Skip to content

ci: build unsigned device IPA payload on macos-26 #1

ci: build unsigned device IPA payload on macos-26

ci: build unsigned device IPA payload on macos-26 #1

name: Build unsigned IPA payload
# WHY UNSIGNED: this repo is PUBLIC. Uploading the signing .p12 as a repo secret
# would put the private key one misconfigured workflow away from exposure. The
# runner therefore only ever COMPILES; signing happens on Sina's mac mini with
# zsign, where the key already lives. Xcode is only needed for the compile step,
# which is exactly the half the runner provides for free.
on:
workflow_dispatch:
push:
branches:
- 'ci/**'
jobs:
build:
# macos-26 arm64 ships Xcode 26.x. project.yml pins deploymentTarget iOS 26.0,
# so an older image (macos-15) cannot build this at all.
runs-on: macos-26
timeout-minutes: 40
steps:
- uses: actions/checkout@v4
- name: Show toolchain
run: |
sw_vers
xcodebuild -version
xcrun --sdk iphoneos --show-sdk-version
# HermesShare.xcodeproj is NOT tracked in git — project.yml is the source
# of truth, so the project has to be generated before anything can build.
- name: Install XcodeGen
run: brew install xcodegen
- name: Generate Xcode project
run: |
xcodegen generate
test -f HermesShare.xcodeproj/project.pbxproj
- name: Build unsigned (device slice)
run: |
set -o pipefail
xcodebuild \
-project HermesShare.xcodeproj \
-scheme HermesShare \
-configuration Release \
-sdk iphoneos \
-destination 'generic/platform=iOS' \
-derivedDataPath build \
CODE_SIGN_IDENTITY="" \
CODE_SIGNING_REQUIRED=NO \
CODE_SIGNING_ALLOWED=NO \
CODE_SIGN_ENTITLEMENTS="" \
ENABLE_BITCODE=NO \
build 2>&1 | tail -60
# Verify the embedded bundles actually made it in. A HermesShare.app with
# no MessagesExtension is a silently useless build: the iMessage card
# renderer IS the extension, so the app would install and do nothing.
- name: Verify app bundle contents
run: |
APP="build/Build/Products/Release-iphoneos/HermesShare.app"
test -d "$APP" || { echo "NO APP BUILT"; exit 1; }
echo "--- PlugIns ---"
ls -1 "$APP/PlugIns" 2>/dev/null || echo "(none)"
test -d "$APP/PlugIns/HermesShareExtension.appex" \
|| { echo "FAIL: MessagesExtension missing"; exit 1; }
test -d "$APP/PlugIns/HermesAgentWidget.appex" \
|| echo "WARN: widget extension missing"
echo "--- build stamp shipped in this binary ---"
strings "$APP/HermesShare" 2>/dev/null | grep -oE '20[0-9]{2}-[0-9]{2}-[0-9]{2}\.[0-9]+ [a-z-]+' | head -3
- name: Package Payload
run: |
cd build/Build/Products/Release-iphoneos
mkdir -p Payload
cp -R HermesShare.app Payload/
zip -qry "$GITHUB_WORKSPACE/HermesShare-unsigned.zip" Payload
cd "$GITHUB_WORKSPACE"
ls -lh HermesShare-unsigned.zip
- uses: actions/upload-artifact@v4
with:
name: HermesShare-unsigned
path: HermesShare-unsigned.zip
retention-days: 7
if-no-files-found: error