381 lines
12 KiB
YAML
381 lines
12 KiB
YAML
name: Template Builds
|
|
|
|
on:
|
|
pull_request:
|
|
paths:
|
|
- ".github/workflows/monthly.yml"
|
|
- ".github/workflows/release.yml"
|
|
- ".github/workflows/template-validation.yml"
|
|
- "data/**"
|
|
- "scripts/**"
|
|
- "templates/**"
|
|
|
|
permissions:
|
|
contents: read
|
|
packages: read
|
|
|
|
concurrency:
|
|
group: template-builds-${{ github.event.pull_request.number || github.ref }}
|
|
cancel-in-progress: true
|
|
|
|
env:
|
|
FASTLANE_SESSION: ${{ secrets.FASTLANE_SESSION }}
|
|
FASTLANE_USER: ${{ secrets.FASTLANE_USER }}
|
|
HOMEBREW_NO_AUTO_UPDATE: 1
|
|
HOMEBREW_NO_INSTALL_CLEANUP: 1
|
|
PACKER_GITHUB_API_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
|
TART_REGISTRY_HOSTNAME: ghcr.io
|
|
TART_REGISTRY_USERNAME: ${{ github.actor }}
|
|
TART_REGISTRY_PASSWORD: ${{ secrets.GITHUB_TOKEN }}
|
|
|
|
jobs:
|
|
packer-validate:
|
|
name: Packer Validate
|
|
runs-on: macos-15
|
|
timeout-minutes: 30
|
|
|
|
steps:
|
|
- name: Checkout
|
|
uses: actions/checkout@v4
|
|
|
|
- name: Setup Packer
|
|
uses: hashicorp/setup-packer@v3
|
|
|
|
- name: Install validation dependencies
|
|
run: |
|
|
brew install ansible
|
|
|
|
- name: Prepare validation inputs
|
|
run: |
|
|
mkdir -p "$HOME/XcodesCache"
|
|
touch "$HOME/XcodesCache/Xcode_26.6.xip"
|
|
|
|
- name: Validate templates
|
|
run: |
|
|
set -euo pipefail
|
|
|
|
validate() {
|
|
local template="$1"
|
|
shift
|
|
|
|
packer init "$template"
|
|
packer validate "$@" "$template"
|
|
}
|
|
|
|
for template in templates/vanilla-*.pkr.hcl; do
|
|
validate "$template"
|
|
done
|
|
|
|
validate templates/base.pkr.hcl \
|
|
-var vm_name=template-validation-base
|
|
|
|
validate templates/disable-sip.pkr.hcl \
|
|
-var vm_name=template-validation-disable-sip
|
|
|
|
validate templates/disable-sip-with-username.pkr.hcl \
|
|
-var vm_name=template-validation-disable-sip-user
|
|
|
|
validate templates/exex-script.pkr.hcl \
|
|
-var vm_name=template-validation-exec \
|
|
-var script_path=scripts/finalize-tahoe.sh
|
|
|
|
validate templates/resolve-macos-number.pkr.hcl \
|
|
-var vm_base_name=template-validation-base \
|
|
-var vm_name=template-validation-resolve \
|
|
-var resolve_file=macos-version.txt
|
|
|
|
validate templates/xcode.pkr.hcl \
|
|
-var macos_version=tahoe \
|
|
-var 'xcode_version=["26.6"]' \
|
|
-var expected_runtimes_file=data/expected.tahoe.runtimes.txt
|
|
|
|
build-vanilla:
|
|
name: Build Vanilla Image (${{ matrix.macos_version }})
|
|
needs: packer-validate
|
|
if: github.event.pull_request.head.repo.full_name == github.repository
|
|
runs-on: [self-hosted, macOS, ARM64]
|
|
timeout-minutes: 180
|
|
strategy:
|
|
fail-fast: false
|
|
max-parallel: 1
|
|
matrix:
|
|
macos_version:
|
|
- tahoe
|
|
- sequoia
|
|
- sonoma
|
|
