name: pull request

on:

push:

branches:

- master

tags:

- '*'

pull_request:

concurrency:

group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.run_id }}

cancel-in-progress: ${{ !contains(github.event.pull_request.labels.*.name, 'pipeline') }}

env:

# Commit the screenshot UI tests check out as the repo they browse.

FIXTURE_COMMIT: 52ff1051d0c8e5cf3ee5

jobs:

build-gitx:

name: build

env:

variableSet: ${{ secrets.BUILD_CERTIFICATE_BASE64 }}

runs-on: ${{ matrix.os }}

strategy:

fail-fast: false

matrix:

include:

- xcode: 26.3

os: macos-15-intel

abi: x86_64

- xcode: 27.0

os: xcode-27

abi: arm64

steps:

- name: ls Xcode

run: ls -la /Applications/Xcode*

- name: Checkout

uses: actions/checkout@v7

with:

fetch-depth: 0

submodules: recursive

- uses: maxim-lobanov/setup-xcode@v1

with:

xcode-version: ${{ matrix.xcode }}

- name: Install the Apple certificate and provisioning profile

if: ${{ env.variableSet != '' }}

env:

BUILD_CERTIFICATE_BASE64: ${{ secrets.BUILD_CERTIFICATE_BASE64 }}

P12_PASSWORD: ${{ secrets.P12_PASSWORD }}

BUILD_PROVISION_PROFILE_BASE64: ${{ secrets.BUILD_PROVISION_PROFILE_BASE64 }}

KEYCHAIN_PASSWORD: ${{ secrets.KEYCHAIN_PASSWORD }}

run: |

# create variables

CERTIFICATE_PATH=$RUNNER_TEMP/build_certificate.p12

PP_PATH=$RUNNER_TEMP/build_pp.provisionprofile

KEYCHAIN_PATH=$RUNNER_TEMP/app-signing.keychain-db

# import certificate and provisioning profile from secrets

echo -n "$BUILD_CERTIFICATE_BASE64" | base64 --decode -o $CERTIFICATE_PATH

echo -n "$BUILD_PROVISION_PROFILE_BASE64" | base64 --decode -o $PP_PATH

# create temporary keychain

security create-keychain -p "$KEYCHAIN_PASSWORD" $KEYCHAIN_PATH

security set-keychain-settings -lut 21600 $KEYCHAIN_PATH

security unlock-keychain -p "$KEYCHAIN_PASSWORD" $KEYCHAIN_PATH

# import certificate to keychain

security import $CERTIFICATE_PATH -P "$P12_PASSWORD" -A -t cert -f pkcs12 -k $KEYCHAIN_PATH

