Release 0.6.0 #82
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Production Release (Streamlined) | |
| on: | |
| push: | |
| tags: | |
| - 'v*' | |
| workflow_dispatch: | |
| inputs: | |
| version: | |
| description: 'Release version (e.g., v1.2.3)' | |
| required: true | |
| type: string | |
| prerelease: | |
| description: 'Mark as pre-release' | |
| required: false | |
| default: false | |
| type: boolean | |
| skip_tests: | |
| description: 'Skip test validation (emergency use only)' | |
| required: false | |
| default: false | |
| type: boolean | |
| env: | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| DEVELOPER_ID_CERTIFICATE: ${{ secrets.DEVELOPER_ID_CERTIFICATE }} | |
| DEVELOPER_ID_CERTIFICATE_PASSWORD: ${{ secrets.DEVELOPER_ID_CERTIFICATE_PASSWORD }} | |
| NOTARIZATION_USERNAME: ${{ secrets.NOTARIZATION_USERNAME }} | |
| NOTARIZATION_PASSWORD: ${{ secrets.NOTARIZATION_PASSWORD }} | |
| # Base64-encoded .provisionprofile carrying the DriverKit managed capabilities. | |
| # Without it the DriverKit entitlements are signed in but inert — see | |
| # Documentation/development/entitlement-validation.md | |
| DRIVERKIT_PROVISIONING_PROFILE: ${{ secrets.DRIVERKIT_PROVISIONING_PROFILE }} | |
| jobs: | |
| release-validation: | |
| name: Release Validation | |
| runs-on: macos-latest | |
| outputs: | |
| version: ${{ steps.extract-version.outputs.version }} | |
| is-prerelease: ${{ steps.extract-version.outputs.prerelease }} | |
| release-type: ${{ steps.extract-version.outputs.release-type }} | |
| steps: | |
| - name: 🏷️ Starting Release Validation | |
| run: | | |
| echo "::notice title=Release Validation::Starting streamlined release validation and version extraction" | |
| echo "🏷️ This stage validates release triggers and extracts necessary metadata" | |
| echo "📊 Status: STARTING" | |
| - name: Checkout code | |
| uses: actions/checkout@v4 | |
| with: | |
| fetch-depth: 0 | |
| - name: 🔍 Extract Version Information | |
| id: extract-version | |
| run: | | |
| echo "::group::Version Extraction" | |
| echo "::notice title=Version Processing::Extracting and validating version information" | |
| if [ "${{ github.event_name }}" = "push" ]; then | |
| VERSION="${{ github.ref_name }}" | |
| echo "📌 Tag-triggered release: $VERSION" | |
| PRERELEASE=$(echo "$VERSION" | grep -E '-(alpha|beta|rc)' >/dev/null && echo "true" || echo "false") | |
| RELEASE_TYPE="automated" | |
| else | |
| VERSION="${{ github.event.inputs.version }}" | |
| PRERELEASE="${{ github.event.inputs.prerelease }}" | |
| RELEASE_TYPE="manual" | |
| echo "🔧 Manual release dispatch: $VERSION" | |
| fi | |
| # Validate semantic versioning | |
| if [[ ! "$VERSION" =~ ^v[0-9]+\.[0-9]+\.[0-9]+(-[a-zA-Z0-9.-]+)?$ ]]; then | |
| echo "::error title=Invalid Version::Version must follow semantic versioning (vX.Y.Z or vX.Y.Z-suffix)" | |
| exit 1 | |
| fi | |
| echo "✅ Version validated: $VERSION" | |
| echo "🏷️ Pre-release: $PRERELEASE" | |
| echo "🔧 Release type: $RELEASE_TYPE" | |
| echo "version=$VERSION" >> $GITHUB_OUTPUT | |
| echo "prerelease=$PRERELEASE" >> $GITHUB_OUTPUT | |
| echo "release-type=$RELEASE_TYPE" >> $GITHUB_OUTPUT | |
| echo "::endgroup::" | |
| - name: 📊 Release Validation Summary | |
| run: | | |
| echo "::group::Release Validation Summary" | |
| echo "::notice title=Release Validated::Release version and trigger validated successfully" | |
| echo "✅ Release trigger: ${{ github.event_name }}" | |
| echo "✅ Version: ${{ steps.extract-version.outputs.version }}" | |
| echo "✅ Pre-release: ${{ steps.extract-version.outputs.prerelease }}" | |
| echo "✅ Release type: ${{ steps.extract-version.outputs.release-type }}" | |
| echo "📊 Status: VALIDATED" | |
| echo "::endgroup::" | |
| ci-validation: | |
| name: CI Validation | |
| needs: release-validation | |
| if: ${{ !github.event.inputs.skip_tests || github.event.inputs.skip_tests == 'false' }} | |
| uses: ./.github/workflows/ci.yml | |
| with: | |
| release_validation: true | |
| test_environment: 'ci' | |
| enable_qemu_tests: false | |
| secrets: inherit | |
| build-artifacts: | |
| name: Build Release Artifacts | |
| runs-on: macos-latest | |
| needs: [release-validation, ci-validation] | |
| if: always() && needs.release-validation.result == 'success' && (needs.ci-validation.result == 'success' || github.event.inputs.skip_tests == 'true') | |
| outputs: | |
| artifact-paths: ${{ steps.build-artifacts.outputs.paths }} | |
| checksums: ${{ steps.generate-checksums.outputs.checksums }} | |
| steps: | |
| - name: 📦 Starting Artifact Building | |
| run: | | |
| echo "::notice title=Artifact Building::Starting streamlined release artifact building and packaging" | |
