Support disbursement activity records #3
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Release | |
| on: | |
| push: | |
| branches: [main] | |
| permissions: | |
| contents: read | |
| env: | |
| VERSION: 0.0.${{ github.run_number }} | |
| MACOSX_DEPLOYMENT_TARGET: "14.0" | |
| jobs: | |
| build: | |
| strategy: | |
| matrix: | |
| include: | |
| - runner: macos-15 | |
| target: aarch64-apple-darwin | |
| platform: macos | |
| artifact: unsigned/venmo-* | |
| - runner: macos-15-intel | |
| target: x86_64-apple-darwin | |
| platform: macos | |
| artifact: unsigned/venmo-* | |
| - runner: ubuntu-22.04-arm | |
| target: aarch64-unknown-linux-gnu | |
| platform: linux | |
| artifact: dist/venmo-v*.tar.gz | |
| - runner: ubuntu-22.04 | |
| target: x86_64-unknown-linux-gnu | |
| platform: linux | |
| artifact: dist/venmo-v*.tar.gz | |
| runs-on: ${{ matrix.runner }} | |
| steps: | |
| - uses: actions/checkout@v7 | |
| - name: Set version | |
| run: | | |
| python3 - <<'PY' | |
| import os | |
| import re | |
| from pathlib import Path | |
| version = os.environ["VERSION"] | |
| path = Path("Cargo.toml") | |
| text = path.read_text() | |
| text, count = re.subn( | |
| r'^version = "[^"]+"$', | |
| f'version = "{version}"', | |
| text, | |
| count=1, | |
| flags=re.MULTILINE, | |
| ) | |
| if count != 1: | |
| raise SystemExit("could not set Cargo package version") | |
| path.write_text(text) | |
| lock_path = Path("Cargo.lock") | |
| lock_text = lock_path.read_text() | |
| lock_text, count = re.subn( | |
| r'(\[\[package\]\]\nname = "venmo-cli"\nversion = ")[^"]+("\n)', | |
| lambda match: f'{match.group(1)}{version}{match.group(2)}', | |
| lock_text, | |
| count=1, | |
| ) | |
| if count != 1: | |
| raise SystemExit("could not set Cargo lockfile version") | |
| lock_path.write_text(lock_text) | |
| PY | |
| - name: Build production binary | |
| run: cargo build --release --locked --bin venmo | |
| - name: Verify production binary | |
| run: | | |
| test "$(target/release/venmo --version)" = "venmo $VERSION" | |
| - name: Prepare release artifact | |
| run: | | |
| if [ "${{ matrix.platform }}" = macos ]; then | |
| mkdir unsigned | |
| cp target/release/venmo "unsigned/venmo-${{ matrix.target }}" | |
| else | |
| mkdir package dist | |
| cp target/release/venmo package/venmo | |
| tar -czf "dist/venmo-v$VERSION-${{ matrix.target }}.tar.gz" -C package venmo | |
| fi | |
| - uses: actions/upload-artifact@v7 | |
| with: | |
| name: ${{ matrix.target }} | |
| path: ${{ matrix.artifact }} | |
| sign: | |
| needs: build | |
| runs-on: macos-15 | |
| steps: | |
| - uses: actions/download-artifact@v8 | |
| with: | |
| pattern: "*-apple-darwin" | |
| path: unsigned | |
| merge-multiple: true | |
| - name: Sign and notarize | |
| env: | |
| MACOS_CERTIFICATE_P12_BASE64: ${{ secrets.MACOS_CERTIFICATE_P12_BASE64 }} | |
| MACOS_CERTIFICATE_PASSWORD: ${{ secrets.MACOS_CERTIFICATE_PASSWORD }} | |