security list-keychain -d user -s $KEYCHAIN_PATH

# apply provisioning profile

mkdir -p ~/Library/MobileDevice/Provisioning\ Profiles

cp $PP_PATH ~/Library/MobileDevice/Provisioning\ Profiles

- name: Show openssl version

run: |

openssl version

# Fully remove any pre-existing [email protected]/openssl@3 kegs/config

# first so the reinstall below has a clean slate. Otherwise

# `brew install` finds leftover files at the link destination (etc

# config, opt symlink, Cellar keg) and prints noisy "have not been

# removed!" / "overwritten during the `brew link` step" warnings.

#

# Deliberately leave the bare "openssl" formula alone: Homebrew now

# aliases it to openssl@4, which curl (and brew's own bottle

# downloads) link against. Uninstalling it deletes that keg and

# breaks curl's dyld lookup for libssl.4.dylib, taking down every

# later `brew` command on this runner.

brew uninstall --ignore-dependencies --force [email protected] openssl@3 || true

rm -rf /usr/local/etc/[email protected] /usr/local/etc/openssl@3

rm -rf /usr/local/opt/[email protected] /usr/local/opt/openssl@3

rm -rf /usr/local/Cellar/[email protected] /usr/local/Cellar/openssl@3

rm -rf /opt/homebrew/etc/[email protected] /opt/homebrew/etc/openssl@3

rm -rf /opt/homebrew/opt/[email protected] /opt/homebrew/opt/openssl@3

rm -rf /opt/homebrew/Cellar/[email protected] /opt/homebrew/Cellar/openssl@3

brew cleanup --prune-prefix

brew install openssl@3

brew link --force --overwrite openssl@3

openssl version

- name: pre build

run: make deps

- name: Show openssl version

run: |

openssl version

- name: Unlink openssl 3

run: |

brew unlink openssl@3

# The unit tests need no signing, no screenshot repo and no network, so

# unlike the screenshot pipeline below they can run on every build

- name: Run unit tests

id: run-unit-tests

if: ${{ matrix.abi == 'arm64' }}

run: |

make unit-test \

ARCH=${{ matrix.abi }} \

RESULT_BUNDLE=UnitTestResults-${{ matrix.abi }}.xcresult

- name: Upload unit test results

if: ${{ failure() && steps.run-unit-tests.outcome == 'failure' && matrix.abi == 'arm64' }}

uses: actions/upload-artifact@v7

with:

name: UnitTestResults-${{ matrix.abi }}.xcresult

path: UnitTestResults-${{ matrix.abi }}.xcresult

retention-days: ${{ github.event_name == 'pull_request' && 7 || 90 }}

# Test (only on arm64 to avoid tripling CI time)

- name: Prepare screenshot comparison

if: ${{ env.variableSet != '' && matrix.abi == 'arm64' && github.event_name == 'pull_request' }}

run: brew install exiftool imagemagick

- name: Checkout fixed repo snapshot for screenshots

if: ${{ env.variableSet != '' && matrix.abi == 'arm64' && github.event_name == 'pull_request' }}

run: |

git clone --no-checkout --no-tags "$GITHUB_WORKSPACE" /tmp/gitx-screenshot-repo

cd /tmp/gitx-screenshot-repo

git checkout -B screenshot-fixture ${{ env.FIXTURE_COMMIT }}

# The history view runs with the All filter and the status bar counts

# every commit reachable from any ref, so what the screenshots show

# depends on which refs this clone carries and not just on

# FIXTURE_COMMIT. The clone inherits the workspace's refs, which

# include the PR merge commit and therefore all of master, so it

# changes on every merge. Drop everything but the fixture branch to

# make the fixture a pure function of the pinned commit, which is

# what lets a baseline built against it stay valid in the cache.

git for-each-ref --format='%(refname)' refs/heads refs/remotes refs/tags \

| grep -vx refs/heads/screenshot-fixture \

| while read -r ref; do git update-ref -d "$ref"; done

# The baseline is built fresh from the PR's base commit rather than

# compared against PNGs committed to this repo: a committed baseline only

# matches the commit it was captured from and drifts on every unrelated

# merge to master, so PRs went red for changes they didn't make. Building

# it from the base commit against the same fixture as the PR build makes

# the comparison answer "did this PR change the UI", and the cache below

# means this costs a real build once per (base commit, fixture, arch),

# shared by every PR sitting on that base.

# github.event.pull_request.base.sha is master as GitHub recorded it when

# the pull request last changed base, not the base branch's current head,

# so it can sit several merges behind. The checkout is refs/pull/N/merge,

# whose first parent is the commit the merge was actually computed

# against, which is what the comparison has to be against.

- name: Resolve the baseline commit

id: baseline-ref

if: ${{ env.variableSet != '' && matrix.abi == 'arm64' && github.event_name == 'pull_request' }}

run: |

sha=$(git rev-parse HEAD^1)

echo "sha=$sha" >> "$GITHUB_OUTPUT"

echo "baseline commit: $sha"

echo "payload base.sha: ${{ github.event.pull_request.base.sha }}"