| echo "📦 This stage builds and packages release artifacts with code signing" | |
| echo "📊 Status: STARTING" | |
| - name: Checkout code | |
| uses: actions/checkout@v4 | |
| - name: 🔧 Setup Swift Environment | |
| uses: ./.github/actions/setup-swift-environment | |
| with: | |
| cache-key-suffix: '-release' | |
| install-swiftlint: 'false' | |
| setup-test-scripts: 'false' | |
| validate-environment: 'false' | |
| - name: 🔒 Setup Code Signing | |
| if: env.DEVELOPER_ID_CERTIFICATE != '' | |
| run: | | |
| echo "::group::Code Signing Setup" | |
| echo "::notice title=Code Signing::Setting up Apple Developer certificates for release signing" | |
| # Import Developer ID certificate | |
| echo "$DEVELOPER_ID_CERTIFICATE" | base64 --decode > certificate.p12 | |
| security create-keychain -p "" build.keychain | |
| security default-keychain -s build.keychain | |
| security unlock-keychain -p "" build.keychain | |
| security import certificate.p12 -k build.keychain -P "$DEVELOPER_ID_CERTIFICATE_PASSWORD" -T /usr/bin/codesign | |
| security set-key-partition-list -S apple-tool:,apple: -s -k "" build.keychain | |
| rm certificate.p12 | |
| echo "::notice title=Signing Ready::Code signing environment configured" | |
| echo "✅ Code signing ready" | |
| echo "::endgroup::" | |
| - name: 🏗️ Build Release Artifacts | |
| id: build-artifacts | |
| run: | | |
| echo "::group::Release Artifact Building" | |
| echo "::notice title=Artifact Building::Building optimized release artifacts" | |
| VERSION="${{ needs.release-validation.outputs.version }}" | |
| ARTIFACTS_DIR="release-artifacts" | |
| mkdir -p "$ARTIFACTS_DIR" | |
| echo "🏗️ Building release artifacts for $VERSION..." | |
| # Build optimized release binaries. | |
| # | |
| # usbipd is built for both architectures and then split, rather than shipped | |
| # as one universal binary. Releases through v0.5.1 were arm64 only, because | |
| # this ran a plain `swift build` on an Apple silicon runner, so Intel Macs got | |
| # "Bad CPU type in executable" (#32). A universal binary fixes that but doubles | |
| # the download for everyone; splitting gives each user one ~5.4 MB artifact, | |
| # slightly smaller than the arm64-only build was. | |
| swift build --configuration release --arch arm64 --arch x86_64 --product usbipd | |
| UNIVERSAL="$(swift build --configuration release --arch arm64 --arch x86_64 --product usbipd --show-bin-path 2>/dev/null)/usbipd" | |
| if [ ! -f "$UNIVERSAL" ]; then | |
| UNIVERSAL=".build/apple/Products/Release/usbipd" | |
| fi | |
| if [ ! -f "$UNIVERSAL" ]; then | |
| echo "::error title=Build Missing::No universal usbipd binary was produced" | |
| exit 1 | |
| fi | |
| echo "🔍 Universal binary: $(lipo -archs "$UNIVERSAL")" | |
| # The rest of the build stays host-architecture: only the CLI is distributed | |
| # to end users, and the system extension is inert (see the formula). | |
| swift build --configuration release | |
| echo "🏗️ Building system extension bundle..." | |
| swift build --configuration release --product USBIPDSystemExtension | |
| # Split into per-architecture artifacts. lipo -thin drops the code signature, | |
| # so each slice is signed separately further down — signing before this point | |
| # would be wasted. | |
| USBIPD_ARM64="$ARTIFACTS_DIR/usbipd-$VERSION-macos-arm64" | |
| USBIPD_X86_64="$ARTIFACTS_DIR/usbipd-$VERSION-macos-x86_64" | |
| lipo "$UNIVERSAL" -thin arm64 -output "$USBIPD_ARM64" | |
| lipo "$UNIVERSAL" -thin x86_64 -output "$USBIPD_X86_64" | |
| for slice in "$USBIPD_ARM64:arm64" "$USBIPD_X86_64:x86_64"; do | |
| path="${slice%:*}"; want="${slice##*:}" | |
| got=$(lipo -archs "$path") | |
| if [ "$got" != "$want" ]; then | |
| echo "::error title=Wrong Architecture::$path is $got, expected $want" | |
| exit 1 | |
| fi | |
| echo " $(basename "$path"): $got, $(stat -f%z "$path") bytes" | |
| done | |
| # Kept so existing references and the checksums glob still see a usbipd binary. | |
| USBIPD_PATH="$ARTIFACTS_DIR/usbipd-$VERSION-macos" | |
| cp "$USBIPD_ARM64" "$USBIPD_PATH" | |
| # Package system extension bundle | |
| echo "📦 Packaging system extension bundle..." | |
| BUNDLE_PATH=$(find .build/release -name "*.systemextension" -type d | head -1) | |
| if [ -n "$BUNDLE_PATH" ]; then | |
| echo "Found system extension bundle at: $BUNDLE_PATH" | |
| cp -R "$BUNDLE_PATH" "$ARTIFACTS_DIR/USBIPDSystemExtension.systemextension" | |
| else | |
| echo "Creating system extension bundle structure..." | |
| mkdir -p "$ARTIFACTS_DIR/USBIPDSystemExtension.systemextension/Contents/MacOS" | |
| cp .build/release/USBIPDSystemExtension "$ARTIFACTS_DIR/USBIPDSystemExtension.systemextension/Contents/MacOS/" | |