- monterey
|
|
env:
|
|
MACOS_VERSION: ${{ matrix.macos_version }}
|
|
|
|
steps:
|
|
- name: Checkout
|
|
uses: actions/checkout@v4
|
|
with:
|
|
fetch-depth: 0
|
|
|
|
- name: Select image
|
|
id: select
|
|
env:
|
|
BASE_SHA: ${{ github.event.pull_request.base.sha }}
|
|
HEAD_SHA: ${{ github.event.pull_request.head.sha }}
|
|
run: |
|
|
set -euo pipefail
|
|
|
|
git diff --name-only "$BASE_SHA" "$HEAD_SHA" > changed-files.txt
|
|
|
|
build=false
|
|
if grep -Fxq "templates/vanilla-$MACOS_VERSION.pkr.hcl" changed-files.txt; then
|
|
build=true
|
|
fi
|
|
|
|
echo "build=$build" >> "$GITHUB_OUTPUT"
|
|
|
|
- name: Tool versions
|
|
if: steps.select.outputs.build == 'true'
|
|
run: |
|
|
tart --version
|
|
packer --version
|
|
|
|
- name: Build vanilla image
|
|
if: steps.select.outputs.build == 'true'
|
|
run: |
|
|
packer init "templates/vanilla-$MACOS_VERSION.pkr.hcl"
|
|
packer build "templates/vanilla-$MACOS_VERSION.pkr.hcl"
|
|
|
|
- name: Cleanup
|
|
if: always() && steps.select.outputs.build == 'true'
|
|
run: |
|
|
tart delete "$MACOS_VERSION-vanilla" || true
|
|
|
|
build-base:
|
|
name: Build Base Image (${{ matrix.macos_version }})
|
|
needs: packer-validate
|
|
if: github.event.pull_request.head.repo.full_name == github.repository
|
|
runs-on: [self-hosted, macOS, ARM64]
|
|
timeout-minutes: 180
|
|
strategy:
|
|
fail-fast: false
|
|
max-parallel: 1
|
|
matrix:
|
|
include:
|
|
- macos_version: sonoma
|
|
disable_sip_template: disable-sip.pkr.hcl
|
|
- macos_version: sequoia
|
|
disable_sip_template: disable-sip-with-username.pkr.hcl
|
|
- macos_version: tahoe
|
|
disable_sip_template: disable-sip-with-username.pkr.hcl
|
|
env:
|
|
DISABLE_SIP_TEMPLATE: ${{ matrix.disable_sip_template }}
|
|
MACOS_VERSION: ${{ matrix.macos_version }}
|
|
|
|
steps:
|
|
- name: Checkout
|
|
uses: actions/checkout@v4
|
|
with:
|
|
fetch-depth: 0
|
|
|
|
- name: Select image
|
|
id: select
|
|
env:
|
|
BASE_SHA: ${{ github.event.pull_request.base.sha }}
|
|
HEAD_SHA: ${{ github.event.pull_request.head.sha }}
|
|
run: |
|
|
set -euo pipefail
|
|
|
|
git diff --name-only "$BASE_SHA" "$HEAD_SHA" > changed-files.txt
|
|
|
|
build=false
|
|
if grep -Eq '^(templates/base\.pkr\.hcl|templates/disable-sip.*\.pkr\.hcl|data/(github_known_hosts|limit\.maxfiles\.plist|setup-info-template\.json|tart-guest-.*\.plist)|scripts/(install-actions-runner|update-tcc-database)\.sh|ansible/)' changed-files.txt; then
|
|
build=true
|
|
fi
|
|
|
|
echo "build=$build" >> "$GITHUB_OUTPUT"
|
|
|
|
- name: Tool versions
|
|
if: steps.select.outputs.build == 'true'
|
|
run: |
|
|
tart --version
|
|
packer --version
|
|
|
|
- name: Pull vanilla image
|
|
if: steps.select.outputs.build == 'true'
|
|
run: |
|
|
tart pull "ghcr.io/cirruslabs/macos-$MACOS_VERSION-vanilla:latest"
|
|