| MACOS_SIGNING_IDENTITY: ${{ secrets.MACOS_SIGNING_IDENTITY }} | |
| APPLE_API_KEY_P8: ${{ secrets.APPLE_API_KEY_P8 }} | |
| APPLE_API_KEY_ID: ${{ secrets.APPLE_API_KEY_ID }} | |
| APPLE_API_ISSUER_ID: ${{ secrets.APPLE_API_ISSUER_ID }} | |
| run: | | |
| : "${MACOS_CERTIFICATE_P12_BASE64:?missing certificate}" | |
| : "${MACOS_CERTIFICATE_PASSWORD:?missing certificate password}" | |
| : "${MACOS_SIGNING_IDENTITY:?missing signing identity}" | |
| : "${APPLE_API_KEY_P8:?missing API key}" | |
| : "${APPLE_API_KEY_ID:?missing API key ID}" | |
| : "${APPLE_API_ISSUER_ID:?missing API issuer ID}" | |
| keychain="$RUNNER_TEMP/release.keychain-db" | |
| certificate="$RUNNER_TEMP/certificate.p12" | |
| api_key="$RUNNER_TEMP/AuthKey_$APPLE_API_KEY_ID.p8" | |
| keychain_password=$(openssl rand -hex 16) | |
| cleanup() { | |
| security list-keychain -d user -s "$HOME/Library/Keychains/login.keychain-db" >/dev/null 2>&1 || true | |
| security delete-keychain "$keychain" >/dev/null 2>&1 || true | |
| } | |
| trap cleanup EXIT | |
| printf '%s' "$MACOS_CERTIFICATE_P12_BASE64" | base64 --decode > "$certificate" | |
| printf '%s\n' "$APPLE_API_KEY_P8" > "$api_key" | |
| security create-keychain -p "$keychain_password" "$keychain" | |
| security set-keychain-settings -lut 21600 "$keychain" | |
| security unlock-keychain -p "$keychain_password" "$keychain" | |
| security import "$certificate" -P "$MACOS_CERTIFICATE_PASSWORD" -A -t cert -f pkcs12 -k "$keychain" | |
| security set-key-partition-list -S apple-tool:,apple: -k "$keychain_password" "$keychain" | |
| security list-keychain -d user -s "$keychain" | |
| for target in aarch64-apple-darwin x86_64-apple-darwin; do | |
| binary="unsigned/venmo-$target" | |
| chmod 755 "$binary" | |
| codesign --force --keychain "$keychain" \ | |
| --sign "$MACOS_SIGNING_IDENTITY" \ | |
| --identifier io.jeph.venmo \ | |
| --options runtime \ | |
| --timestamp \ | |
| "$binary" | |
| codesign --verify --strict --verbose=2 "$binary" | |
| done | |
| mkdir -p notarize/aarch64 notarize/x86_64 | |
| cp unsigned/venmo-aarch64-apple-darwin notarize/aarch64/venmo | |
| cp unsigned/venmo-x86_64-apple-darwin notarize/x86_64/venmo | |
| COPYFILE_DISABLE=1 ditto -c -k --keepParent notarize "$RUNNER_TEMP/notarize.zip" | |
| xcrun notarytool submit "$RUNNER_TEMP/notarize.zip" \ | |
| --key "$api_key" \ | |
| --key-id "$APPLE_API_KEY_ID" \ | |
| --issuer "$APPLE_API_ISSUER_ID" \ | |
| --wait \ | |
| --timeout 30m \ | |
| --no-progress \ | |
| --output-format json > "$RUNNER_TEMP/notary-result.json" | |
| test "$(plutil -extract status raw -o - "$RUNNER_TEMP/notary-result.json")" = Accepted | |
| mkdir dist | |
| for target in aarch64-apple-darwin x86_64-apple-darwin; do | |
| package="$RUNNER_TEMP/package-$target" | |
| mkdir "$package" | |
| cp "unsigned/venmo-$target" "$package/venmo" | |
| COPYFILE_DISABLE=1 tar -czf "dist/venmo-v$VERSION-$target.tar.gz" -C "$package" venmo | |
| done | |
| - uses: actions/upload-artifact@v7 | |
