mirror of
https://github.com/nimbold/Firelink.git
synced 2026-07-26 12:08:27 +00:00
NimBold
7b3d620efa
Gatekeeper enforces Library Validation and prevents `dlopen` of quarantined ad-hoc signed dynamic libraries on ARM64. Because the `_internal` folder was shipped inside the DMG, the user's system flagged it with the com.apple.quarantine attribute, causing the Python shared library to fail to load inside `yt-dlp`. By reverting back to the single-file PyInstaller binary (which is now properly code-signable without corruption on macOS), PyInstaller extracts the `_internal` folder at runtime to `/var/folders/...`. These extracted files do not inherit the quarantine flag, allowing AMFI to successfully load them and completely bypassing the dlopen system policy rejection.
127 lines
4.1 KiB
YAML
127 lines
4.1 KiB
YAML
name: Release
|
|
|
|
on:
|
|
push:
|
|
tags:
|
|
- "v*"
|
|
workflow_dispatch:
|
|
inputs:
|
|
version:
|
|
description: "Release version, for example 0.1.0"
|
|
required: true
|
|
default: "0.1.0"
|
|
|
|
permissions:
|
|
contents: write
|
|
|
|
jobs:
|
|
macos-arm64-dmg:
|
|
name: Build macOS ARM64 DMG
|
|
runs-on: macos-26
|
|
|
|
steps:
|
|
- name: Check out repository
|
|
uses: actions/checkout@v6
|
|
with:
|
|
submodules: recursive
|
|
|
|
- name: Resolve version
|
|
id: version
|
|
shell: bash
|
|
run: |
|
|
if [[ "${GITHUB_REF_TYPE}" == "tag" ]]; then
|
|
VERSION="${GITHUB_REF_NAME#v}"
|
|
TAG_NAME="${GITHUB_REF_NAME}"
|
|
else
|
|
VERSION="${{ inputs.version }}"
|
|
TAG_NAME="v${VERSION}"
|
|
fi
|
|
|
|
echo "version=$VERSION" >> "$GITHUB_OUTPUT"
|
|
echo "tag_name=$TAG_NAME" >> "$GITHUB_OUTPUT"
|
|
echo "Version: $VERSION"
|
|
|
|
- name: Show build environment
|
|
run: |
|
|
uname -a
|
|
swift --version
|
|
xcodebuild -version
|
|
xcode-select -p
|
|
xcrun --sdk macosx --show-sdk-version
|
|
|
|
- name: Verify macOS 26+ SDK
|
|
shell: bash
|
|
run: |
|
|
SDK_VERSION="$(xcrun --sdk macosx --show-sdk-version)"
|
|
SDK_MAJOR="${SDK_VERSION%%.*}"
|
|
|
|
if [[ "$SDK_MAJOR" -lt 26 ]]; then
|
|
echo "Expected at least macOS 26 SDK, got macOS $SDK_VERSION" >&2
|
|
exit 1
|
|
fi
|
|
|
|
- name: Install dependencies
|
|
run: brew install aria2 dylibbundler
|
|
|
|
- name: Fetch media engines
|
|
run: |
|
|
mkdir -p Sources/Firelink
|
|
|
|
# Download the one-file macOS build. PyInstaller on macOS now properly supports code-signing without corrupting the archive.
|
|
curl -fsSL https://github.com/yt-dlp/yt-dlp/releases/latest/download/yt-dlp_macos -o Sources/Firelink/yt-dlp
|
|
chmod +x Sources/Firelink/yt-dlp
|
|
|
|
# Download latest FFmpeg release build for macOS ARM64 from Martin Riedl's build server
|
|
curl -fsSL "https://ffmpeg.martin-riedl.de/redirect/latest/macos/arm64/release/ffmpeg.zip" -o ffmpeg.zip
|
|
unzip -q -o ffmpeg.zip -d Sources/Firelink
|
|
rm ffmpeg.zip
|
|
chmod +x Sources/Firelink/ffmpeg
|
|
test -x Sources/Firelink/yt-dlp
|
|
test -x Sources/Firelink/ffmpeg
|
|
|
|
- name: Build app bundle
|
|
env:
|
|
MARKETING_VERSION: ${{ steps.version.outputs.version }}
|
|
BUILD_NUMBER: ${{ github.run_number }}
|
|
run: Scripts/create_app_bundle.sh
|
|
|
|
- name: Verify ARM64 binary
|
|
run: |
|
|
file build/Firelink.app/Contents/MacOS/Firelink
|
|
lipo -archs build/Firelink.app/Contents/MacOS/Firelink | grep -qx arm64
|
|
codesign --verify --deep build/Firelink.app
|
|
|
|
- name: Create DMG
|
|
env:
|
|
VERSION: ${{ steps.version.outputs.version }}
|
|
ARCH: arm64
|
|
run: Scripts/create_dmg.sh
|
|
|
|
- name: Upload workflow artifact
|
|
uses: actions/upload-artifact@v7
|
|
with:
|
|
name: Firelink-${{ steps.version.outputs.version }}-mac-arm64-dmg
|
|
path: dist/*.dmg
|
|
if-no-files-found: error
|
|
|
|
- name: Publish GitHub release
|
|
if: github.ref_type == 'tag' || github.event_name == 'workflow_dispatch'
|
|
env:
|
|
GH_TOKEN: ${{ github.token }}
|
|
run: |
|
|
VERSION="${{ steps.version.outputs.version }}"
|
|
TAG_NAME="${{ steps.version.outputs.tag_name }}"
|
|
awk '/^## \['"$VERSION"'\]/{flag=1; next} /^## \[/{if(flag) exit} flag' CHANGELOG.md > release_notes.md
|
|
test -s release_notes.md
|
|
|
|
if gh release view "$TAG_NAME" >/dev/null 2>&1; then
|
|
gh release upload "$TAG_NAME" dist/*.dmg --clobber
|
|
gh release edit "$TAG_NAME" --notes-file release_notes.md
|
|
else
|
|
if [[ "${{ github.event_name }}" == "workflow_dispatch" ]]; then
|
|
gh release create "$TAG_NAME" dist/*.dmg --title "$TAG_NAME" --notes-file release_notes.md
|
|
else
|
|
gh release create "$TAG_NAME" dist/*.dmg --title "$TAG_NAME" --notes-file release_notes.md --verify-tag
|
|
fi
|
|
fi
|