# About half of recent merges touch neither Classes/ nor Resources/ - CI

# config, Makefile, test wiring, submodule bumps - and for those the

# comparison can only ever report "no change". Skip the baseline build

# for them rather than spending a second full build to prove a negative.

- name: Check whether this PR can affect the UI

id: ui-paths

if: ${{ env.variableSet != '' && matrix.abi == 'arm64' && github.event_name == 'pull_request' }}

run: |

changed=$(git diff --name-only \

${{ steps.baseline-ref.outputs.sha }}...HEAD \

-- Classes Resources GitXUITests GitX.xcodeproj GitX.xcconfig External)

if [ -n "$changed" ]; then

echo "changed=true" >> "$GITHUB_OUTPUT"

echo "UI-relevant paths changed:"

echo "$changed"

else

echo "changed=false" >> "$GITHUB_OUTPUT"

echo "No UI-relevant paths changed; skipping the screenshot baseline."

fi

- name: Cache baseline screenshots

id: baseline-cache

if: ${{ env.variableSet != '' && matrix.abi == 'arm64' && github.event_name == 'pull_request' && steps.ui-paths.outputs.changed == 'true' }}

uses: actions/cache@v6

with:

path: scripts/baseline-screenshots-${{ matrix.abi }}

key: baseline-screenshots-${{ steps.baseline-ref.outputs.sha }}-${{ env.FIXTURE_COMMIT }}-${{ matrix.abi }}

- name: Checkout baseline commit

if: ${{ env.variableSet != '' && matrix.abi == 'arm64' && github.event_name == 'pull_request' && steps.ui-paths.outputs.changed == 'true' && steps.baseline-cache.outputs.cache-hit != 'true' }}

run: |

# .gitmodules pins submodules via [email protected]: SSH URLs, which the

# runner has no key for. All of them are public repos, so rewrite to

# HTTPS (anonymous, no auth needed) before recursing into them.

git config --global url."https://github.com/".insteadOf "[email protected]:"

# A SHA cannot be cloned with --branch, and the submodule revisions

# have to follow the checkout rather than the clone's default HEAD.

git clone --no-checkout "$GITHUB_WORKSPACE" /tmp/gitx-baseline

git -C /tmp/gitx-baseline checkout --detach ${{ steps.baseline-ref.outputs.sha }}

git -C /tmp/gitx-baseline submodule update --init --recursive

- name: Build baseline and run its UI tests

id: baseline-tests

# A baseline build failure (e.g. the base commit no longer builds on a

# newer Xcode) should skip the comparison, not fail every PR for an

# unrelated reason.

continue-on-error: true

if: ${{ env.variableSet != '' && matrix.abi == 'arm64' && github.event_name == 'pull_request' && steps.ui-paths.outputs.changed == 'true' && steps.baseline-cache.outputs.cache-hit != 'true' }}

working-directory: /tmp/gitx-baseline

run: |

make deps

brew unlink openssl@3 || true

make ui-test \

ARCH=${{ matrix.abi }} \

GITX_SCREENSHOT_REPO=/tmp/gitx-screenshot-repo \

RESULT_BUNDLE=BaselineTestResults-${{ matrix.abi }}.xcresult

- name: Extract baseline screenshots

if: ${{ env.variableSet != '' && matrix.abi == 'arm64' && github.event_name == 'pull_request' && steps.ui-paths.outputs.changed == 'true' && steps.baseline-cache.outputs.cache-hit != 'true' && steps.baseline-tests.outcome == 'success' }}