| # Create Info.plist for system extension | |
| cat > "$ARTIFACTS_DIR/USBIPDSystemExtension.systemextension/Contents/Info.plist" << EOF | |
| <?xml version="1.0" encoding="UTF-8"?> | |
| <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"> | |
| <plist version="1.0"> | |
| <dict> | |
| <key>CFBundleExecutable</key> | |
| <string>USBIPDSystemExtension</string> | |
| <key>CFBundleIdentifier</key> | |
| <string>com.github.usbipd-mac.systemextension</string> | |
| <key>CFBundleInfoDictionaryVersion</key> | |
| <string>6.0</string> | |
| <key>CFBundleName</key> | |
| <string>USBIPD System Extension</string> | |
| <key>CFBundlePackageType</key> | |
| <string>SYSX</string> | |
| <key>CFBundleShortVersionString</key> | |
| <string>$VERSION</string> | |
| <key>CFBundleVersion</key> | |
| <string>$VERSION</string> | |
| <key>NSSystemExtensionUsageDescription</key> | |
| <string>Enables USB device sharing over IP networks</string> | |
| </dict> | |
| </plist> | |
| EOF | |
| fi | |
| # Copy entitlements files for code signing | |
| echo "📋 Copying entitlements..." | |
| cp Sources/SystemExtension/SystemExtension.entitlements "$ARTIFACTS_DIR/" | |
| cp usbipd.entitlements "$ARTIFACTS_DIR/" | |
| # Embed the provisioning profile into the system extension bundle. | |
| # | |
| # The DriverKit entitlements in SystemExtension.entitlements are managed | |
| # capabilities: codesign will happily embed the keys, but the kernel only | |
| # honours them when the same keys appear in an Apple-issued provisioning | |
| # profile shipped inside the bundle. Without this the entitlements are inert, | |
| # which is indistinguishable at signing time from them working. | |
| if [ -n "$DRIVERKIT_PROVISIONING_PROFILE" ]; then | |
| echo "📋 Embedding provisioning profile..." | |
| if [ -d "$ARTIFACTS_DIR/USBIPDSystemExtension.systemextension" ]; then | |
| echo "$DRIVERKIT_PROVISIONING_PROFILE" | base64 --decode \ | |
| > "$ARTIFACTS_DIR/USBIPDSystemExtension.systemextension/Contents/embedded.provisionprofile" | |
| echo "✅ Provisioning profile embedded" | |
| else | |
| echo "::warning::DRIVERKIT_PROVISIONING_PROFILE set but no system extension bundle to embed it in" | |
| fi | |
| else | |
| echo "::warning::No DRIVERKIT_PROVISIONING_PROFILE secret configured. The DriverKit entitlements will be signed into the bundle but will not take effect, so device claiming will fail at runtime. See Documentation/development/entitlement-validation.md" | |
| fi | |
| # Package QEMU test server if available | |
| if [ -f .build/release/QEMUTestServer ]; then | |
| QEMU_SERVER_PATH="$ARTIFACTS_DIR/QEMUTestServer-$VERSION-macos" | |
| cp .build/release/QEMUTestServer "$QEMU_SERVER_PATH" | |
| fi | |
| # Code sign binaries if certificates available | |
| if [ -n "$DEVELOPER_ID_CERTIFICATE" ]; then | |
| echo "🔒 Code signing release artifacts..." | |
| # usbipd carries com.apple.developer.system-extension.install, which is a | |
| # RESTRICTED entitlement: AMFI kills a binary that claims it without a | |
| # provisioning profile authorising it. Measured, not assumed — a binary | |
| # signed with just that key and no profile exits 137 on launch. | |
| # | |
| # So the entitlements are only applied when a profile is present. Without | |
| # one, sign exactly as before: hardened runtime for notarization, no | |
| # entitlements, and a daemon that actually starts. | |
| # Every usbipd artifact is signed, including both architecture slices: | |
| # lipo -thin strips the signature, so an unsigned slice would ship. | |
| for target in "$USBIPD_PATH" "$USBIPD_ARM64" "$USBIPD_X86_64"; do | |
| [ -f "$target" ] || continue | |
| if [ -n "$DRIVERKIT_PROVISIONING_PROFILE" ]; then | |
| echo " signing $(basename "$target") with entitlements (provisioning profile present)" | |
| codesign --sign "Developer ID Application" --entitlements "$ARTIFACTS_DIR/usbipd.entitlements" --options runtime --timestamp "$target" || echo "::warning::Code signing failed for $(basename "$target")" | |
| else | |
| echo " signing $(basename "$target") without entitlements (no provisioning profile)" | |
| codesign --sign "Developer ID Application" --options runtime --timestamp "$target" || echo "::warning::Code signing failed for $(basename "$target")" | |
| fi | |
| done | |
| if [ -z "$DRIVERKIT_PROVISIONING_PROFILE" ]; then | |
| echo "::warning::usbipd signed without entitlements. It cannot install the System Extension, but it will launch. Set DRIVERKIT_PROVISIONING_PROFILE to enable them." | |
| fi | |
| # Sign system extension bundle | |
| if [ -d "$ARTIFACTS_DIR/USBIPDSystemExtension.systemextension" ]; then | |
| echo "🔒 Code signing system extension bundle..." | |
