build-binaries.yaml

name: Build, Test and Publish Pyinstaller Binaries

on:
  workflow_call:
    inputs:
      production_release:
        required: true
        type: string
      python_version:
        required: true
        type: string
      release_version:
        required: false
        type: string

jobs:
  build-binaries:
    runs-on: ${{ matrix.os }}
    strategy:
      matrix:
        # macos-14 is the Apple Silicon M1 runner (mac os 14)
        # macos-13 is the last available Intel Mac runner (mac os 13)
        # See https://github.com/actions/runner-images?tab=readme-ov-file#available-images
        os: [ubuntu-22.04, windows-latest, macos-13, macos-14]

    steps:
      - name: Set signing condition
        id: signing
        run: |
          # Allow signing on:
          # 1. Main branch non-PR events when production_release is true OR
          # 2. Main branch CRON triggered events
          if [[ "${{ github.event_name }}" != "pull_request" && \
                "${{ github.ref_name }}" == "main" && \
                ("${{ inputs.production_release }}" == "true" || "${{ github.event_name }}" == "schedule") ]]; then
            echo "allowed=true" >> $GITHUB_OUTPUT
          else
            echo "allowed=false" >> $GITHUB_OUTPUT
          fi
        shell: bash

      - name: Checkout source code
        uses: actions/checkout@v4
        with:
          ref: ${{ inputs.release_version != '' && format('v{0}', inputs.release_version) || '' }}

      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: ${{ inputs.python_version }}

      - name: Set up Poetry
        uses: ./.github/actions/setup-poetry

      - name: Install dependencies
        run: poetry install --no-interaction

      - name: Configure build environment
        shell: bash
        run: |
          artifacts_dir="${{ github.workspace }}${{ runner.os == 'Windows' && '\dist\artifacts' || '/dist/artifacts' }}"
          mkdir -p $artifacts_dir
          package_name_version="${{ inputs.release_version != '' && format('-{0}', inputs.release_version) || '' }}"
          package_name="algokit${package_name_version}-${{ runner.os }}_${{ runner.arch }}"
          echo "PACKAGE_NAME=`echo $package_name | tr '[:upper:]' '[:lower:]'`" >> $GITHUB_ENV
          echo "ARTIFACTS_DIR=${artifacts_dir}" >> $GITHUB_ENV

      # GitHub doesn't support expressions in the uses block
      - name: Build windows binary
        if: ${{ runner.os == 'Windows' }}
        uses: ./.github/actions/build-binaries/windows
        with:
          package_name: ${{ env.PACKAGE_NAME }}
          version: ${{ inputs.release_version }}
          artifacts_dir: ${{ env.ARTIFACTS_DIR }}
          with_codesign: ${{ steps.signing.outputs.allowed }}
          azure_tenant_id: ${{ steps.signing.outputs.allowed == 'true' && secrets.AZURE_TENANT_ID || '' }}
          azure_client_id: ${{ steps.signing.outputs.allowed == 'true' && secrets.AZURE_CLIENT_ID || '' }}
          azure_client_secret: ${{ steps.signing.outputs.allowed == 'true' && secrets.AZURE_CLIENT_SECRET || '' }}

      - name: Build linux binary
        if: ${{ runner.os == 'Linux' }}
        uses: ./.github/actions/build-binaries/linux
        with:
          package_name: ${{ env.PACKAGE_NAME }}
          version: ${{ inputs.release_version }}
          artifacts_dir: ${{ env.ARTIFACTS_DIR }}

      - name: Install Apple Developer Id Cert
        if: ${{ runner.os == 'macOS' && steps.signing.outputs.allowed == 'true' }}
        uses: ./.github/actions/install-apple-dev-id-cert
        with:
          cert_data: ${{ secrets.APPLE_CERT_DATA }}
          cert_password: ${{ secrets.APPLE_CERT_PASSWORD }}

      - name: Build macOS binary
        if: ${{ runner.os == 'macOS' }}
        uses: ./.github/actions/build-binaries/macos
        with:
          package_name: ${{ env.PACKAGE_NAME }}
          version: ${{ inputs.release_version }}
          artifacts_dir: ${{ env.ARTIFACTS_DIR }}
          with_codesign: ${{ steps.signing.outputs.allowed }}
          apple_team_id: ${{ steps.signing.outputs.allowed == 'true' && secrets.APPLE_TEAM_ID || '' }}
          apple_bundle_id: ${{ inputs.production_release == 'true' && vars.APPLE_BUNDLE_ID || format('beta.{0}', vars.APPLE_BUNDLE_ID) }}
          apple_cert_id: ${{ steps.signing.outputs.allowed == 'true' && secrets.APPLE_CERT_ID || '' }}
          apple_notary_user: ${{ steps.signing.outputs.allowed == 'true' && secrets.APPLE_NOTARY_USER || '' }}
          apple_notary_password: ${{ steps.signing.outputs.allowed == 'true' && secrets.APPLE_NOTARY_PASSWORD || '' }}

      - name: Add binary to path
        run: |
          echo "${{ github.workspace }}${{ runner.os == 'Windows' && '\dist\algokit' || '/dist/algokit' }}" >> $GITHUB_PATH
        shell: bash

      - name: Run portability tests
        if: ${{ runner.os == 'Windows' }}
        run: |
          git config --global user.email "actions@github.com" && git config --global user.name "github-actions"
          poetry run pytest tests/ -m pyinstaller_binary_tests --log-cli-level=INFO
        shell: cmd

      - name: Run portability tests
        if: ${{ runner.os != 'Windows' }}
        run: |
          git config --global user.email "actions@github.com" && git config --global user.name "github-actions"
          poetry run pytest tests/ -m pyinstaller_binary_tests --log-cli-level=INFO
        shell: bash

      # softprops/action-gh-release doesn't support the \ character in paths
      - name: Adjust artifacts directory for softprops/action-gh-release
        if: ${{ runner.os == 'Windows' }}
        shell: pwsh
        run: |
          $adjusted = '${{ env.ARTIFACTS_DIR }}' -replace '\\','/'
          echo "ARTIFACTS_DIR=$adjusted" >> $env:GITHUB_ENV

      - name: Append artifacts to release
        if: ${{ inputs.production_release == 'true' }}
        uses: softprops/action-gh-release@v1
        with:
          fail_on_unmatched_files: true
          files: |
            ${{ env.ARTIFACTS_DIR }}/*.*
          tag_name: ${{ format('v{0}', inputs.release_version) }}
          prerelease: ${{ contains(inputs.release_version, 'beta') }}