nix breaks xcodebuild so this has to be run outside.
|
|
- name: Build Ghostty.app
|
|
run: |
|
|
cd macos
|
|
xcodebuild -target Ghostty -configuration Release \
|
|
COMPILATION_CACHE_CAS_PATH=/Users/runner/Library/Developer/Xcode/DerivedData/CompilationCache.noindex \
|
|
COMPILATION_CACHE_KEEP_CAS_DIRECTORY=YES
|
|
|
|
# We inject the "build number" as simply the number of commits since HEAD.
|
|
# This will be a monotonically always increasing build number that we use.
|
|
- name: Update Info.plist
|
|
env:
|
|
SPARKLE_KEY_PUB: ${{ secrets.PROD_MACOS_SPARKLE_KEY_PUB }}
|
|
run: |
|
|
# Version Info
|
|
/usr/libexec/PlistBuddy -c "Set :GhosttyCommit $GHOSTTY_COMMIT" "macos/build/Release/Ghostty.app/Contents/Info.plist"
|
|
/usr/libexec/PlistBuddy -c "Set :CFBundleVersion $GHOSTTY_BUILD" "macos/build/Release/Ghostty.app/Contents/Info.plist"
|
|
/usr/libexec/PlistBuddy -c "Set :CFBundleShortVersionString $GHOSTTY_COMMIT" "macos/build/Release/Ghostty.app/Contents/Info.plist"
|
|
|
|
# Updater
|
|
/usr/libexec/PlistBuddy -c "Set :SUPublicEDKey $SPARKLE_KEY_PUB" "macos/build/Release/Ghostty.app/Contents/Info.plist"
|
|
/usr/libexec/PlistBuddy -c "Delete :SUEnableAutomaticChecks" "macos/build/Release/Ghostty.app/Contents/Info.plist"
|
|
|
|
- name: Codesign app bundle
|
|
env:
|
|
MACOS_CERTIFICATE: ${{ secrets.PROD_MACOS_CERTIFICATE }}
|
|
MACOS_CERTIFICATE_PWD: ${{ secrets.PROD_MACOS_CERTIFICATE_PWD }}
|
|
MACOS_CERTIFICATE_NAME: ${{ secrets.PROD_MACOS_CERTIFICATE_NAME }}
|
|
MACOS_CI_KEYCHAIN_PWD: ${{ secrets.PROD_MACOS_CI_KEYCHAIN_PWD }}
|
|
run: |
|
|
# Turn our base64-encoded certificate back to a regular .p12 file
|
|
echo $MACOS_CERTIFICATE | base64 --decode > certificate.p12
|
|
|
|
# We need to create a new keychain, otherwise using the certificate will prompt
|
|
# with a UI dialog asking for the certificate password, which we can't
|
|
# use in a headless CI environment
|
|
security create-keychain -p "$MACOS_CI_KEYCHAIN_PWD" build.keychain
|
|
security default-keychain -s build.keychain
|
|
security unlock-keychain -p "$MACOS_CI_KEYCHAIN_PWD" build.keychain
|
|
security import certificate.p12 -k build.keychain -P "$MACOS_CERTIFICATE_PWD" -T /usr/bin/codesign
|
|
security set-key-partition-list -S apple-tool:,apple:,codesign: -s -k "$MACOS_CI_KEYCHAIN_PWD" build.keychain