| codesign --sign "Developer ID Application" --entitlements "$ARTIFACTS_DIR/SystemExtension.entitlements" --options runtime --timestamp "$ARTIFACTS_DIR/USBIPDSystemExtension.systemextension" || echo "::warning::Code signing failed for system extension" | |
| fi | |
| if [ -f "$QEMU_SERVER_PATH" ]; then | |
| codesign --sign "Developer ID Application" --timestamp "$QEMU_SERVER_PATH" || echo "::warning::Code signing failed for QEMUTestServer" | |
| fi | |
| echo "✅ Code signing completed" | |
| # Read the entitlements back out of the signatures rather than trusting | |
| # what we passed in. A managed capability that was silently dropped looks | |
| # identical to a successful signing run without this check. | |
| echo "🔍 Verifying embedded entitlements..." | |
| codesign -d --entitlements - --xml "$USBIPD_PATH" 2>/dev/null || echo "::warning::Could not read back usbipd entitlements" | |
| if [ -d "$ARTIFACTS_DIR/USBIPDSystemExtension.systemextension" ]; then | |
| SYSEXT_ENTITLEMENTS=$(codesign -d --entitlements - --xml "$ARTIFACTS_DIR/USBIPDSystemExtension.systemextension" 2>/dev/null || echo "") | |
| echo "$SYSEXT_ENTITLEMENTS" | |
| if ! echo "$SYSEXT_ENTITLEMENTS" | grep -q "com.apple.developer.driverkit.transport.usb"; then | |
| echo "::warning::com.apple.developer.driverkit.transport.usb is not present in the signed system extension. Device claiming will not work." | |
| fi | |
| fi | |
| # Notarize system extension bundle if notarization credentials available | |
| if [ -n "$NOTARIZATION_USERNAME" ] && [ -n "$NOTARIZATION_PASSWORD" ] && [ -d "$ARTIFACTS_DIR/USBIPDSystemExtension.systemextension" ]; then | |
| echo "🔒 Notarizing system extension bundle..." | |
| # Create zip for notarization (required format) | |
| ditto -c -k --keepParent "$ARTIFACTS_DIR/USBIPDSystemExtension.systemextension" "$ARTIFACTS_DIR/USBIPDSystemExtension_notarization.zip" | |
| # Submit for notarization with timeout | |
| echo "📤 Submitting system extension for notarization..." | |
| xcrun notarytool submit "$ARTIFACTS_DIR/USBIPDSystemExtension_notarization.zip" \ | |
| --apple-id "$NOTARIZATION_USERNAME" \ | |
| --password "$NOTARIZATION_PASSWORD" \ | |
| --team-id "592A3U6J26" \ | |
| --wait --timeout 10m || { | |
| echo "::warning::System extension notarization failed or timed out" | |
| echo "::warning::This may prevent proper System Extension installation" | |
| } | |
| # Staple the notarization if successful | |
| if xcrun stapler staple "$ARTIFACTS_DIR/USBIPDSystemExtension.systemextension" 2>/dev/null; then | |
| echo "✅ System extension notarization completed and stapled" | |
| else | |
| echo "::warning::Failed to staple notarization to system extension" | |
| fi | |
| # Clean up notarization zip | |
| rm -f "$ARTIFACTS_DIR/USBIPDSystemExtension_notarization.zip" | |
| else | |
| echo "::warning::Notarization credentials not available - System Extension will not be notarized" | |
| echo "::warning::This will prevent proper System Extension installation on user machines" | |
| fi | |
| else | |
| echo "::warning::No code signing certificates available - binaries will be unsigned" | |
| fi | |
| # Create compressed system extension bundle for release | |
| if [ -d "$ARTIFACTS_DIR/USBIPDSystemExtension.systemextension" ]; then | |
| echo "📦 Creating compressed system extension bundle..." | |
| tar -czf "$ARTIFACTS_DIR/USBIPDSystemExtension.systemextension.tar.gz" -C "$ARTIFACTS_DIR" USBIPDSystemExtension.systemextension | |
| # Remove the directory after creating the tar.gz to avoid upload conflicts | |
| rm -rf "$ARTIFACTS_DIR/USBIPDSystemExtension.systemextension" | |
| fi | |
| # Create archive with all non-tar.gz files | |
| ARCHIVE_PATH="$ARTIFACTS_DIR/usbipd-mac-$VERSION.tar.gz" | |
| # Include all files except other .tar.gz files | |
| find "$ARTIFACTS_DIR" -maxdepth 1 -type f ! -name "*.tar.gz" -exec basename {} \; | \ | |
| xargs -I {} tar -czf "$ARCHIVE_PATH" -C "$ARTIFACTS_DIR" {} | |
| # Output artifact paths | |
| PATHS="$USBIPD_PATH" | |
| if [ -f "$QEMU_SERVER_PATH" ]; then | |
| PATHS="$PATHS,$QEMU_SERVER_PATH" | |
| fi | |
| if [ -f "$ARTIFACTS_DIR/USBIPDSystemExtension.systemextension.tar.gz" ]; then | |
| PATHS="$PATHS,$ARTIFACTS_DIR/USBIPDSystemExtension.systemextension.tar.gz" | |
| fi | |
| PATHS="$PATHS,$ARCHIVE_PATH" | |
| echo "paths=$PATHS" >> $GITHUB_OUTPUT | |
| echo "::notice title=Artifacts Built::Release artifacts built successfully" | |
| echo "✅ Artifacts: $PATHS" | |
| echo "::endgroup::" | |
| - name: 📊 Generate Checksums | |
| id: generate-checksums | |
| run: | | |
| echo "::group::Checksum Generation" | |
| echo "::notice title=Checksums::Generating SHA256 checksums for release artifacts" | |
| cd release-artifacts | |