run: |

python3 /tmp/gitx-baseline/scripts/extract_screenshots.py \

/tmp/gitx-baseline/BaselineTestResults-${{ matrix.abi }}.xcresult \

./scripts/baseline-screenshots-${{ matrix.abi }}

# screenShotScript/screenShotCompare.sh (unmodified, vendored from the

# separate hannesa2/screenShotScript repo) diffs the working tree

# against git HEAD via git-diff-image, so the freshly-built baseline is

# committed here as HEAD. Nothing is committed to this repo any more,

# which is the point: the baseline exists only for the length of the

# job. This commit is local-only, throwaway and never pushed - the

# runner's checkout is discarded afterwards.

# scripts/Screenshots-<arch> (capital S, staged baseline) and

# scripts/screenshots-<arch> (lowercase, PR extraction path below) are

# the same directory on the case-insensitive runner filesystem, so

# extracting the PR's screenshots afterwards overwrites these files in

# the working tree, leaving them modified relative to this commit. The

# "Check the screenshot paths still collide" step below guards that.

# Two cache entries have turned up under one key with a two-byte size

# difference, which would mean the baseline is not byte-stable between

# builds of the same commit. If that is so, every cache miss reports

# differences the pull request did not cause. Compare these hashes

# across a cached run and a rebuilt one to tell. Note the gate makes

# this the only way to see it: a pull request that changes no UI skips

# the comparison entirely, so there is no "should be identical" run to

# observe.

- name: Hash the baseline screenshots

if: ${{ env.variableSet != '' && matrix.abi == 'arm64' && github.event_name == 'pull_request' && steps.ui-paths.outputs.changed == 'true' && hashFiles(format('scripts/baseline-screenshots-{0}/*.png', matrix.abi)) != '' }}

run: |

echo "baseline-cache hit: ${{ steps.baseline-cache.outputs.cache-hit }}"

echo "baseline built from: ${{ steps.baseline-ref.outputs.sha }}"

shasum -a 256 "./scripts/baseline-screenshots-${{ matrix.abi }}"/*.png

- name: Stage fresh baseline for screenshot diff

id: stage-baseline

if: ${{ env.variableSet != '' && matrix.abi == 'arm64' && github.event_name == 'pull_request' && steps.ui-paths.outputs.changed == 'true' && hashFiles(format('scripts/baseline-screenshots-{0}/*.png', matrix.abi)) != '' }}

run: |

rm -rf "./scripts/Screenshots-${{ matrix.abi }}"

mkdir -p "./scripts/Screenshots-${{ matrix.abi }}"

cp "./scripts/baseline-screenshots-${{ matrix.abi }}"/*.png "./scripts/Screenshots-${{ matrix.abi }}/"

git add -f "./scripts/Screenshots-${{ matrix.abi }}"

git -c user.email="[email protected]" -c user.name="GitX CI" \

commit -m "Baseline screenshots for comparison (ephemeral, not pushed)" --quiet

# Only the UI tests: the unit tests have already run in their own step

# above, and testing the whole scheme here would repeat them

- name: Run tests

if: ${{ env.variableSet != '' && matrix.abi == 'arm64' && github.event_name == 'pull_request' }}

run: |

make ui-test \

ARCH=${{ matrix.abi }} \

GITX_SCREENSHOT_REPO=/tmp/gitx-screenshot-repo \

RESULT_BUNDLE=TestResults-${{ matrix.abi }}.xcresult

- name: Extract screenshots from test results

if: ${{ env.variableSet != '' && matrix.abi == 'arm64' && github.event_name == 'pull_request' }}

run: |

python3 scripts/extract_screenshots.py \

TestResults-${{ matrix.abi }}.xcresult \

./scripts/screenshots-${{ matrix.abi }}

- name: Upload screenshots

if: ${{ env.variableSet != '' && matrix.abi == 'arm64' && github.event_name == 'pull_request' }}

uses: actions/upload-artifact@v7

with:

name: Screenshots-${{ matrix.abi }}

path: ./scripts/screenshots-${{ matrix.abi }}

retention-days: ${{ github.event_name == 'pull_request' && 7 || 90 }}

# The comparison only works because scripts/Screenshots-<arch> (the

# staged baseline, committed above) and scripts/screenshots-<arch> (the

# PR's extraction target) are one directory on the case-insensitive

# runner filesystem, so the PR's screenshots overwrite the baseline and

# git-diff-image sees modified files. If that ever stops holding, git

# would see no modification, screenShotCompare.sh would report no

# differences, and the check would pass without comparing anything.

# Probe the assumption directly rather than inferring it from the diff,

# which cannot tell "nothing changed" from "nothing was compared".

- name: Check the screenshot paths still collide

if: ${{ env.variableSet != '' && matrix.abi == 'arm64' && github.event_name == 'pull_request' && steps.stage-baseline.outcome == 'success' }}

run: |

probe="./scripts/screenshots-${{ matrix.abi }}/.collision-probe"

touch "$probe"

if [ ! -e "./scripts/Screenshots-${{ matrix.abi }}/.collision-probe" ]; then

echo "::error::scripts/Screenshots-${{ matrix.abi }} and scripts/screenshots-${{ matrix.abi }} are no longer the same directory; the screenshot comparison would silently pass without comparing anything."

