GlcoinCore/alby-hub
1
0
Fork 0
mirror of https://github.com/getAlby/hub.git synced 2026-08-13 12:33:39 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions 4

ci: support builds for fork pull requests (#2492)

Browse source 
ci: skip macOS signing for untrusted PRs

Co-authored-by: Hermes Agent <hermes-agent@users.noreply.github.com>
This commit is contained in:
hermes-alby 2026-08-04 16:14:30 +07:00 • committed by GitHub
parent 32af89bc8c
commit bf0ebe1f33
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
2 changed files with 56 additions and 6 deletions
Download patch file Download diff file Expand all files Collapse all files

32
.github/workflows/http.yml vendored
View file

@ -25,6 +25,7 @@ on:
jobs:
build:
strategy:
fail-fast: false
matrix:
build:
[
@ -128,7 +129,15 @@ jobs:
run: go build ${{ env.GOTAGS }} -o build/bin/${{ env.PACKAGE_NAME }}/bin/${{ env.EXEC_NAME }} -ldflags "-X 'github.com/getAlby/hub/version.Tag=${{ env.TAG }}'" cmd/http/main.go
- name: Import Code-Signing Certificates for macOS
if: runner.os == 'macOS'
if: >-
runner.os == 'macOS' &&
(
!github.event.pull_request ||
(
github.event.pull_request.head.repo.full_name == github.repository &&
github.actor != 'dependabot[bot]'
)
)
uses: Apple-Actions/import-codesign-certs@v3
with:
# The certificates in a PKCS12 file encoded as a base64 string
@ -165,7 +174,15 @@ jobs:
shell: bash
- name: Sign the MacOS binary and libraries
if: runner.os == 'macOS'
if: >-
runner.os == 'macOS' &&
(
!github.event.pull_request ||
(
github.event.pull_request.head.repo.full_name == github.repository &&
github.actor != 'dependabot[bot]'
)
)
run: |
/usr/bin/codesign -s "Developer ID Application: Alby Inc." -f -v --deep --timestamp --options runtime ./build/bin/${{ env.PACKAGE_NAME }}/bin/${{ env.EXEC_NAME }}
/usr/bin/codesign -s "Developer ID Application: Alby Inc." -f -v --deep --timestamp --options runtime ./build/bin/${{ env.PACKAGE_NAME }}/lib/*.dylib
@ -189,7 +206,16 @@ jobs:
cd ../../..
- name: Notarize the zip file
if: runner.os == 'macOS' && inputs.build-release
if: >-
runner.os == 'macOS' &&
inputs.build-release &&
(
!github.event.pull_request ||
(
github.event.pull_request.head.repo.full_name == github.repository &&
github.actor != 'dependabot[bot]'
)
)
run: |
echo "Notarizing Zip Files"
gon -log-level=info -log-json ./build/darwin/http/gon-notarize.json

30
.github/workflows/wails.yml vendored
View file

@ -129,7 +129,15 @@ jobs:
shell: bash
- name: Import Code-Signing Certificates for macOS
if: runner.os == 'macOS'
if: >-
runner.os == 'macOS' &&
(
!github.event.pull_request ||
(
github.event.pull_request.head.repo.full_name == github.repository &&
github.actor != 'dependabot[bot]'
)
)
uses: Apple-Actions/import-codesign-certs@v3
with:
# The certificates in a PKCS12 file encoded as a base64 string
@ -190,7 +198,15 @@ jobs:
mv ./build/out/${{ env.PACKAGE_NAME }}.tar.bz2 ./build/bin/
- name: Sign the macOS binary
if: runner.os == 'macOS'
if: >-
runner.os == 'macOS' &&
(
!github.event.pull_request ||
(
github.event.pull_request.head.repo.full_name == github.repository &&
github.actor != 'dependabot[bot]'
)
)
run: |
echo "Signing Package"
/usr/bin/codesign -s "Developer ID Application: Alby Inc." -f -v --deep --timestamp --options runtime --entitlements ./build/darwin/entitlements.plist "./build/bin/${{ env.EXEC_NAME }}.app"
@ -222,7 +238,15 @@ jobs:
EOF
- name: Notarize the DMG image
if: runner.os == 'macOS'
if: >-
runner.os == 'macOS' &&
(
!github.event.pull_request ||
(
github.event.pull_request.head.repo.full_name == github.repository &&
github.actor != 'dependabot[bot]'
)
)
run: |
echo "Notarizing Zip Files"
gon -log-level=info -log-json ./build/darwin/gon-notarize.json