| CHECKSUMS_FILE="checksums-${{ needs.release-validation.outputs.version }}.sha256" | |
| echo "📊 Generating checksums..." | |
| # Only checksum files, not directories | |
| # The binaries are named usbipd-vX.Y.Z-macos, so they end in "-macos" and the | |
| # old "*.macos" glob never matched one. checksums-v0.5.0.sha256 shipped | |
| # covering only the tarballs, with no hash for the binary anyone downloads. | |
| find . -maxdepth 1 -type f \( -name "*-macos" -o -name "*.tar.gz" \) -exec shasum -a 256 {} \; > "$CHECKSUMS_FILE" | |
| if ! grep -q -- "-macos" "$CHECKSUMS_FILE"; then | |
| echo "::error title=Checksums Incomplete::No binary checksum was recorded" | |
| exit 1 | |
| fi | |
| # Extract specific checksums for metadata generation | |
| CLI_SHA256=$(shasum -a 256 usbipd-${{ needs.release-validation.outputs.version }}-macos | cut -d' ' -f1) | |
| echo "CLI_SHA256=$CLI_SHA256" >> $GITHUB_ENV | |
| if [ -f "USBIPDSystemExtension.systemextension.tar.gz" ]; then | |
| SYSEXT_SHA256=$(shasum -a 256 USBIPDSystemExtension.systemextension.tar.gz | cut -d' ' -f1) | |
| echo "SYSEXT_SHA256=$SYSEXT_SHA256" >> $GITHUB_ENV | |
| echo "✅ System extension checksum: ${SYSEXT_SHA256:0:16}..." | |
| else | |
| echo "SYSEXT_SHA256=" >> $GITHUB_ENV | |
| echo "⚠️ System extension bundle not found" | |
| fi | |
| echo "::notice title=Checksums Generated::SHA256 checksums created for all artifacts" | |
| echo "✅ Checksums saved to $CHECKSUMS_FILE" | |
| echo "✅ CLI binary checksum: ${CLI_SHA256:0:16}..." | |
| echo "checksums=$CHECKSUMS_FILE" >> $GITHUB_OUTPUT | |
| echo "::endgroup::" | |
| - name: 📤 Upload Release Artifacts | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: release-artifacts-${{ needs.release-validation.outputs.version }} | |
| path: release-artifacts/ | |
| retention-days: 30 | |
| generate-homebrew-metadata: | |
| name: Generate Homebrew Metadata | |
| runs-on: macos-latest | |
| needs: [release-validation, build-artifacts] | |
| outputs: | |
| metadata-file: ${{ steps.generate-metadata.outputs.metadata-file }} | |
| steps: | |
| - name: 🏺 Starting Homebrew Metadata Generation | |
| run: | | |
| echo "::notice title=Homebrew Metadata::Starting automated homebrew metadata generation" | |
| echo "🏺 This stage generates structured metadata for tap repository consumption" | |
| echo "📊 Status: STARTING" | |
| - name: Checkout code | |
| uses: actions/checkout@v4 | |
| with: | |
| fetch-depth: 0 | |
| - name: 📤 Download Release Artifacts | |
| uses: actions/download-artifact@v4 | |
| with: | |
| name: release-artifacts-${{ needs.release-validation.outputs.version }} | |
| path: release-artifacts/ | |
| - name: 🔧 Setup Metadata Generation Environment | |
| run: | | |
| echo "::group::Environment Setup" | |
| echo "::notice title=Environment::Setting up metadata generation environment" | |
| # Install jq if not available | |
| if ! command -v jq >/dev/null 2>&1; then | |
| echo "📦 Installing jq for JSON processing..." | |
| brew install jq | |
| fi | |
| echo "✅ Environment ready for metadata generation" | |
| echo "::endgroup::" | |
| - name: 🔢 Calculate Binary SHA256 | |
| id: calculate-sha256 | |
| run: | | |
| echo "::group::SHA256 Calculation" | |
| echo "::notice title=SHA256::Calculating release binary checksum for metadata" | |
| VERSION="${{ needs.release-validation.outputs.version }}" | |
| BINARY_URL="https://github.com/beriberikix/usbipd-mac/releases/download/$VERSION/usbipd-$VERSION-macos" | |
| echo "📊 Downloading and calculating SHA256 for release binary..." | |
| echo " URL: $BINARY_URL" | |
| # Download and calculate SHA256 of the release binary from artifacts | |
| # Use local binary from artifacts instead of downloading from GitHub | |
| BINARY_FILE="release-artifacts/usbipd-$VERSION-macos" | |
| if [ ! -f "$BINARY_FILE" ]; then | |
| echo "::error title=Binary Not Found::Release binary not found in artifacts: $BINARY_FILE" | |
| exit 1 | |
| fi | |
| SHA256_CHECKSUM=$(shasum -a 256 "$BINARY_FILE" | cut -d' ' -f1) | |
| if [[ ! "$SHA256_CHECKSUM" =~ ^[a-fA-F0-9]{64}$ ]]; then | |
| echo "::error title=Invalid Checksum::Generated checksum format is invalid" | |
| exit 1 | |
| fi | |
| echo "✅ SHA256 calculated: $SHA256_CHECKSUM" | |
| echo " This checksum will be used for binary validation in tap repository" | |
| echo "sha256=$SHA256_CHECKSUM" >> $GITHUB_OUTPUT | |
| echo "::endgroup::" | |
| - name: 🏺 Generate Homebrew Metadata | |
| id: generate-metadata | |
| run: | | |
| echo "::group::Metadata Generation" | |
| echo "::notice title=Metadata Generation::Generating structured homebrew metadata JSON" | |
| VERSION="${{ needs.release-validation.outputs.version }}" | |