rm -f "$probe"

exit 1

fi

rm -f "$probe"

- name: Compare screenshots

if: ${{ env.variableSet != '' && matrix.abi == 'arm64' && github.event_name == 'pull_request' && steps.stage-baseline.outcome == 'success' }}

env:

# Screenshot diffs are hosted on GitHub's own attachment API

# (uploads.github.com/user-attachments) instead of a privately-run

# upload server. That endpoint rejects the default GITHUB_TOKEN

# (a GitHub App installation token) with a 404, so the existing

# CLASSIC_TOKEN secret (a classic PAT) is still needed for it and

# for posting/deleting the PR comment.

CLASSIC_TOKEN: ${{ secrets.CLASSIC_TOKEN }}

emulatorApi: ${{ matrix.abi }}

run: |

ls -ls ./scripts/Screenshots-${{ matrix.abi }}

./screenShotScript/screenShotCompare.sh false

- name: Archive screenshots diffs

if: ${{ always() && env.variableSet != '' && matrix.abi == 'arm64' && github.event_name == 'pull_request' && steps.stage-baseline.outcome == 'success' }}

uses: actions/upload-artifact@v7

with:

name: gitx-Screenshots-diffs-${{ matrix.abi }}

path: |

screenshotDiffs

retention-days: ${{ github.event_name == 'pull_request' && 7 || 90 }}

# - name: Show git status

# if: ${{ always() && matrix.abi == 'arm64' && github.event_name == 'pull_request' }}

# run: |

# rm -rf TestResults-${{ matrix.abi }}.xcresult

# rm -rf screenshots-${{ matrix.abi }}

# git status

# [ "$(git status -s \

# -- ':!screenshotsToCompare${{ matrix.abi }}' \

# ':!screenshotDiffs')" ] && exit 1 || exit 0

# end test

- name: Build project

# Do NOT pass PRODUCT_BUNDLE_IDENTIFIER on the command line: it would

# override every target in the workspace, including Sparkle's

# Updater.app, which then shares the app's bundle ID and breaks the

# gitx CLI (Scripting Bridge resolves the wrong bundle). The GitX

# target already sets its identifier in the project file.

run: make archive ARCH=${{ matrix.abi }} ARCHIVE=GitX.xcarchive

- name: Prepare artifact

if: ${{ env.variableSet != '' }}

env:

EXPORT_OPTIONS: ${{ secrets.NOTARY_EXPORT_OPTIONS }}

run: |

EXPORT_OPTIONS_PATH=$RUNNER_TEMP/ExportOptions.plist

echo -n "$EXPORT_OPTIONS" > "$EXPORT_OPTIONS_PATH"

echo "EXPORT_OPTIONS_PATH=$EXPORT_OPTIONS_PATH"

echo "Export GitX.app"

make export-signed \

ARCH=${{ matrix.abi }} \

ARCHIVE=GitX.xcarchive \

EXPORT_DIR=. \

EXPORT_OPTIONS="$EXPORT_OPTIONS_PATH" \

DMG=GitX-${{ matrix.abi }}.dmg

- name: Notarize App

if: ${{ env.variableSet != '' }}

env:

APPLE_ID: ${{ secrets.APPLE_ID }}

TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}

APPLE_PASSWORD: ${{ secrets.APPLE_PASSWORD }}

KEY_ID: ${{ secrets.APPLE_KEY_ID }}

run: |

set -euo pipefail

APP_PATH="GitX.app"

ZIP_PATH="GitX.zip"