tart clone "ghcr.io/cirruslabs/macos-$MACOS_VERSION-vanilla:latest" "$MACOS_VERSION-base"
|
|
|
|
- name: Disable SIP
|
|
if: steps.select.outputs.build == 'true'
|
|
run: |
|
|
packer init "templates/$DISABLE_SIP_TEMPLATE"
|
|
packer build -var "vm_name=$MACOS_VERSION-base" "templates/$DISABLE_SIP_TEMPLATE"
|
|
|
|
- name: Build base image
|
|
if: steps.select.outputs.build == 'true'
|
|
run: |
|
|
packer init templates/base.pkr.hcl
|
|
packer build -var "vm_name=$MACOS_VERSION-base" templates/base.pkr.hcl
|
|
|
|
- name: Cleanup
|
|
if: always() && steps.select.outputs.build == 'true'
|
|
run: |
|
|
tart delete "$MACOS_VERSION-base" || true
|
|
|
|
build-runner:
|
|
name: Build Runner Image (${{ matrix.macos_version }})
|
|
needs: packer-validate
|
|
if: github.event.pull_request.head.repo.full_name == github.repository
|
|
runs-on: [self-hosted, macOS, ARM64]
|
|
timeout-minutes: 180
|
|
strategy:
|
|
fail-fast: false
|
|
max-parallel: 1
|
|
matrix:
|
|
include:
|
|
- macos_version: tahoe
|
|
xcode_versions: '"26.6","27-beta-2","26.5","27-beta","26.4.1","26.3","26.2","26.1.1","26.0.1"'
|
|
additional_ios_builds: "18.6"
|
|
additional_tvos_builds: ""
|
|
xcode_components: '"MetalToolchain"'
|
|
disk_size: 520
|
|
- macos_version: sequoia
|
|
xcode_versions: '"26.0.1",16.4,16.3,16.2,16.1,16'
|
|
additional_ios_builds: "18.5,18.4,18.2,17.5"
|
|
additional_tvos_builds: "17.5"
|
|
xcode_components: '"MetalToolchain"'
|
|
disk_size: 380
|
|
env:
|
|
ADDITIONAL_IOS_BUILDS: ${{ matrix.additional_ios_builds }}
|
|
ADDITIONAL_TVOS_BUILDS: ${{ matrix.additional_tvos_builds }}
|
|
DISK_SIZE: ${{ matrix.disk_size }}
|
|
MACOS_VERSION: ${{ matrix.macos_version }}
|
|
XCODE_COMPONENTS: ${{ matrix.xcode_components }}
|
|
XCODE_VERSIONS: ${{ matrix.xcode_versions }}
|
|
|
|
steps:
|
|
- name: Checkout
|
|
uses: actions/checkout@v4
|
|
with:
|
|
fetch-depth: 0
|
|
|
|
- name: Select image
|
|
id: select
|
|
env:
|
|
BASE_SHA: ${{ github.event.pull_request.base.sha }}
|
|
HEAD_SHA: ${{ github.event.pull_request.head.sha }}
|
|
run: |
|
|
set -euo pipefail
|
|
|
|
git diff --name-only "$BASE_SHA" "$HEAD_SHA" > changed-files.txt
|
|
|
|
build=false
|
|
if grep -Fxq ".github/workflows/release.yml" changed-files.txt; then
|
|
build=true
|
|
elif grep -Fxq "data/expected.$MACOS_VERSION.runtimes.txt" changed-files.txt; then
|
|
build=true
|
|
elif grep -Fxq "scripts/finalize-$MACOS_VERSION.sh" changed-files.txt; then
|
|
build=true
|
|
elif grep -Eq '^(templates/xcode\.pkr\.hcl|data/setup-info-template\.json|scripts/install-actions-runner\.sh)$' changed-files.txt; then
|
|
build=true
|
|
fi
|
|
|
|
echo "build=$build" >> "$GITHUB_OUTPUT"
|
|
|
|
- name: Tool versions
|
|
if: steps.select.outputs.build == 'true'
|
|
run: |
|
|
tart --version
|
|
packer --version
|
|
|
|
- name: Pull base image