| SHA256_CHECKSUM="${{ steps.calculate-sha256.outputs.sha256 }}" | |
| ARCHIVE_URL="https://github.com/beriberikix/usbipd-mac/archive/$VERSION.tar.gz" | |
| echo "🏺 Generating metadata..." | |
| echo " Version: $VERSION" | |
| echo " SHA256: $SHA256_CHECKSUM" | |
| echo " Archive URL: $ARCHIVE_URL" | |
| # Create enhanced metadata with system extension support | |
| mkdir -p .build/homebrew-metadata | |
| METADATA_FILE=".build/homebrew-metadata/homebrew-metadata.json" | |
| # Get release notes from latest commit | |
| RELEASE_NOTES=$(git log -1 --pretty=format:"%s") | |
| cat > "$METADATA_FILE" << EOF | |
| { | |
| "schema_version": "1.0", | |
| "metadata": { | |
| "version": "$VERSION", | |
| "archive_url": "$ARCHIVE_URL", | |
| "binary_url": "https://github.com/beriberikix/usbipd-mac/releases/download/$VERSION/usbipd-$VERSION-macos", | |
| "sha256": "$SHA256_CHECKSUM", | |
| "release_notes": "$RELEASE_NOTES", | |
| "timestamp": "$(date -u +%Y-%m-%dT%H:%M:%SZ)", | |
| "generator": "usbipd-mac homebrew metadata generator v2.0" | |
| EOF | |
| # Add system extension metadata if available | |
| if [ -n "${SYSEXT_SHA256:-}" ] && [ "$SYSEXT_SHA256" != "" ]; then | |
| cat >> "$METADATA_FILE" << EOF | |
| , | |
| "systemextension_url": "https://github.com/beriberikix/usbipd-mac/releases/download/$VERSION/USBIPDSystemExtension.systemextension.tar.gz", | |
| "systemextension_sha256": "$SYSEXT_SHA256" | |
| EOF | |
| echo "✅ System extension metadata included" | |
| else | |
| echo "⚠️ System extension metadata not available" | |
| fi | |
| cat >> "$METADATA_FILE" << EOF | |
| }, | |
| "formula_updates": { | |
| "version_placeholder": "{{VERSION}}", | |
| "sha256_placeholder": "{{SHA256}}", | |
| "url_pattern": "releases/download/{{VERSION}}/usbipd-{{VERSION}}-macos" | |
| EOF | |
| # Add system extension formula updates if available | |
| if [ -n "${SYSEXT_SHA256:-}" ] && [ "$SYSEXT_SHA256" != "" ]; then | |
| cat >> "$METADATA_FILE" << EOF | |
| , | |
| "sysext_sha256_placeholder": "{{SYSEXT_SHA256}}", | |
| "sysext_url_pattern": "releases/download/{{VERSION}}/USBIPDSystemExtension.systemextension.tar.gz" | |
| EOF | |
| fi | |
| cat >> "$METADATA_FILE" << EOF | |
| } | |
| } | |
| EOF | |
| # Verify metadata was generated | |
| if [ ! -f "$METADATA_FILE" ]; then | |
| echo "::error title=Metadata Missing::Generated metadata file not found" | |
| exit 1 | |
| fi | |
| echo "::notice title=Metadata Generated::Homebrew metadata generated successfully" | |
| echo "✅ Metadata generated: $METADATA_FILE" | |
| echo "metadata-file=$METADATA_FILE" >> $GITHUB_OUTPUT | |
| echo "::endgroup::" | |
| - name: 🔍 Validate Generated Metadata | |
| run: | | |
| echo "::group::Metadata Validation" | |
| echo "::notice title=Metadata Validation::Validating generated metadata against schema" | |
| METADATA_FILE="${{ steps.generate-metadata.outputs.metadata-file }}" | |
| echo "🔍 Validating metadata..." | |
| echo " File: $METADATA_FILE" | |
| # Validate metadata using the validation script | |
| ./Scripts/validate-homebrew-metadata.sh \ | |
| --file "$METADATA_FILE" \ | |
| --skip-network \ | |
| --skip-checksum \ | |
| --verbose | |
| echo "::notice title=Metadata Validated::Metadata validation completed successfully" | |
| echo "✅ Metadata validation passed" | |
| echo "::endgroup::" | |
| - name: 📋 Metadata Summary | |
| run: | | |
| echo "::group::Metadata Summary" | |
| echo "::notice title=Metadata Summary::Displaying generated metadata summary" | |
| METADATA_FILE="${{ steps.generate-metadata.outputs.metadata-file }}" | |
| echo "📋 Generated Metadata Summary:" | |
| echo " • Schema Version: $(jq -r '.schema_version' "$METADATA_FILE")" | |
| echo " • Version: $(jq -r '.metadata.version' "$METADATA_FILE")" | |
| echo " • Archive URL: $(jq -r '.metadata.archive_url' "$METADATA_FILE")" | |
| echo " • SHA256: $(jq -r '.metadata.sha256' "$METADATA_FILE" | head -c 16)..." | |
| echo " • Timestamp: $(jq -r '.metadata.timestamp' "$METADATA_FILE")" | |
| echo " • File Size: $(wc -c < "$METADATA_FILE") bytes" | |
| echo "✅ Metadata ready for tap repository consumption" | |
| echo "::endgroup::" | |
| - name: 📤 Upload Metadata as Artifact | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: homebrew-metadata-${{ needs.release-validation.outputs.version }} | |
| path: ${{ steps.generate-metadata.outputs.metadata-file }} | |
| retention-days: 90 | |
| create-release: | |
| name: Create GitHub Release | |
| runs-on: macos-latest | |
| needs: [release-validation, build-artifacts, generate-homebrew-metadata] | |
| steps: | |
| - name: 🚀 Starting Release Creation | |
| run: | | |
| echo "::notice title=Release Creation::Creating GitHub release with artifacts" | |