AUTH=(--key-id "$KEY_ID" --apple-id "$APPLE_ID" --team-id "$TEAM_ID" --password "$APPLE_PASSWORD")

ditto -c -k --keepParent "$APP_PATH" "$ZIP_PATH"

SUBMISSION=$(xcrun notarytool submit "$ZIP_PATH" "${AUTH[@]}" --output-format json)

echo "$SUBMISSION"

ID=$(echo "$SUBMISSION" | plutil -extract id raw -o - -)

echo "Submission id is: $ID"

STATUS=""

for attempt in 1 2 3 4 5 6; do

xcrun notarytool wait "$ID" "${AUTH[@]}" --timeout 20m || echo "notarytool wait returned early (attempt $attempt)"

STATUS=$(xcrun notarytool info "$ID" "${AUTH[@]}" --output-format json | plutil -extract status raw -o - - || echo "unknown")

echo "Notarization status: $STATUS"

case "$STATUS" in

Accepted|Invalid|Rejected) break ;;

esac

sleep 20

done

xcrun notarytool log "$ID" "${AUTH[@]}"

if [ "$STATUS" != "Accepted" ]; then

echo "::error::Notarization finished with status '$STATUS'"

exit 1

fi

- name: Staple Notarization

if: ${{ env.variableSet != '' }}

run: |

APP_PATH="GitX.app"

xcrun stapler staple "$APP_PATH"

- name: Check Notarization

if: ${{ env.variableSet != '' }}

run: spctl -a -vv GitX.app

- name: Package the stapled app

if: ${{ env.variableSet != '' }}

run: |

echo "Create GitX-${{ matrix.abi }}.dmg from the stapled app"

make package-signed \

ARCH=${{ matrix.abi }} \

EXPORT_DIR=. \

DMG=GitX-${{ matrix.abi }}.dmg

xcrun stapler validate GitX.app

- name: Upload dmg

uses: actions/upload-artifact@v7

if: ${{ success() }}

with:

name: GitX-${{ matrix.abi }}.dmg

path: GitX-${{ matrix.abi }}.dmg

overwrite: true

retention-days: ${{ github.event_name == 'pull_request' && 7 || 90 }}

- name: Clean up keychain and provisioning profile

if: ${{ env.variableSet != '' }}

run: |

security delete-keychain $RUNNER_TEMP/app-signing.keychain-db

rm ~/Library/MobileDevice/Provisioning\ Profiles/build_pp.provisionprofile

release:

if: startsWith(github.event.ref, 'refs/tags/')

needs: build-gitx

runs-on: macos-14

steps:

- name: Checkout

uses: actions/checkout@v7

with:

fetch-depth: 0

submodules: recursive

- name: Find Tag

id: tagger

uses: jimschubert/[email protected]

with:

skip-unshallow: 'true'

abbrev: false

commit-ish: HEAD

- uses: actions/download-artifact@v8

with:

name: GitX-x86_64.dmg

- uses: actions/download-artifact@v8

with:

name: GitX-arm64.dmg

- name: Check pre-release

run: |

echo "tag=${{steps.tagger.outputs.tag}}"

if [[ ${{ steps.tagger.outputs.tag }} == *alpha* || ${{ steps.tagger.outputs.tag }} == *beta* ]]

then

prerelease=true

else

prerelease=false

fi

echo "PRE_RELEASE=$prerelease" >> $GITHUB_ENV

echo "prerelease=$prerelease"

- name: Create Release

uses: softprops/action-gh-release@v3

with:

tag_name: ${{steps.tagger.outputs.tag}}

generate_release_notes: true

prerelease: ${{ env.PRE_RELEASE }}

name: ${{steps.tagger.outputs.tag}}

files: |

GitX-x86_64.dmg

GitX-arm64.dmg

env:

GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

- name: update Sparkle

if: ${{ env.PRE_RELEASE == 'false' }}

run: curl -u $GITHUB_ACTOR:${{ secrets.CLASSIC_TOKEN }} -X POST https://api.github.com/repos/$GITHUB_REPOSITORY/pages/builds