|
|
|
|
# Codesign Sparkle. Some notes here:
|
|
# - The XPC services aren't used since we don't sandbox Ghostty,
|
|
# but since they're part of the build, they still need to be
|
|
# codesigned.
|
|
# - The binaries in the "Versions" folders need to NOT be symlinks.
|
|
/usr/bin/codesign --verbose -f -s "$MACOS_CERTIFICATE_NAME" -o runtime "macos/build/Release/Ghostty.app/Contents/Frameworks/Sparkle.framework/Versions/B/XPCServices/Downloader.xpc"
|
|
/usr/bin/codesign --verbose -f -s "$MACOS_CERTIFICATE_NAME" -o runtime "macos/build/Release/Ghostty.app/Contents/Frameworks/Sparkle.framework/Versions/B/XPCServices/Installer.xpc"
|
|
/usr/bin/codesign --verbose -f -s "$MACOS_CERTIFICATE_NAME" -o runtime "macos/build/Release/Ghostty.app/Contents/Frameworks/Sparkle.framework/Versions/B/Autoupdate"
|
|
/usr/bin/codesign --verbose -f -s "$MACOS_CERTIFICATE_NAME" -o runtime "macos/build/Release/Ghostty.app/Contents/Frameworks/Sparkle.framework/Versions/B/Updater.app"
|
|
/usr/bin/codesign --verbose -f -s "$MACOS_CERTIFICATE_NAME" -o runtime "macos/build/Release/Ghostty.app/Contents/Frameworks/Sparkle.framework"
|
|
/usr/bin/codesign --verbose -f -s "$MACOS_CERTIFICATE_NAME" -o runtime "macos/build/Release/Ghostty.app/Contents/PlugIns/DockTilePlugin.plugin"
|
|
|
|
# Codesign the app bundle
|
|
/usr/bin/codesign --verbose -f -s "$MACOS_CERTIFICATE_NAME" -o runtime --entitlements "macos/Ghostty.entitlements" macos/build/Release/Ghostty.app
|
|
|
|
- name: "Notarize app bundle"
|
|
env:
|
|
APPLE_NOTARIZATION_ISSUER: ${{ secrets.APPLE_NOTARIZATION_ISSUER }}
|
|
APPLE_NOTARIZATION_KEY_ID: ${{ secrets.APPLE_NOTARIZATION_KEY_ID }}
|
|
APPLE_NOTARIZATION_KEY: ${{ secrets.APPLE_NOTARIZATION_KEY }}
|
|
run: |
|
|
# Store the notarization credentials so that we can prevent a UI password dialog
|
|
# from blocking the CI
|
|
echo "Create keychain profile"
|
|
echo "$APPLE_NOTARIZATION_KEY" > notarization_key.p8
|
|
xcrun notarytool store-credentials "notarytool-profile" --key notarization_key.p8 --key-id "$APPLE_NOTARIZATION_KEY_ID" --issuer "$APPLE_NOTARIZATION_ISSUER"
|
|
rm notarization_key.p8
|
|
|
|
# We can't notarize an app bundle directly, but we need to compress it as an archive.
|
|
# Therefore, we create a zip file containing our app bundle, so that we can send it to the
|
|
# notarization service
|
|
echo "Creating temp notarization archive"
|
|
ditto -c -k --keepParent "macos/build/Release/Ghostty.app" "notarization.zip"
|
|
|
|
# Here we send the notarization request to the Apple's Notarization service, waiting for the result.
|
|
# This typically takes a few seconds inside a CI environment, but it might take more depending on the App
|
|
# characteristics. Visit the Notarization docs for more information and strategies on how to optimize it if
|
|
# you're curious
|
|
echo "Notarize app"
|
|
xcrun notarytool submit "notarization.zip" --keychain-profile "notarytool-profile" --wait
|
|
|
|
# Finally, we need to "attach the staple" to our executable, which will allow our app to be
|
|
# validated by macOS even when an internet connection is not available.
|
|
echo "Attach staple"
|
|
xcrun stapler staple "macos/build/Release/Ghostty.app"
|
|
|
|
# Zip up the app
|
|
- name: Zip App
|
|
run: |
|
|
cd macos/build/Release
|
|
zip -9 -r --symlinks ../../../ghostty-macos-universal-debug-slow.zip Ghostty.app
|
|
zip -9 -r --symlinks ../../../ghostty-macos-universal-debug-slow-dsym.zip Ghostty.app.dSYM/
|
|
|
|
# Update Release
|
|
- name: Release
|
|
uses: softprops/action-gh-release@3d0d9888cb7fd7b750713d6e236d1fcb99157228 # v3.0.2
|
|
with:
|
|
name: 'Ghostty Tip ("Nightly")'
|
|
prerelease: true