| with: | |
| name: signed-macos | |
| path: dist/venmo-v*.tar.gz | |
| release: | |
| needs: sign | |
| runs-on: ubuntu-24.04 | |
| permissions: | |
| contents: write | |
| env: | |
| GH_TOKEN: ${{ github.token }} | |
| GH_REPO: ${{ github.repository }} | |
| steps: | |
| - uses: actions/download-artifact@v8 | |
| with: | |
| name: signed-macos | |
| path: dist | |
| - uses: actions/download-artifact@v8 | |
| with: | |
| pattern: "*-unknown-linux-gnu" | |
| path: dist | |
| merge-multiple: true | |
| - name: Publish release | |
| run: | | |
| cd dist | |
| sha256sum ./*.tar.gz > SHA256SUMS | |
| if ! gh release view "v$VERSION" >/dev/null 2>&1; then | |
| gh release create "v$VERSION" ./*.tar.gz SHA256SUMS \ | |
| --target "$GITHUB_SHA" \ | |
| --generate-notes \ | |
| --latest | |
| fi | |
| - uses: actions/checkout@v7 | |
| with: | |
| repository: jeph/homebrew-tap | |
| ssh-key: ${{ secrets.HOMEBREW_TAP_DEPLOY_KEY }} | |
| path: tap | |
| - name: Update tap | |
| run: | | |
| arm_sha=$(sha256sum "dist/venmo-v$VERSION-aarch64-apple-darwin.tar.gz" | cut -d ' ' -f 1) | |
| intel_sha=$(sha256sum "dist/venmo-v$VERSION-x86_64-apple-darwin.tar.gz" | cut -d ' ' -f 1) | |
| linux_arm_sha=$(sha256sum "dist/venmo-v$VERSION-aarch64-unknown-linux-gnu.tar.gz" | cut -d ' ' -f 1) | |
| linux_intel_sha=$(sha256sum "dist/venmo-v$VERSION-x86_64-unknown-linux-gnu.tar.gz" | cut -d ' ' -f 1) | |
| mkdir -p tap/Formula | |
| cat > tap/Formula/venmo.rb <<EOF | |
| class Venmo < Formula | |
| desc "Unofficial Venmo command-line client" | |
| homepage "https://github.com/$GITHUB_REPOSITORY" | |
| version "$VERSION" | |
| license "MIT" | |
| on_macos do | |
| depends_on macos: :sonoma | |
| on_arm do | |
| url "https://github.com/$GITHUB_REPOSITORY/releases/download/v#{version}/venmo-v#{version}-aarch64-apple-darwin.tar.gz" | |
| sha256 "$arm_sha" | |
| end | |
| on_intel do | |
| url "https://github.com/$GITHUB_REPOSITORY/releases/download/v#{version}/venmo-v#{version}-x86_64-apple-darwin.tar.gz" | |
| sha256 "$intel_sha" | |
| end | |
| end | |
| on_linux do | |
| on_arm do | |
| url "https://github.com/$GITHUB_REPOSITORY/releases/download/v#{version}/venmo-v#{version}-aarch64-unknown-linux-gnu.tar.gz" | |
| sha256 "$linux_arm_sha" | |
| end | |
| on_intel do | |
| url "https://github.com/$GITHUB_REPOSITORY/releases/download/v#{version}/venmo-v#{version}-x86_64-unknown-linux-gnu.tar.gz" | |
| sha256 "$linux_intel_sha" | |
| end | |
| end | |
| def install | |
| bin.install "venmo" | |
| end | |
| test do | |
| assert_equal "venmo #{version}", shell_output("#{bin}/venmo --version").strip | |
| end | |
| end | |
| EOF | |
| git -C tap config user.name github-actions[bot] | |
| git -C tap config user.email 41898282+github-actions[bot]@users.noreply.github.com | |
| git -C tap add Formula/venmo.rb | |
| if ! git -C tap diff --cached --quiet; then | |
| git -C tap commit -m "venmo $VERSION" | |
| git -C tap push | |
| fi |