84 lines
3.2 KiB
Bash
Executable File
84 lines
3.2 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
|
|
# Install iOS CI signing assets on a GitHub-hosted macOS runner.
|
|
#
|
|
# Usage in GitHub Actions:
|
|
# - name: Install Apple signing assets
|
|
# run: scripts/ios-ci-install-signing-assets.sh
|
|
# env:
|
|
# BUILD_CERTIFICATE_BASE64: ${{ secrets.BUILD_CERTIFICATE_BASE64 }}
|
|
# P12_PASSWORD: ${{ secrets.P12_PASSWORD }}
|
|
# BUILD_PROVISION_PROFILE_BASE64: ${{ secrets.BUILD_PROVISION_PROFILE_BASE64 }}
|
|
# KEYCHAIN_PASSWORD: ${{ secrets.KEYCHAIN_PASSWORD }}
|
|
# IOS_BUNDLE_ID_PREFIX: ${{ vars.IOS_BUNDLE_ID_PREFIX }}
|
|
#
|
|
# The script imports the CI certificate into a temporary keychain, installs the
|
|
# provisioning profile, and writes platform/darwin/bazel/config.bzl so Bazel and
|
|
# rules_xcodeproj use the same team/profile/bundle prefix on ephemeral runners.
|
|
|
|
set -euo pipefail
|
|
|
|
script_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
|
repo_root="$(cd "$script_dir/../../.." && pwd)"
|
|
|
|
require_env() {
|
|
local name="$1"
|
|
if [[ -z "${!name:-}" ]]; then
|
|
echo "::error::$name is required"
|
|
exit 1
|
|
fi
|
|
}
|
|
|
|
decode_base64_to_file() {
|
|
local value="$1"
|
|
local path="$2"
|
|
|
|
if ! printf '%s' "$value" | base64 --decode >"$path" 2>/dev/null; then
|
|
printf '%s' "$value" | base64 -D >"$path"
|
|
fi
|
|
}
|
|
|
|
require_env BUILD_CERTIFICATE_BASE64
|
|
require_env P12_PASSWORD
|
|
require_env BUILD_PROVISION_PROFILE_BASE64
|
|
require_env KEYCHAIN_PASSWORD
|
|
|
|
ios_bundle_id_prefix="${IOS_BUNDLE_ID_PREFIX:-org.maplibre}"
|
|
runner_temp="${RUNNER_TEMP:-$(mktemp -d)}"
|
|
|
|
certificate_path="$runner_temp/ios-ci-certificate.p12"
|
|
profile_path="$runner_temp/ios-ci-profile.mobileprovision"
|
|
profile_plist_path="$runner_temp/ios-ci-profile.plist"
|
|
keychain_path="$runner_temp/ios-ci-signing.keychain-db"
|
|
profiles_dir="$HOME/Library/MobileDevice/Provisioning Profiles"
|
|
|
|
decode_base64_to_file "$BUILD_CERTIFICATE_BASE64" "$certificate_path"
|
|
decode_base64_to_file "$BUILD_PROVISION_PROFILE_BASE64" "$profile_path"
|
|
|
|
security create-keychain -p "$KEYCHAIN_PASSWORD" "$keychain_path"
|
|
security set-keychain-settings -lut 21600 "$keychain_path"
|
|
security unlock-keychain -p "$KEYCHAIN_PASSWORD" "$keychain_path"
|
|
security import "$certificate_path" -P "$P12_PASSWORD" -A -t cert -f pkcs12 -k "$keychain_path"
|
|
security set-key-partition-list -S apple-tool:,apple: -k "$KEYCHAIN_PASSWORD" "$keychain_path"
|
|
security list-keychain -d user -s "$keychain_path"
|
|
|
|
mkdir -p "$profiles_dir"
|
|
security cms -D -i "$profile_path" >"$profile_plist_path"
|
|
|
|
profile_uuid="$(/usr/libexec/PlistBuddy -c 'Print UUID' "$profile_plist_path")"
|
|
profile_name="$(/usr/libexec/PlistBuddy -c 'Print Name' "$profile_plist_path")"
|
|
team_id="$(/usr/libexec/PlistBuddy -c 'Print TeamIdentifier:0' "$profile_plist_path")"
|
|
|
|
cp "$profile_path" "$profiles_dir/$profile_uuid.mobileprovision"
|
|
|
|
cat >"$repo_root/platform/darwin/bazel/config.bzl" <<CONFIG
|
|
# Generated by platform/ios/scripts/ios-ci-install-signing-assets.sh.
|
|
APPLE_MOBILE_PROVISIONING_PROFILE_TEAM_ID = "$team_id"
|
|
APPLE_MOBILE_PROVISIONING_PROFILE_NAME = "$profile_name"
|
|
BUNDLE_ID_PREFIX = "$ios_bundle_id_prefix"
|
|
API_KEY = "0000000000"
|
|
CONFIG
|
|
|
|
echo "Installed provisioning profile '$profile_name' for team '$team_id'."
|
|
echo "Generated platform/darwin/bazel/config.bzl with bundle ID prefix '$ios_bundle_id_prefix'."
|