|
|
tag_name: tip
|
|
target_commitish: ${{ github.sha }}
|
|
files: ghostty-macos-universal-debug-slow.zip
|
|
token: ${{ secrets.GH_RELEASE_TOKEN }}
|
|
|
|
# Update Blob Storage
|
|
- name: Prep R2 Storage
|
|
run: |
|
|
mkdir blob
|
|
mkdir -p blob/${GHOSTTY_COMMIT_LONG}
|
|
cp ghostty-macos-universal-debug-slow.zip blob/${GHOSTTY_COMMIT_LONG}/ghostty-macos-universal-debug-slow.zip
|
|
cp ghostty-macos-universal-debug-slow-dsym.zip blob/${GHOSTTY_COMMIT_LONG}/ghostty-macos-universal-debug-slow-dsym.zip
|
|
- name: Upload to R2
|
|
uses: ryand56/r2-upload-action@b801a390acbdeb034c5e684ff5e1361c06639e7c # v1.4
|
|
with:
|
|
r2-account-id: ${{ secrets.CF_R2_TIP_ACCOUNT_ID }}
|
|
r2-access-key-id: ${{ secrets.CF_R2_TIP_AWS_KEY }}
|
|
r2-secret-access-key: ${{ secrets.CF_R2_TIP_SECRET_KEY }}
|
|
r2-bucket: ghostty-tip
|
|
source-dir: blob
|
|
destination-dir: ./
|
|
|
|
- name: Echo Release URLs
|
|
run: |
|
|
echo "Release URLs:"
|
|
echo " App Bundle: https://tip.files.ghostty.org/${GHOSTTY_COMMIT_LONG}/ghostty-macos-universal-debug-slow.zip"
|
|
echo " Debug Symbols: https://tip.files.ghostty.org/${GHOSTTY_COMMIT_LONG}/ghostty-macos-universal-debug-slow-dsym.zip"
|
|
|
|
build-macos-debug-fast:
|
|
needs: [setup]
|
|
if: |
|
|
needs.setup.outputs.should_skip != 'true' &&
|
|
(
|
|
github.event_name == 'workflow_dispatch' ||
|
|
(
|
|
github.repository_owner == 'ghostty-org' &&
|
|
github.ref_name == 'main'
|
|
)
|
|
)
|
|
|
|
runs-on: namespace-profile-ghostty-macos-tahoe
|
|
timeout-minutes: 90
|
|
env:
|
|
GHOSTTY_BUILD: ${{ needs.setup.outputs.build }}
|
|
GHOSTTY_COMMIT: ${{ needs.setup.outputs.commit }}
|
|
GHOSTTY_COMMIT_LONG: ${{ needs.setup.outputs.commit_long }}
|
|
ZIG_LOCAL_CACHE_DIR: /Users/runner/zig/local-cache
|
|
ZIG_GLOBAL_CACHE_DIR: /Users/runner/zig/global-cache
|
|
steps:
|
|
- name: Checkout code
|
|
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
|
|
with:
|
|
# Important so that build number generation works
|
|
fetch-depth: 0
|
|
|
|
- name: Setup Cache
|
|
uses: namespacelabs/nscloud-cache-action@c5f8dab7560444c4bf8dbc64f1b203431873c547 # v1.6.1
|
|
with:
|
|
cache: |
|
|
xcode
|
|
path: |
|
|
/Users/runner/zig
|
|
|
|
# TODO(tahoe): https://github.com/NixOS/nix/issues/13342
|
|
- uses: DeterminateSystems/nix-installer-action@main
|
|
with:
|
|
determinate: true
|
|
- uses: cachix/cachix-action@5f2d7c5294214f71b873db4b969586b980625e71 # v17
|
|
with:
|
|
name: ghostty
|
|
authToken: "${{ secrets.CACHIX_AUTH_TOKEN }}"
|
|
|
|
- name: XCode Select
|
|
run: sudo xcode-select -s /Applications/Xcode_26.6.app
|
|
|
|
- name: Xcode Version
|
|
run: xcodebuild -version
|
|
|
|
# Setup Sparkle
|
|
- name: Setup Sparkle
|
|
env:
|
|
SPARKLE_VERSION: 2.9.0
|
|
run: |
|
|
mkdir -p .action/sparkle
|
|
cd .action/sparkle
|
|
curl -L https://github.com/sparkle-project/Sparkle/releases/download/${SPARKLE_VERSION}/Sparkle-for-Swift-Package-Manager.zip > sparkle.zip
|
|
unzip sparkle.zip
|
|
echo "$(pwd)/bin" >> $GITHUB_PATH
|
|
|
|
# GhosttyKit is the framework that is built from Zig for our native
|
|
# Mac app to access. Build this in release mode.
|
|
- name: Build GhosttyKit
|
|
run: nix develop -c zig build -Doptimize=ReleaseSafe -Demit-macos-app=false
|
|
|
|
# The native app is built with native XCode tooling. This also does
|
|
# codesigning. IMPORTANT: this must NOT run in a Nix environment.
|
|
# Nix breaks xcodebuild so this has to be run outside.
|
|
- name: Build Ghostty.app
|
|
run: |
|
|
cd macos
|
|
xcodebuild -target Ghostty -configuration Release \
|
|
COMPILATION_CACHE_CAS_PATH=/Users/runner/Library/Developer/Xcode/DerivedData/CompilationCache.noindex \