| echo "🚀 This stage creates the GitHub release and uploads artifacts" | |
| echo "📊 Status: STARTING" | |
| - name: Checkout code | |
| uses: actions/checkout@v4 | |
| with: | |
| fetch-depth: 0 | |
| - name: 📤 Download Release Artifacts | |
| uses: actions/download-artifact@v4 | |
| with: | |
| name: release-artifacts-${{ needs.release-validation.outputs.version }} | |
| path: release-artifacts/ | |
| - name: 📥 Download Homebrew Metadata | |
| uses: actions/download-artifact@v4 | |
| with: | |
| name: homebrew-metadata-${{ needs.release-validation.outputs.version }} | |
| path: homebrew-metadata/ | |
| - name: 📝 Generate Release Notes | |
| id: release-notes | |
| run: | | |
| echo "::group::Release Notes Generation" | |
| echo "::notice title=Release Notes::Generating release notes from commit history" | |
| VERSION="${{ needs.release-validation.outputs.version }}" | |
| PREVIOUS_TAG=$(git describe --tags --abbrev=0 HEAD^ 2>/dev/null || echo "") | |
| echo "📝 Generating release notes for $VERSION..." | |
| if [ -n "$PREVIOUS_TAG" ]; then | |
| echo "📋 Changes since $PREVIOUS_TAG:" | |
| CHANGELOG=$(git log --pretty=format:"- %s" $PREVIOUS_TAG..HEAD | head -20) | |
| else | |
| echo "📋 Initial release changes:" | |
| CHANGELOG=$(git log --pretty=format:"- %s" HEAD | head -20) | |
| fi | |
| # Create release notes | |
| cat > release-notes.md << EOF | |
| # Release $VERSION | |
| ## What's Changed | |
| $CHANGELOG | |
| ## Artifacts | |
| This release includes the following artifacts: | |
| - **usbipd**: Main USB/IP daemon executable for macOS | |
| - **USBIPDSystemExtension.systemextension.tar.gz**: System Extension bundle for advanced USB device access | |
| - **QEMUTestServer**: QEMU integration test server (if available) | |
| - **Archive**: Complete packaged release (tar.gz) | |
| - **Checksums**: SHA256 verification checksums | |
| ## Installation | |
| **Homebrew (Recommended):** | |
| \`\`\`bash | |
| brew tap beriberikix/usbipd-mac | |
| brew install usbip | |
| sudo usbipd install-system-extension | |
| sudo brew services start usbip | |
| \`\`\` | |
| **Manual Installation:** | |
| 1. Download \`usbipd-$VERSION-macos\` and \`USBIPDSystemExtension.systemextension.tar.gz\` | |
| 2. Make the binary executable: \`chmod +x usbipd-$VERSION-macos\` | |
| 3. Extract and install the system extension bundle | |
| 4. Install the system extension: \`sudo ./usbipd-$VERSION-macos install-system-extension\` | |
| ## Requirements | |
| - macOS 11.0 or later | |
| - Administrator privileges for USB device access | |
| - System extension approval in System Preferences | |
| ## Notes | |
| - Binaries are code-signed with Apple Developer ID when available | |
| - System extension requires user approval on first installation | |
| - Full functionality requires both the CLI binary and system extension | |
| EOF | |
| echo "::notice title=Release Notes Ready::Release notes generated successfully" | |
| echo "✅ Release notes prepared" | |
| echo "::endgroup::" | |
| - name: 🚀 Create GitHub Release | |
| run: | | |
| echo "::group::GitHub Release Creation" | |
| echo "::notice title=GitHub Release::Creating GitHub release with artifacts" | |
| VERSION="${{ needs.release-validation.outputs.version }}" | |
| PRERELEASE="${{ needs.release-validation.outputs.is-prerelease }}" | |
| echo "🚀 Creating GitHub release $VERSION..." | |
| # Create release with artifacts and metadata | |
| if [ "$PRERELEASE" = "true" ]; then | |
| echo "🏷️ Creating pre-release" | |
| gh release create "$VERSION" release-artifacts/* homebrew-metadata/* \ | |
| --title "usbipd-mac $VERSION" \ | |
| --notes-file release-notes.md \ | |
| --prerelease | |
| else | |
| echo "🏷️ Creating stable release" | |
| gh release create "$VERSION" release-artifacts/* homebrew-metadata/* \ | |
| --title "usbipd-mac $VERSION" \ | |
| --notes-file release-notes.md | |
| fi | |
| echo "::notice title=Release Created::GitHub release created successfully" | |
| echo "✅ Release $VERSION published" | |
| echo "🔗 Release URL: ${{ github.server_url }}/${{ github.repository }}/releases/tag/$VERSION" | |
| echo "::endgroup::" | |
| update-homebrew-formula: | |
| name: Update Homebrew Formula | |
| runs-on: ubuntu-latest | |
| needs: [release-validation, create-release, generate-homebrew-metadata] | |
| if: always() && needs.create-release.result == 'success' | |
| steps: | |
| # The tap pulls; this repository no longer pushes to it. | |
| # | |
| # This job used to send a repository_dispatch to homebrew-usbipd-mac, which needed | |
| # a personal access token with write access there. The token expired after a year, | |
| # the dispatch began returning 401, and the step reported success regardless — so | |
