| 1 |
// GoingsOn: macOS (aarch64) release recipe for Bento. |
| 2 |
// |
| 3 |
// Ports _private/docs/goingson/deploy.md (macOS section). Runs on the mbp host |
| 4 |
// over the in-session ops-agent transport, the only context where the |
| 5 |
// Developer ID key is usable (Bento design ยง7 "THE WALL"). `release-macos.sh |
| 6 |
// --keychain` does build + codesign + notarize + staple + a Gatekeeper |
| 7 |
// self-check in one pass; we re-verify Gatekeeper here (the proof the publish |
| 8 |
// gate requires) and collect the DMG + updater artifacts into Bento's dist |
| 9 |
// tree. OTA upload stays manual via the MNW dashboard, no publish() call. |
| 10 |
|
| 11 |
let h = build_host(); |
| 12 |
let v = version(); |
| 13 |
let r = repo(); |
| 14 |
|
| 15 |
step("checkout"); |
| 16 |
// Pin to the release tag v<version> (not whatever main is at pull time); the |
| 17 |
// daemon also runs this as a cross-host preflight barrier before any build. |
| 18 |
let sha = checkout_sha(h); |
| 19 |
log("pinned " + h + " to v" + v + " @ " + sha); |
| 20 |
|
| 21 |
// release-macos.sh: build, sign (ephemeral build keychain), notarize, staple. |
| 22 |
// Gate: no artifact is built from code that fails clippy or its tests. It runs |
| 23 |
// on this target's own build host, so a break confined to one platform is |
| 24 |
// caught where it would have shipped. |
| 25 |
step("prebuild"); |
| 26 |
sh_ok(h, "cd " + r + " && cargo clippy --workspace --all-targets " + feature_flags() + " -- -D warnings"); |
| 27 |
sh_ok(h, "cd " + r + " && cargo test --workspace " + feature_flags()); |
| 28 |
|
| 29 |
step("build"); |
| 30 |
sh_ok(h, "cd " + r + " && . ~/.tauri/passwords.env && ./dist/release-macos.sh --keychain"); |
| 31 |
|
| 32 |
// The DMG name embeds the version; resolve it rather than reconstruct it. |
| 33 |
step("verify"); |
| 34 |
let dmg = resolve_artifact(h, r + "/target/release/bundle/dmg/*.dmg"); |
| 35 |
if !verify_gatekeeper(h, dmg) { |
| 36 |
throw "DMG is not Gatekeeper-accepted as Notarized Developer ID: " + dmg; |
| 37 |
} |
| 38 |
|
| 39 |
step("collect"); |
| 40 |
collect(h, dmg, "goingson", v); |
| 41 |
// Updater artifacts (.app.tar.gz + .sig) for OTA, when the build produced them. |
| 42 |
let upd = resolve_artifact_opt(h, r + "/target/release/bundle/macos/*.app.tar.gz"); |
| 43 |
if upd != "" { |
| 44 |
collect(h, upd, "goingson", v); |
| 45 |
collect(h, upd + ".sig", "goingson", v); |
| 46 |
} |
| 47 |
log("GoingsOn macOS v" + v + " built, notarized, and collected. Upload OTA artifacts via the MNW dashboard."); |
| 48 |
|