name: Build Release Binaries (new)
on:
pull_request:
types: [closed]
branches:
- main
workflow_call:
inputs:
version:
description: Version to publish (e.g., 1.2.1-experimental.1)
required: true
type: string
features:
description: Cargo features (comma-separated, e.g., apps)
required: false
type: string
ref:
description: Git ref to use for the built artifacts
required: false
type: string
defaults:
run:
# necessary for windows
shell: bash
jobs:
get-version:
# Run on PR merge (original) or workflow_call (experimental)
if: (github.event.pull_request.merged == true && github.event.pull_request.head.ref == 'release') || inputs.version
runs-on: ubuntu-latest
outputs:
version: ${{ steps.store-version.outputs.version }}
steps:
- uses: actions/checkout@v6
with:
ref: ${{ inputs.ref || github.ref }}
- uses: knope-dev/action@v2.1.0
if: ${{ !inputs.version }}
with:
version: 0.21.7
- name: Store version
id: store-version
run: |
if [ -n "${{ inputs.version }}" ]; then
echo "version=${{ inputs.version }}" >> $GITHUB_OUTPUT
else
echo "version=$(knope get-version)" >> $GITHUB_OUTPUT
fi
build-artifacts:
needs: [get-version]
strategy:
matrix:
include:
- target: aarch64-apple-darwin
os: macos-latest
- target: aarch64-pc-windows-msvc
os: windows-11-arm
- target: aarch64-unknown-linux-gnu
os: ubuntu-24.04-arm
- target: aarch64-unknown-linux-musl
os: ubuntu-24.04-arm
- target: x86_64-apple-darwin
os: macos-15-intel
- target: x86_64-pc-windows-msvc
os: windows-latest
- target: x86_64-unknown-linux-gnu
os: ubuntu-latest
- target: x86_64-unknown-linux-musl
os: ubuntu-latest
runs-on: ${{ matrix.os }}
name: ${{ matrix.target }}
permissions:
contents: write
packages: write
attestations: write
id-token: write
env:
archive_name: artifact
package_name: apollo-mcp-server
steps:
- uses: actions/checkout@v6
with:
ref: ${{ inputs.ref || github.ref }}
- uses: actions-rust-lang/setup-rust-toolchain@v1
with:
target: ${{ matrix.target }}
- name: Install musl tools (Linux)
if: runner.os == 'Linux' && contains(matrix.target, 'musl')
run: |
sudo apt-get update
sudo apt-get install -y musl-tools
- name: Configure linker for musl (aarch64)
if: matrix.target == 'aarch64-unknown-linux-musl'
run: |
mkdir -p .cargo
cat >> .cargo/config.toml << EOF
[target.aarch64-unknown-linux-musl]
linker = "musl-gcc"
EOF
- name: Configure linker for musl (x86_64)
if: matrix.target == 'x86_64-unknown-linux-musl'
run: |
mkdir -p .cargo
cat >> .cargo/config.toml << EOF
[target.x86_64-unknown-linux-musl]
linker = "musl-gcc"
EOF
- name: Build
run: cargo build --release --target ${{ matrix.target }} ${{ inputs.features && format('--features {0}', inputs.features) || '' }}
- name: Sign Apple Binary
if: runner.os == 'macOS'
run: |
MACOS_CERT_BUNDLE_PASSWORD=${{ secrets.MACOS_CERT_BUNDLE_PASSWORD }}
MACOS_CERT_BUNDLE_BASE64=${{ secrets.MACOS_CERT_BUNDLE_BASE64 }}
MACOS_KEYCHAIN_PASSWORD=${{ secrets.MACOS_KEYCHAIN_PASSWORD }}
MACOS_NOTARIZATION_PASSWORD=${{ secrets.APPLE_NOTARIZATION_PASSWORD }}
APPLE_TEAM_ID=${{ secrets.APPLE_TEAM_ID }}
APPLE_USERNAME=${{ secrets.APPLE_USERNAME }}
echo "Pre-check: Valid Codesigning Identify"
security find-identity -v -p codesigning
echo "Pre-check: Codesigning Identify"
security find-identity -p codesigning
echo "Pre-check: Any Identify"
security find-identity
echo "|||||||||||||||||||||||||||||||||||||||||||||"
VERSION=${{ needs.get-version.outputs.version }}
BINARY_PATH=target/${{ matrix.target }}/release/${{ env.package_name }}
ENTITLEMENTS_PATH="macos-entitlements.plist"
# Create a temporary keychain
KEYCHAIN_NAME="${{ env.package_name }}-keychain"
mkdir $KEYCHAIN_NAME
echo "Creating keychain..."
security create-keychain -p "${MACOS_KEYCHAIN_PASSWORD}" $KEYCHAIN_NAME
echo "Removing relock timeout on keychain..."