|
|
if: steps.select.outputs.build == 'true'
|
|
run: |
|
|
tart pull "ghcr.io/cirruslabs/macos-$MACOS_VERSION-base:latest"
|
|
|
|
- name: Prepare Xcode archives
|
|
if: steps.select.outputs.build == 'true'
|
|
run: |
|
|
set -euo pipefail
|
|
|
|
source ~/.zprofile || true
|
|
|
|
if ! command -v xcodes >/dev/null; then
|
|
brew install xcodes
|
|
fi
|
|
|
|
mkdir -p "$HOME/XcodesCache"
|
|
IFS=',' read -ra versions <<< "$XCODE_VERSIONS"
|
|
|
|
for raw_version in "${versions[@]}"; do
|
|
version="${raw_version//\"/}"
|
|
target="$HOME/XcodesCache/Xcode_${version}.xip"
|
|
|
|
if [[ -f "$target" ]]; then
|
|
echo "Using cached Xcode $version at $target"
|
|
continue
|
|
fi
|
|
|
|
echo "Downloading Xcode $version"
|
|
if [[ -z "${FASTLANE_SESSION:-}" ]]; then
|
|
echo "::error::Missing $target and FASTLANE_SESSION is not configured. Pre-cache the Xcode archive on the runner or add Apple Developer auth secrets."
|
|
exit 1
|
|
fi
|
|
|
|
download_args=(download "$version" --directory "$HOME/XcodesCache" --use-fastlane-auth)
|
|
if [[ -n "${FASTLANE_USER:-}" ]]; then
|
|
download_args+=(--fastlane-user "$FASTLANE_USER")
|
|
fi
|
|
xcodes "${download_args[@]}"
|
|
|
|
candidate=""
|
|
case "$version" in
|
|
27-beta-2)
|
|
candidate="$HOME/XcodesCache/Xcode_27_beta_2.xip"
|
|
;;
|
|
27-beta)
|
|
candidate="$HOME/XcodesCache/Xcode_27_beta.xip"
|
|
;;
|
|
*)
|
|
candidate="$(find "$HOME/XcodesCache" -maxdepth 1 -type f -name "Xcode_${version}*.xip" -print -quit)"
|
|
;;
|
|
esac
|
|
|
|
if [[ -n "$candidate" && -f "$candidate" && "$candidate" != "$target" ]]; then
|
|
mv "$candidate" "$target"
|
|
fi
|
|
|
|
test -f "$target"
|
|
done
|
|
|
|
- name: Build runner image
|
|
if: steps.select.outputs.build == 'true'
|
|
run: |
|
|
packer init templates/xcode.pkr.hcl
|
|
packer build \
|
|
-var tag=runner \
|
|
-var "disk_size=$DISK_SIZE" \
|
|
-var disk_free_mb=100000 \
|
|
-var "macos_version=$MACOS_VERSION" \
|
|
-var "xcode_version=[$XCODE_VERSIONS]" \
|
|
-var "additional_ios_builds=[$ADDITIONAL_IOS_BUILDS]" \
|
|
-var "additional_tvos_builds=[$ADDITIONAL_TVOS_BUILDS]" \
|
|
-var "xcode_components=[$XCODE_COMPONENTS]" \
|
|
-var "expected_runtimes_file=data/expected.$MACOS_VERSION.runtimes.txt" \
|
|
templates/xcode.pkr.hcl
|
|
|
|
- name: Finalize runner image
|
|
if: steps.select.outputs.build == 'true'
|
|
run: |
|
|
if [[ -f "scripts/finalize-$MACOS_VERSION.sh" ]]; then
|
|
packer build \
|
|
-var "vm_name=$MACOS_VERSION-xcode:runner" \
|
|
-var "script_path=scripts/finalize-$MACOS_VERSION.sh" \
|
|
templates/exex-script.pkr.hcl
|
|
else
|
|
echo "Skipping prepare script for $MACOS_VERSION"
|
|
fi
|
|
|
|
- name: Cleanup
|
|
if: always() && steps.select.outputs.build == 'true'
|
|
run: |
|
|
tart delete "$MACOS_VERSION-xcode:runner" || true
|