build.yml

name: build

# on:
#   push:
#     branches: [ main ]
on:
  workflow_dispatch:

jobs:
  build-win32:
    runs-on: windows-2022
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Build
        shell: powershell
        env:
          SPC_B64: ${{ secrets.SPC_B64 }}
          POINTER_CC_VERSION: ${{ vars.POINTER_CC_VERSION }} 
        run: |
          $bytes = [System.Convert]::FromBase64String($env:SPC_B64)
          Set-Content -Path .\StefanMattingSPC.pfx -Value $bytes -Encoding Byte
          Import-PfxCertificate -FilePath .\StefanMattingSPC.pfx -CertStoreLocation 'Cert:\CurrentUser\My'
          Remove-Item .\StefanMattingSPC.pfx

          choco install python310 > $null
          choco install innosetup

          Remove-Item -Force -Recurse -ErrorAction SilentlyContinue venv
          C:\hostedtoolcache\windows\Python\3.10.11\x64\python.exe --version
          C:\hostedtoolcache\windows\Python\3.10.11\x64\python.exe -m venv venv
          cd .\venv\Scripts
          ./Activate.ps1
          cd ..\..\

          # --no-deps: prevent wxpython from pulling numpy
          python -m pip install --no-deps -r requirements.txt
          python -m pip install -r requirements-stage2.txt

          & .\scripts\build.ps1
          $env:PATH = " C:\Program Files (x86)\Windows Kits\10\App Certification Kit;" + $env:PATH
          & .\scripts\package-win.ps1

      - name: Upload Artifacts
        uses: actions/upload-artifact@v4
        with:
          name: build-result-win32
          path: Output/*.exe

  build-darwin:
    runs-on: macos-11
    strategy:
      matrix:
        target_arch: [ x86_64, arm64 ]
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Import certs
        shell: bash
        env:
          CERTS_P12: ${{ secrets.CERTS_P12 }} 
          CERTS_P12_PASSWORD: ${{ secrets.CERTS_P12_PASSWORD }} 
        run: |
          set -eo pipefail
          # https://github.com/Apple-Actions/import-codesign-certs/blob/master/src/security.ts

          CERTS_PATH=$RUNNER_TEMP/bundle.p12
          echo -n "$CERTS_P12" | base64 -d -o "$CERTS_PATH"
          KEYCHAIN_PATH=$RUNNER_TEMP/app-signing
          KEYCHAIN_PASSWORD=foo

          # create temporary keychain
          security create-keychain -p "$KEYCHAIN_PASSWORD" $KEYCHAIN_PATH
          security set-keychain-settings -lut 21600 $KEYCHAIN_PATH
          security unlock-keychain -p "$KEYCHAIN_PASSWORD" $KEYCHAIN_PATH

          # import and allow all applications to use it
          security import "$CERTS_PATH" -k $KEYCHAIN_PATH  -f pkcs12 -A -T /usr/bin/codesign -T /usr/bin/security -P "$CERTS_P12_PASSWORD"
          
          # magic incantation that is necessary
          security set-key-partition-list -S apple-tool:,apple: -k "$KEYCHAIN_PASSWORD" $KEYCHAIN_PATH

          # also necessary, this command actually sets things (even though the name).
          security list-keychains -d user -s $KEYCHAIN_PATH login.keychain

          # check that we have a valid codesigning cert
          security find-identity -vp codesigning $KEYCHAIN_PATH

      - name: Set architecture variable
        run: |
          if [ "${{ matrix.target_arch }}" == "x86_64" ]; then
            architecture="x64"
          elif [ "${{ matrix.target_arch }}" == "arm64" ]; then
            architecture="arm64"
          fi
          echo "architecture=$architecture" >> "$GITHUB_ENV"

      - uses: actions/setup-python@v5
        with:
          architecture: ${{ env.architecture }}
          python-version: '3.10.11'

      - shell: bash
        env:
          POINTER_CC_VERSION: ${{ vars.POINTER_CC_VERSION }} 
          TARGET_ARCH: ${{ matrix.target_arch }}
        run: |
          export TARGET_ARCH

          python3 --version
          python3 -m venv venv
          source venv/bin/activate

          if [ "$TARGET_ARCH" = "x86_64" ]; then
            # --no-deps: prevent wxpython from pulling numpy
            pip install --no-deps -r requirements.txt
            pip install -r requirements-stage2.txt
          else
            pip install --platform macosx_11_0_arm64 --no-deps --target venv/lib/python3.10/site-packages -r requirements.txt
            pip install --platform macosx_11_0_arm64 --no-deps --target venv/lib/python3.10/site-packages -r requirements-stage2.txt
          fi
          ./scripts/build.sh
          ./scripts/package-mac.sh

      - name: Upload Artifacts
        uses: actions/upload-artifact@v4
        with:
          name: build-result-darwin-${{ matrix.target_arch }}
          path: dist/*.dmg