security set-keychain-settings $KEYCHAIN_NAME
echo "Decoding certificate bundle..."
echo "${MACOS_CERT_BUNDLE_BASE64}" | base64 --decode > $KEYCHAIN_NAME/certificate.p12
echo "Importing codesigning certificate to build keychain..."
security import $KEYCHAIN_NAME/certificate.p12 -k $KEYCHAIN_NAME -P "${MACOS_CERT_BUNDLE_PASSWORD}" -T /usr/bin/codesign
echo "Adding the codesign tool to the security partition-list..."
security set-key-partition-list -S "apple-tool:,apple:,codesign:" -s -k "${MACOS_KEYCHAIN_PASSWORD}" $KEYCHAIN_NAME
echo "Setting default keychain..."
security default-keychain -d user -s $KEYCHAIN_NAME
echo "Unlocking keychain..."
security unlock-keychain -p "${MACOS_KEYCHAIN_PASSWORD}" $KEYCHAIN_NAME
echo "Verifying keychain is set up correctly..."
security find-identity -v -p codesigning
echo "|||||||||||||||||||||||||||||||||||||||||||||"
echo "Post-check: Valid Codesigning Identify"
security find-identity -v -p codesigning
echo "Post-check: Codesigning Identify"
security find-identity -p codesigning
echo "Post-check: Any Identify"
security find-identity
echo "|||||||||||||||||||||||||||||||||||||||||||||"
# Sign the binary
echo "Signing code (step 1 of 2)..."
codesign --sign "$APPLE_TEAM_ID" --options runtime --entitlements $ENTITLEMENTS_PATH --force --timestamp "$BINARY_PATH" -v
echo "Signing code (step 2 of 2)..."
codesign -vvv --deep --strict "$BINARY_PATH"
echo "Zipping dist..."
mkdir "$KEYCHAIN_NAME/dist"
cp "$BINARY_PATH" "$KEYCHAIN_NAME/dist/${{ env.package_name }}"
zip -r "$KEYCHAIN_NAME/${{ env.package_name }}-$VERSION.zip" "$KEYCHAIN_NAME/dist"
echo "Beginning notarization process..."
xcrun notarytool submit "$KEYCHAIN_NAME/${{ env.package_name }}-$VERSION.zip" --apple-id "$APPLE_USERNAME" --password "$MACOS_NOTARIZATION_PASSWORD" --team-id "$APPLE_TEAM_ID" --wait --timeout 20m
- name: Create Archive Folder
run: mkdir ${{ env.archive_name }}
- name: Copy Unix Artifact
if: runner.os != 'Windows'
run: cp target/${{ matrix.target }}/release/${{ env.package_name }} ${{ env.archive_name }}
- name: Copy Windows Artifact
if: runner.os == 'Windows'
run: cp target/${{ matrix.target }}/release/${{ env.package_name }}.exe ${{ env.archive_name }}
- name: Create Tar Archive
run: tar -czf ${{ env.package_name }}-${{ needs.get-version.outputs.version }}-${{ matrix.target }}.tgz ${{ env.archive_name }}
- name: Upload Artifact
uses: actions/upload-artifact@v4.4.0
with:
name: ${{ matrix.target }}
path: ${{ env.package_name }}-${{ needs.get-version.outputs.version }}-${{ matrix.target }}.tgz
if-no-files-found: error
generate-config-schema:
# Run on PR merge (original) or workflow_call (experimental)
if: (github.event.pull_request.merged == true && github.event.pull_request.head.ref == 'release') || inputs.version
runs-on: ubuntu-latest
permissions:
contents: write
packages: write
attestations: write
id-token: write
env:
archive_name: artifact
package_name: apollo-mcp-server
steps:
- uses: actions/checkout@v6
with:
ref: ${{ inputs.ref || github.ref }}
- uses: actions-rust-lang/setup-rust-toolchain@v1
- name: Create Archive Folder
run: mkdir ${{ env.archive_name }}
- name: Generate config schema
run: cargo run -p apollo-mcp-server --bin config-schema > ${{ env.archive_name }}/config.schema.json
- name: Upload Artifact
uses: actions/upload-artifact@v4.4.0
with:
name: "config-schema"
path: ${{ env.archive_name }}/config.schema.json
if-no-files-found: error
release:
needs: [build-artifacts, generate-config-schema]
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v6
with:
ref: ${{ inputs.ref || github.ref }}
- uses: actions/download-artifact@v4.1.8
with:
path: artifacts
merge-multiple: true
- name: Configure Git
run: |
git config --global user.name GitHub Actions
git config user.email github-actions@github.com
- uses: knope-dev/action@v2.1.0
with:
version: 0.21.7
- run: knope release
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