|
|
COMPILATION_CACHE_KEEP_CAS_DIRECTORY=YES
|
|
|
|
# We inject the "build number" as simply the number of commits since HEAD.
|
|
# This will be a monotonically always increasing build number that we use.
|
|
- name: Update Info.plist
|
|
env:
|
|
SPARKLE_KEY_PUB: ${{ secrets.PROD_MACOS_SPARKLE_KEY_PUB }}
|
|
run: |
|
|
# Version Info
|
|
/usr/libexec/PlistBuddy -c "Set :GhosttyCommit $GHOSTTY_COMMIT" "macos/build/Release/Ghostty.app/Contents/Info.plist"
|
|
/usr/libexec/PlistBuddy -c "Set :CFBundleVersion $GHOSTTY_BUILD" "macos/build/Release/Ghostty.app/Contents/Info.plist"
|
|
/usr/libexec/PlistBuddy -c "Set :CFBundleShortVersionString $GHOSTTY_COMMIT" "macos/build/Release/Ghostty.app/Contents/Info.plist"
|
|
|
|
# Updater
|
|
/usr/libexec/PlistBuddy -c "Set :SUPublicEDKey $SPARKLE_KEY_PUB" "macos/build/Release/Ghostty.app/Contents/Info.plist"
|
|
/usr/libexec/PlistBuddy -c "Delete :SUEnableAutomaticChecks" "macos/build/Release/Ghostty.app/Contents/Info.plist"
|
|
|
|
- name: Codesign app bundle
|
|
env:
|
|
MACOS_CERTIFICATE: ${{ secrets.PROD_MACOS_CERTIFICATE }}
|
|
MACOS_CERTIFICATE_PWD: ${{ secrets.PROD_MACOS_CERTIFICATE_PWD }}
|
|
MACOS_CERTIFICATE_NAME: ${{ secrets.PROD_MACOS_CERTIFICATE_NAME }}
|
|
MACOS_CI_KEYCHAIN_PWD: ${{ secrets.PROD_MACOS_CI_KEYCHAIN_PWD }}
|
|
run: |
|
|
# Turn our base64-encoded certificate back to a regular .p12 file
|
|
echo $MACOS_CERTIFICATE | base64 --decode > certificate.p12
|
|
|
|
# We need to create a new keychain, otherwise using the certificate will prompt
|
|
# with a UI dialog asking for the certificate password, which we can't
|
|
# use in a headless CI environment
|
|
security create-keychain -p "$MACOS_CI_KEYCHAIN_PWD" build.keychain
|
|
security default-keychain -s build.keychain
|
|
security unlock-keychain -p "$MACOS_CI_KEYCHAIN_PWD" build.keychain
|
|
security import certificate.p12 -k build.keychain -P "$MACOS_CERTIFICATE_PWD" -T /usr/bin/codesign
|
|
security set-key-partition-list -S apple-tool:,apple:,codesign: -s -k "$MACOS_CI_KEYCHAIN_PWD" build.keychain
|
|
|
|
# Codesign Sparkle. Some notes here:
|
|
# - The XPC services aren't used since we don't sandbox Ghostty,
|
|
# but since they're part of the build, they still need to be
|
|
# codesigned.
|
|
# - The binaries in the "Versions" folders need to NOT be symlinks.
|
|
/usr/bin/codesign --verbose -f -s "$MACOS_CERTIFICATE_NAME" -o runtime "macos/build/Release/Ghostty.app/Contents/Frameworks/Sparkle.framework/Versions/B/XPCServices/Downloader.xpc"
|
|
/usr/bin/codesign --verbose -f -s "$MACOS_CERTIFICATE_NAME" -o runtime "macos/build/Release/Ghostty.app/Contents/Frameworks/Sparkle.framework/Versions/B/XPCServices/Installer.xpc"
|
|
/usr/bin/codesign --verbose -f -s "$MACOS_CERTIFICATE_NAME" -o runtime "macos/build/Release/Ghostty.app/Contents/Frameworks/Sparkle.framework/Versions/B/Autoupdate"
|
|
/usr/bin/codesign --verbose -f -s "$MACOS_CERTIFICATE_NAME" -o runtime "macos/build/Release/Ghostty.app/Contents/Frameworks/Sparkle.framework/Versions/B/Updater.app"
|
|
/usr/bin/codesign --verbose -f -s "$MACOS_CERTIFICATE_NAME" -o runtime "macos/build/Release/Ghostty.app/Contents/Frameworks/Sparkle.framework"
|
|
/usr/bin/codesign --verbose -f -s "$MACOS_CERTIFICATE_NAME" -o runtime "macos/build/Release/Ghostty.app/Contents/PlugIns/DockTilePlugin.plugin"
|
|
|
|
# Codesign the app bundle
|
|
/usr/bin/codesign --verbose -f -s "$MACOS_CERTIFICATE_NAME" -o runtime --entitlements "macos/Ghostty.entitlements" macos/build/Release/Ghostty.app
|
|
|
|
- name: "Notarize app bundle"
|
|
env:
|
|
APPLE_NOTARIZATION_ISSUER: ${{ secrets.APPLE_NOTARIZATION_ISSUER }}
|
|
APPLE_NOTARIZATION_KEY_ID: ${{ secrets.APPLE_NOTARIZATION_KEY_ID }}
|
|
APPLE_NOTARIZATION_KEY: ${{ secrets.APPLE_NOTARIZATION_KEY }}
|
|
run: |
|
|
# Store the notarization credentials so that we can prevent a UI password dialog
|
|
# from blocking the CI
|
|
echo "Create keychain profile"
|
|
echo "$APPLE_NOTARIZATION_KEY" > notarization_key.p8
|
|
xcrun notarytool store-credentials "notarytool-profile" --key notarization_key.p8 --key-id "$APPLE_NOTARIZATION_KEY_ID" --issuer "$APPLE_NOTARIZATION_ISSUER"
