1+ name : Build Redis CE MacOS Binary Distributions
2+
3+ on :
4+ push :
5+ branches : [ main ]
6+ paths :
7+ - ' .github/workflows/build-binary-dists.yml'
8+ - ' configs/**'
9+ - ' scripts/**'
10+
11+ pull_request_target :
12+ branches : [ main ]
13+ types : [ labeled ]
14+ paths :
15+ - ' .github/workflows/build-binary-dists.yml'
16+ - ' configs/**'
17+ - ' scripts/**'
18+
19+ env :
20+ REDIS_VERSION : " 8.0-m03"
21+
22+ permissions :
23+ id-token : write
24+ contents : read
25+
26+ jobs :
27+ build :
28+ if : ${{ (github.event.label.name == 'build-binary-dists') || (github.event_name == 'push' && github.ref == 'refs/heads/main') }}
29+ name : Build Redis CE MacOS Binary Distributions
30+ strategy :
31+ matrix :
32+ os_version : # See: https://github.com/actions/runner-images/blob/main/README.md#available-images
33+ - macos-13 # macOS 13 x86_64
34+ - macos-13-xlarge # macOS 13 arm64
35+
36+ runs-on : ${{ matrix.os_version }}
37+
38+ steps :
39+ - uses : actions/checkout@v4
40+
41+ - name : Install build dependencies
42+ run : |
43+ export HOMEBREW_NO_AUTO_UPDATE=1
44+ brew update
45+ brew install coreutils
46+ brew install make
47+ brew install openssl
48+ brew install llvm@18
49+ brew install cmake
50+ brew install gnu-sed
51+ brew install make
52+ brew install automake
53+ brew install libtool
54+
55+ RUST_INSTALLER=rust-1.80.1-$(if [ "$(uname -m)" = "arm64" ]; then echo "aarch64"; else echo "x86_64"; fi)-apple-darwin
56+ echo "Downloading and installing Rust standalone installer: ${RUST_INSTALLER}"
57+ wget --quiet -O ${RUST_INSTALLER}.tar.xz https://static.rust-lang.org/dist/${RUST_INSTALLER}.tar.xz
58+ tar -xf ${RUST_INSTALLER}.tar.xz
59+ (cd ${RUST_INSTALLER} && sudo ./install.sh)
60+ rm -rf ${RUST_INSTALLER}
61+
62+ - name : Build Redis CE
63+ id : build
64+ run : |
65+ export HOMEBREW_PREFIX="$(brew --prefix)"
66+ export BUILD_WITH_MODULES=yes
67+ export BUILD_TLS=yes
68+ export DISABLE_WERRORS=yes
69+ PATH="$HOMEBREW_PREFIX/opt/libtool/libexec/gnubin:$HOMEBREW_PREFIX/opt/llvm@18/bin:$HOMEBREW_PREFIX/opt/make/libexec/gnubin:$HOMEBREW_PREFIX/opt/gnu-sed/libexec/gnubin:$HOMEBREW_PREFIX/opt/coreutils/libexec/gnubin:$PATH" # Override macOS defaults.
70+ export LDFLAGS="-L$HOMEBREW_PREFIX/opt/llvm@18/lib"
71+ export CPPFLAGS="-I$HOMEBREW_PREFIX/opt/llvm@18/include"
72+
73+ curl -L "https://github.com/redis/redis/archive/refs/tags/${{ vars.BINARY_VERSION_TO_BUILD }}.tar.gz" -o redis.tar.gz
74+ tar xzf redis.tar.gz
75+
76+ mkdir -p build_dir/etc
77+ make -C redis-${{ vars.BINARY_VERSION_TO_BUILD }} -j "$(nproc)" all OS=macos
78+ make -C redis-${{ vars.BINARY_VERSION_TO_BUILD }} install PREFIX=$(pwd)/build_dir OS=macos
79+ cp ./configs/redis.conf build_dir/etc/redis.conf
80+ (cd build_dir && zip -r ../redis-ce-${{ vars.BINARY_VERSION_TO_BUILD }}-$(uname -m).zip .)
