build_nudge_pr.yml

name: Build signed Nudge for pull requests

on:
  pull_request_target:
    types: [labeled]

jobs:
  build:
    runs-on: macos-14
    if: contains(github.event.pull_request.labels.*.name, 'safe-to-test')

    steps:
    - name: Checkout nudge repo
      uses: actions/checkout@24cb9080177205b6e8c946b17badbe402adc938f # v3.4.0
      with:
        ref: ${{ github.event.pull_request.head.sha }}
        fetch-depth: 0

    - name: Install Apple Xcode certificates
      uses: apple-actions/import-codesign-certs@8f3fb608891dd2244cdab3d69cd68c0d37a7fe93 # v2.0.0
      with:
        keychain-password: ${{ github.run_id }}
        p12-file-base64: ${{ secrets.APP_CERTIFICATES_P12_MAOS }}
        p12-password: ${{ secrets.APP_CERTIFICATES_P12_PASSWORD_MAOS }}

    - name: Install Apple Installer certificates
      uses: apple-actions/import-codesign-certs@8f3fb608891dd2244cdab3d69cd68c0d37a7fe93 # v2.0.0
      with:
        create-keychain: false # do not create a new keychain for this value
        keychain-password: ${{ github.run_id }}
        p12-file-base64: ${{ secrets.PKG_CERTIFICATES_P12_MAOS }}
        p12-password: ${{ secrets.PKG_CERTIFICATES_P12_PASSWORD_MAOS }}

    - name: Run build package script
      run: ./build_nudge.zsh

    - name: get environment variables
      id: get_env_var
      run: |
         echo "NUDGE_VERSION=$(/bin/cat ./build_info.txt)" >> $GITHUB_ENV
         echo "NUDGE_MAIN_VERSION=$(/bin/cat ./build_info_main.txt)" >> $GITHUB_ENV

    - name: Upload packages
      uses: actions/upload-artifact@0b7f8abb1508181956e8e162db84b466c27e18ce # v3.1.2
      with:
        name: packages
        path: outputs/

    - name: Clean up PR safety tag
      if: always()
      id: clean_up_pr_safety_tag
      run: |
         /usr/bin/curl --silent --fail-with-body -X DELETE -H 'Accept: application/vnd.github.v3+json' -H 'Authorization: token ${{ github.token }}' 'https://api.github.com/repos/${{ github.repository }}/issues/${{ github.event.number }}/labels/safe-to-test'