wangjia
48e282dd97
- compile-macos.sh：flutter build 后 codesign（hardened runtime + timestamp + Release.entitlements）→ notarytool 公证（复用 App Store Connect API key） → stapler staple → 重新打包，产出已签名+公证+stapled 的 .app - 强制策略：缺 MACOS_DEVELOPER_ID_CERT_P12_BASE64 / APPSTORE_API_KEY_P8_BASE64 时在 flutter build 前 fail-fast，绝不产出未签名包 - deploy-client.yml：build-macos 步骤注入证书与 API key secrets - 新增 docs/macos-signing.md：Developer ID Application 证书创建与 secret 配置 Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
199 lines
6.1 KiB
YAML
199 lines
6.1 KiB
YAML
name: Deploy Client
|
|
|
|
on:
|
|
push:
|
|
tags:
|
|
- 'client-v[0-9]*.[0-9]*.[0-9]*'
|
|
|
|
concurrency:
|
|
group: deploy-client
|
|
cancel-in-progress: false
|
|
|
|
jobs:
|
|
build-client-web:
|
|
runs-on: mac
|
|
env:
|
|
GOPROXY: https://goproxy.cn,direct
|
|
PUB_HOSTED_URL: https://pub.flutter-io.cn
|
|
FLUTTER_STORAGE_BASE_URL: https://storage.flutter-io.cn
|
|
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
|
|
- name: Provision (idempotent — auto-runs if host not initialized)
|
|
run: sh scripts/ci/provision-mac.sh
|
|
|
|
- name: Compile (Flutter Web)
|
|
run: sh scripts/ci/compile-client-web.sh "${{ gitea.ref_name }}"
|
|
|
|
- name: Upload web artifacts
|
|
uses: actions/upload-artifact@v3
|
|
with:
|
|
name: client-web
|
|
path: dist/
|
|
|
|
build-macos:
|
|
needs: build-client-web
|
|
runs-on: mac
|
|
env:
|
|
PUB_HOSTED_URL: https://pub.flutter-io.cn
|
|
FLUTTER_STORAGE_BASE_URL: https://storage.flutter-io.cn
|
|
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
|
|
- name: Provision (idempotent — auto-runs if host not initialized)
|
|
run: sh scripts/ci/provision-mac.sh
|
|
|
|
- name: Compile (Flutter macOS)
|
|
env:
|
|
MACOS_DEVELOPER_ID_CERT_P12_BASE64: ${{ secrets.MACOS_DEVELOPER_ID_CERT_P12_BASE64 }}
|
|
MACOS_DEVELOPER_ID_CERT_PASSWORD: ${{ secrets.MACOS_DEVELOPER_ID_CERT_PASSWORD }}
|
|
APPSTORE_API_KEY_ID: ${{ secrets.APPSTORE_API_KEY_ID }}
|
|
APPSTORE_API_ISSUER_ID: ${{ secrets.APPSTORE_API_ISSUER_ID }}
|
|
APPSTORE_API_KEY_P8_BASE64: ${{ secrets.APPSTORE_API_KEY_P8_BASE64 }}
|
|
run: sh scripts/ci/compile-macos.sh "${{ gitea.ref_name }}"
|
|
|
|
- name: Upload macos artifacts
|
|
uses: actions/upload-artifact@v3
|
|
with:
|
|
name: macos
|
|
path: dist/
|
|
|
|
build-android:
|
|
needs: build-macos
|
|
runs-on: mac
|
|
env:
|
|
PUB_HOSTED_URL: https://pub.flutter-io.cn
|
|
FLUTTER_STORAGE_BASE_URL: https://storage.flutter-io.cn
|
|
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
|
|
- name: Provision (idempotent — auto-runs if host not initialized)
|
|
run: sh scripts/ci/provision-mac.sh
|
|
|
|
- name: Compile (Flutter Android APK)
|
|
env:
|
|
ANDROID_KEYSTORE_BASE64: ${{ secrets.ANDROID_KEYSTORE_BASE64 }}
|
|
ANDROID_KEYSTORE_PASSWORD: ${{ secrets.ANDROID_KEYSTORE_PASSWORD }}
|
|
ANDROID_KEY_ALIAS: ${{ secrets.ANDROID_KEY_ALIAS }}
|
|
ANDROID_KEY_PASSWORD: ${{ secrets.ANDROID_KEY_PASSWORD }}
|
|
run: sh scripts/ci/compile-android.sh "${{ gitea.ref_name }}"
|
|
|
|
- name: Upload android artifacts
|
|
uses: actions/upload-artifact@v3
|
|
with:
|
|
name: android
|
|
path: dist/
|
|
|
|
build-ios:
|
|
needs: build-android
|
|
runs-on: mac
|
|
env:
|
|
PUB_HOSTED_URL: https://pub.flutter-io.cn