81+ echo "UNSIGNED_REDIS_BINARY=unsigned-redis-ce-${{ vars.BINARY_VERSION_TO_BUILD }}-$(uname -m).zip" >> $GITHUB_OUTPUT
82+
83+ - name : Upload Redis CE Binary Distribution
84+ uses : actions/upload-artifact@v4
85+ with :
86+ path : ./${{ steps.build.outputs.UNSIGNED_REDIS_BINARY }}
87+ name : ${{ steps.build.outputs.UNSIGNED_REDIS_BINARY }}
88+
89+ - name : Setup Keychain and Certificate
90+ if : github.event_name == 'push' && github.ref == 'refs/heads/main'
91+ run : |
92+ # Decode and save certificate
93+ echo "${{ secrets.MACOS_CERTIFICATE }}" | base64 --decode > certificate.p12
94+
95+ # Create and configure keychain
96+ security create-keychain -p "${{ secrets.MACOS_KEYCHAIN_PASSWORD }}" build.keychain
97+ security unlock-keychain -p "${{ secrets.MACOS_KEYCHAIN_PASSWORD }}" build.keychain
98+ security set-keychain-settings -t 3600 -l build.keychain
99+
100+ # Add to search list and set as default
101+ security list-keychains -d user -s build.keychain login.keychain
102+ security default-keychain -s build.keychain
103+
104+ # Import and trust certificate
105+ security import certificate.p12 -k build.keychain -P "${{ secrets.MACOS_CERTIFICATE_PASSWORD }}" -T /usr/bin/codesign
106+ security set-key-partition-list -S apple-tool:,apple:,codesign: -s -k "${{ secrets.MACOS_KEYCHAIN_PASSWORD }}" build.keychain
107+
108+ # Debug certificate presence
109+ security find-identity -v -p codesigning build.keychain
110+
111+ - name : Sign Binaries
112+ if : github.event_name == 'push' && github.ref == 'refs/heads/main'
113+ id : sign
114+ run : |
115+ # Get identity from specific keychain
116+ CODESIGN_IDENTITY=$(security find-identity -v -p codesigning build.keychain | grep -o '[0-9A-F]\{40\}' | head -n 1)
117+ echo "Using identity: ${CODESIGN_IDENTITY}"
118+
119+ # Check if entitlements file exists
120+ if [ ! -f configs/entitlements.xml ]; then
121+ echo "Entitlements file not found!"
122+ exit 1
123+ fi
124+
125+ # Sign binaries with explicit keychain
126+ for i in $(ls build_dir/bin); do
127+ /usr/bin/codesign --keychain build.keychain --options=runtime --timestamp -v --sign "${CODESIGN_IDENTITY}" --entitlements configs/entitlements.xml -f build_dir/bin/$i
128+ done
129+
130+ # Sign libraries with explicit keychain
131+ for i in $(ls build_dir/lib/redis/modules); do
132+ /usr/bin/codesign --keychain build.keychain --options=runtime --timestamp -v --sign "${CODESIGN_IDENTITY}" --entitlements configs/entitlements.xml -f build_dir/lib/redis/modules/$i
133+ done
134+
135+ # Create distribution archive
136+ (cd build_dir && zip -r ../redis-ce-${{ vars.BINARY_VERSION_TO_BUILD }}-$(uname -m).zip .)
137+ echo "REDIS_BINARY=redis-ce-${{ vars.BINARY_VERSION_TO_BUILD }}-$(uname -m).zip" >> $GITHUB_OUTPUT
138+
139+ - name : Notarize Redis CE Binary Distribution
140+ if : github.event_name == 'push' && github.ref == 'refs/heads/main'
141+ run : |
142+ sh scripts/notarize.sh ${{ steps.sign.outputs.REDIS_BINARY }} com.redis.redis ${{ secrets.MAC_NOTARIZE_USERNAME }} ${{ secrets.MAC_NOTARIZE_PASSWORD }} ${{ secrets.MAC_NOTARIZE_TEAM_ID }}
143+
144+ - uses : aws-actions/configure-aws-credentials@v4
145+ if : github.event_name == 'push' && github.ref == 'refs/heads/main'
146+ with :
147+ aws-region : ${{ secrets.S3_REGION }}
148+ role-to-assume : ${{ secrets.S3_IAM_ARN }}
149+
150+ - name : Upload Redis CE Binary Distribution to S3
151+ if : github.event_name == 'push' && github.ref == 'refs/heads/main'
152+ run : |
153+ aws s3 cp ${{ steps.sign.outputs.REDIS_BINARY }} s3://${{ secrets.S3_BUCKET }}/homebrew/ --acl public-read
0 commit comments