|
|
rm notarization_key.p8
|
|
|
|
# We can't notarize an app bundle directly, but we need to compress it as an archive.
|
|
# Therefore, we create a zip file containing our app bundle, so that we can send it to the
|
|
# notarization service
|
|
echo "Creating temp notarization archive"
|
|
ditto -c -k --keepParent "macos/build/Release/Ghostty.app" "notarization.zip"
|
|
|
|
# Here we send the notarization request to the Apple's Notarization service, waiting for the result.
|
|
# This typically takes a few seconds inside a CI environment, but it might take more depending on the App
|
|
# characteristics. Visit the Notarization docs for more information and strategies on how to optimize it if
|
|
# you're curious
|
|
echo "Notarize app"
|
|
xcrun notarytool submit "notarization.zip" --keychain-profile "notarytool-profile" --wait
|
|
|
|
# Finally, we need to "attach the staple" to our executable, which will allow our app to be
|
|
# validated by macOS even when an internet connection is not available.
|
|
echo "Attach staple"
|
|
xcrun stapler staple "macos/build/Release/Ghostty.app"
|
|
|
|
# Zip up the app
|
|
- name: Zip App
|
|
run: |
|
|
cd macos/build/Release
|
|
zip -9 -r --symlinks ../../../ghostty-macos-universal-debug-fast.zip Ghostty.app
|
|
zip -9 -r --symlinks ../../../ghostty-macos-universal-debug-fast-dsym.zip Ghostty.app.dSYM/
|
|
|
|
# Update Release
|
|
- name: Release
|
|
uses: softprops/action-gh-release@3d0d9888cb7fd7b750713d6e236d1fcb99157228 # v3.0.2
|
|
with:
|
|
name: 'Ghostty Tip ("Nightly")'
|
|
prerelease: true
|
|
tag_name: tip
|
|
target_commitish: ${{ github.sha }}
|
|
files: ghostty-macos-universal-debug-fast.zip
|
|
token: ${{ secrets.GH_RELEASE_TOKEN }}
|
|
|
|
# Update Blob Storage
|
|
- name: Prep R2 Storage
|
|
run: |
|
|
mkdir blob
|
|
mkdir -p blob/${GHOSTTY_COMMIT_LONG}
|
|
cp ghostty-macos-universal-debug-fast.zip blob/${GHOSTTY_COMMIT_LONG}/ghostty-macos-universal-debug-fast.zip
|
|
cp ghostty-macos-universal-debug-fast-dsym.zip blob/${GHOSTTY_COMMIT_LONG}/ghostty-macos-universal-debug-fast-dsym.zip
|
|
- name: Upload to R2
|
|
uses: ryand56/r2-upload-action@b801a390acbdeb034c5e684ff5e1361c06639e7c # v1.4
|
|
with:
|
|
r2-account-id: ${{ secrets.CF_R2_TIP_ACCOUNT_ID }}
|
|
r2-access-key-id: ${{ secrets.CF_R2_TIP_AWS_KEY }}
|
|
r2-secret-access-key: ${{ secrets.CF_R2_TIP_SECRET_KEY }}
|
|
r2-bucket: ghostty-tip
|
|
source-dir: blob
|
|
destination-dir: ./
|
|
|
|
- name: Echo Release URLs
|
|
run: |
|
|
echo "Release URLs:"
|
|
echo " App Bundle: https://tip.files.ghostty.org/${GHOSTTY_COMMIT_LONG}/ghostty-macos-universal-debug-fast.zip"
|
|
echo " Debug Symbols: https://tip.files.ghostty.org/${GHOSTTY_COMMIT_LONG}/ghostty-macos-universal-debug-fast-dsym.zip"
|