| # v0.5.0 shipped with the formula still pointing at a deleted release. | |
| # | |
| # homebrew-usbipd-mac now runs formula-sync.yml on a schedule: it reads the latest | |
| # release here, which is public and needs no credential, and commits with its own | |
| # GITHUB_TOKEN. Nothing expires, and a missed run is corrected by the next one. | |
| - name: 🏺 Homebrew formula updates by pull | |
| run: | | |
| echo "::notice title=Homebrew Update::The tap syncs itself; no dispatch is sent" | |
| echo "The formula is updated by formula-sync.yml in homebrew-usbipd-mac," | |
| echo "which polls this repository's latest release every six hours." | |
| echo "" | |
| echo "To update immediately rather than waiting for the schedule:" | |
| echo " gh workflow run formula-sync.yml --repo beriberikix/homebrew-usbipd-mac" | |
| echo "" | |
| echo "Tap runs: https://github.com/beriberikix/homebrew-usbipd-mac/actions" | |
| post-release: | |
| name: Post-Release Validation | |
| runs-on: macos-latest | |
| needs: [release-validation, create-release, generate-homebrew-metadata, update-homebrew-formula] | |
| if: always() && needs.create-release.result == 'success' | |
| steps: | |
| - name: 📊 Starting Post-Release Validation | |
| run: | | |
| echo "::notice title=Post-Release::Starting post-release validation and summary" | |
| echo "📊 This stage validates the published release and provides completion summary" | |
| echo "📊 Status: STARTING" | |
| - name: Checkout code | |
| uses: actions/checkout@v4 | |
| - name: ✅ Validate Release | |
| run: | | |
| echo "::group::Release Validation" | |
| echo "::notice title=Release Validation::Validating published release" | |
| VERSION="${{ needs.release-validation.outputs.version }}" | |
| echo "✅ Validating release $VERSION..." | |
| # Verify release exists and is accessible | |
| if gh release view "$VERSION" > /dev/null 2>&1; then | |
| echo "::notice title=Release Verified::Release is publicly accessible" | |
| echo "✅ Release $VERSION verified" | |
| # Display release summary | |
| echo "📊 Release Summary:" | |
| echo " • Version: $VERSION" | |
| echo " • Pre-release: ${{ needs.release-validation.outputs.is-prerelease }}" | |
| echo " • Release type: ${{ needs.release-validation.outputs.release-type }}" | |
| echo " • Artifacts: Available" | |
| echo " • Status: Published" | |
| else | |
| echo "::error title=Release Verification Failed::Cannot verify release accessibility" | |
| echo "❌ Release verification failed" | |
| exit 1 | |
| fi | |
| echo "::endgroup::" | |
| - name: 🎉 Release Success Summary | |
| run: | | |
| echo "::group::Release Success" | |
| echo "::notice title=Release Complete::Streamlined production release completed successfully" | |
| echo "🎉 Release ${{ needs.release-validation.outputs.version }} has been successfully published!" | |
| echo "" | |
| echo "📦 **Release Details:**" | |
| echo " • Version: ${{ needs.release-validation.outputs.version }}" | |
| echo " • Pre-release: ${{ needs.release-validation.outputs.is-prerelease }}" | |
| echo " • Release type: ${{ needs.release-validation.outputs.release-type }}" | |
| echo " • Release URL: ${{ github.server_url }}/${{ github.repository }}/releases/tag/${{ needs.release-validation.outputs.version }}" | |
| echo "" | |
| echo "✅ **Completed Steps:**" | |
| echo " • Release version validation" | |
| echo " • Comprehensive CI validation (via workflow_call)" | |
| echo " • Optimized artifact building and signing" | |
| echo " • Automated Homebrew metadata generation" | |
| echo " • GitHub release creation with artifacts and metadata" | |
| echo " • Homebrew formula update via homebrew-releaser" | |
| echo " • Post-release verification" | |
| echo "" | |
| echo "🔗 **Workflow Benefits:**" | |
| echo " • Reused CI validation logic from consolidated workflow" | |
| echo " • Streamlined artifact building process" | |
| echo " • Consistent validation across CI and release pipelines" | |
| echo " • Automated external tap repository integration" | |
| echo " • Reduced workflow duplication and maintenance" | |
| echo "" | |
| echo "🏺 **Homebrew Integration:**" | |
| if [[ "${{ needs.update-homebrew-formula.result }}" == "success" ]]; then | |
| echo " • ✅ Homebrew formula update completed successfully" | |
| echo " • ✅ Formula committed to tap repository via homebrew-releaser" | |
| echo " • ✅ Users can upgrade via: brew upgrade usbip" | |
| else | |
| echo " • ⚠️ Homebrew formula update failed" | |
| echo " • 🔧 Review action logs for configuration issues" | |
| echo " • 🔧 Manual formula update may be needed" | |
| fi | |
| echo "" | |
| echo "📊 Status: **SUCCESS**" | |
| echo "::endgroup::" |