|
|
FLUTTER_STORAGE_BASE_URL: https://storage.flutter-io.cn
|
|
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
|
|
- name: Provision (idempotent — auto-runs if host not initialized)
|
|
run: sh scripts/ci/provision-mac.sh
|
|
|
|
- name: Compile & upload to TestFlight (Flutter iOS)
|
|
env:
|
|
IOS_DIST_CERT_P12_BASE64: ${{ secrets.IOS_DIST_CERT_P12_BASE64 }}
|
|
IOS_DIST_CERT_PASSWORD: ${{ secrets.IOS_DIST_CERT_PASSWORD }}
|
|
IOS_PROVISIONING_PROFILE_BASE64: ${{ secrets.IOS_PROVISIONING_PROFILE_BASE64 }}
|
|
IOS_TEAM_ID: ${{ secrets.IOS_TEAM_ID }}
|
|
APPSTORE_API_KEY_ID: ${{ secrets.APPSTORE_API_KEY_ID }}
|
|
APPSTORE_API_ISSUER_ID: ${{ secrets.APPSTORE_API_ISSUER_ID }}
|
|
APPSTORE_API_KEY_P8_BASE64: ${{ secrets.APPSTORE_API_KEY_P8_BASE64 }}
|
|
run: sh scripts/ci/compile-ios.sh "${{ gitea.ref_name }}"
|
|
|
|
build-windows:
|
|
runs-on: windows
|
|
env:
|
|
GOPROXY: https://goproxy.cn,direct
|
|
PUB_HOSTED_URL: https://pub.flutter-io.cn
|
|
FLUTTER_STORAGE_BASE_URL: https://storage.flutter-io.cn
|
|
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
|
|
- name: Provision (idempotent — auto-runs if host not initialized)
|
|
shell: bash
|
|
run: sh scripts/ci/provision-windows.sh
|
|
|
|
- name: Compile (Flutter Windows)
|
|
shell: bash
|
|
run: sh scripts/ci/compile-windows.sh "${{ gitea.ref_name }}"
|
|
|
|
- name: Upload windows artifacts
|
|
uses: actions/upload-artifact@v3
|
|
with:
|
|
name: windows
|
|
path: dist/
|
|
|
|
release-deploy-client:
|
|
needs: [build-client-web, build-macos, build-android, build-ios, build-windows]
|
|
runs-on: mac
|
|
env:
|
|
GOPROXY: https://goproxy.cn,direct
|
|
PUB_HOSTED_URL: https://pub.flutter-io.cn
|
|
FLUTTER_STORAGE_BASE_URL: https://storage.flutter-io.cn
|
|
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
|
|
- name: Download web artifacts
|
|
uses: actions/download-artifact@v3
|
|
with:
|
|
name: client-web
|
|
path: dist/
|
|
|
|
- name: Download macos artifacts
|
|
uses: actions/download-artifact@v3
|
|
with:
|
|
name: macos
|
|
path: dist/
|
|
|
|
- name: Download android artifacts
|
|
uses: actions/download-artifact@v3
|
|
with:
|
|
name: android
|
|
path: dist/
|
|
|
|
- name: Download windows artifacts
|
|
uses: actions/download-artifact@v3
|
|
with:
|
|
name: windows
|
|
path: dist/
|
|
|
|
- name: Test (flutter analyze)
|
|
run: sh scripts/ci/test.sh client
|
|
|
|
- name: Release
|
|
env:
|
|
FORGEJO_TOKEN: ${{ secrets.FORGEJO_TOKEN }}
|
|
FORGEJO_URL: ${{ secrets.FORGEJO_URL }}
|
|
GITEA_REPOSITORY: ${{ gitea.repository }}
|
|
run: sh scripts/ci/release-client.sh "${{ gitea.ref_name }}"
|
|
|
|
- name: Deploy
|
|
env:
|
|
FORGEJO_TOKEN: ${{ secrets.FORGEJO_TOKEN }}
|
|
FORGEJO_URL: ${{ secrets.FORGEJO_URL }}
|
|
GITEA_REPOSITORY: ${{ gitea.repository }}
|
|
EC2_SSH_KEY: ${{ secrets.EC2_SSH_KEY }}
|
|
EC2_HOST: ${{ secrets.EC2_HOST }}
|
|
EC2_USER: ${{ secrets.EC2_USER }}
|
|
run: sh scripts/ci/deploy-client.sh "${{ gitea.ref_name }}"
|
|
|
|
- name: Notify
|
|
if: always()
|
|
env:
|
|
TELEGRAM_TOKEN: ${{ secrets.TELEGRAM_TOKEN }}
|
|
TELEGRAM_CHAT_ID: ${{ secrets.TELEGRAM_CHAT_ID }}
|
|
run: sh scripts/ci/notify.sh "${{ gitea.ref_name }}" "${{ job.status }}"
|