ci: build unsigned device IPA payload on macos-26 #1
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Build unsigned IPA payload | |
| # WHY UNSIGNED: this repo is PUBLIC. Uploading the signing .p12 as a repo secret | |
| # would put the private key one misconfigured workflow away from exposure. The | |
| # runner therefore only ever COMPILES; signing happens on Sina's mac mini with | |
| # zsign, where the key already lives. Xcode is only needed for the compile step, | |
| # which is exactly the half the runner provides for free. | |
| on: | |
| workflow_dispatch: | |
| push: | |
| branches: | |
| - 'ci/**' | |
| jobs: | |
| build: | |
| # macos-26 arm64 ships Xcode 26.x. project.yml pins deploymentTarget iOS 26.0, | |
| # so an older image (macos-15) cannot build this at all. | |
| runs-on: macos-26 | |
| timeout-minutes: 40 | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Show toolchain | |
| run: | | |
| sw_vers | |
| xcodebuild -version | |
| xcrun --sdk iphoneos --show-sdk-version | |
| # HermesShare.xcodeproj is NOT tracked in git — project.yml is the source | |
| # of truth, so the project has to be generated before anything can build. | |
| - name: Install XcodeGen | |
| run: brew install xcodegen | |
| - name: Generate Xcode project | |
| run: | | |
| xcodegen generate | |
| test -f HermesShare.xcodeproj/project.pbxproj | |
| - name: Build unsigned (device slice) | |
| run: | | |
| set -o pipefail | |
| xcodebuild \ | |
| -project HermesShare.xcodeproj \ | |
| -scheme HermesShare \ | |
| -configuration Release \ | |
| -sdk iphoneos \ | |
| -destination 'generic/platform=iOS' \ | |
| -derivedDataPath build \ | |
| CODE_SIGN_IDENTITY="" \ | |
| CODE_SIGNING_REQUIRED=NO \ | |
| CODE_SIGNING_ALLOWED=NO \ | |
| CODE_SIGN_ENTITLEMENTS="" \ | |
| ENABLE_BITCODE=NO \ | |
| build 2>&1 | tail -60 | |
| # Verify the embedded bundles actually made it in. A HermesShare.app with | |
| # no MessagesExtension is a silently useless build: the iMessage card | |
| # renderer IS the extension, so the app would install and do nothing. | |
| - name: Verify app bundle contents | |
| run: | | |
| APP="build/Build/Products/Release-iphoneos/HermesShare.app" | |
| test -d "$APP" || { echo "NO APP BUILT"; exit 1; } | |
| echo "--- PlugIns ---" | |
| ls -1 "$APP/PlugIns" 2>/dev/null || echo "(none)" | |
| test -d "$APP/PlugIns/HermesShareExtension.appex" \ | |
| || { echo "FAIL: MessagesExtension missing"; exit 1; } | |
| test -d "$APP/PlugIns/HermesAgentWidget.appex" \ | |
| || echo "WARN: widget extension missing" | |
| echo "--- build stamp shipped in this binary ---" | |
| strings "$APP/HermesShare" 2>/dev/null | grep -oE '20[0-9]{2}-[0-9]{2}-[0-9]{2}\.[0-9]+ [a-z-]+' | head -3 | |
| - name: Package Payload | |
| run: | | |
| cd build/Build/Products/Release-iphoneos | |
| mkdir -p Payload | |
| cp -R HermesShare.app Payload/ | |
| zip -qry "$GITHUB_WORKSPACE/HermesShare-unsigned.zip" Payload | |
| cd "$GITHUB_WORKSPACE" | |
| ls -lh HermesShare-unsigned.zip | |
| - uses: actions/upload-artifact@v4 | |
| with: | |
| name: HermesShare-unsigned | |
| path: HermesShare-unsigned.zip | |
| retention-days: 7 | |
| if-no-files-found: error |