Create Release PRs #29
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Create Release PRs | |
| # Note: The "Use workflow from" dropdown selects which version of THIS workflow to run. | |
| # Always select "main" unless you're testing workflow changes from another branch. | |
| # The "base_branch" input below determines where the release PR will be targeted. | |
| # This workflow bumps version and creates PRs in the iOS-SDK and XCFramework SDK. | |
| on: | |
| workflow_dispatch: | |
| inputs: | |
| version: | |
| description: "The version number of the release (e.g., 5.2.15 or 5.2.3-beta-01)" | |
| type: string | |
| required: true | |
| base_branch: | |
| description: "Target branch for the PR (e.g. main for regular releases, 5.3-main for 5.3.x releases)" | |
| type: string | |
| required: false | |
| default: "main" | |
| permissions: | |
| contents: write | |
| pull-requests: write | |
| jobs: | |
| # Step 1: Use reusable workflow to prepare release branch | |
| prep: | |
| uses: OneSignal/sdk-shared/.github/workflows/prep-release.yml@main | |
| with: | |
| version: ${{ github.event.inputs.version }} | |
| target_branch: ${{ github.event.inputs.base_branch }} | |
| # Step 2: Update iOS-specific files and build binaries | |
| update-and-build: | |
| needs: prep | |
| runs-on: macos-14 | |
| outputs: | |
| version_from: ${{ steps.extract_version.outputs.current_version }} | |
| env: | |
| VERSION: ${{ github.event.inputs.version }} | |
| BASE_BRANCH: ${{ github.event.inputs.base_branch }} | |
| RELEASE_BRANCH: ${{ needs.prep.outputs.release_branch }} | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| # Single source of truth for the XCFrameworks the Code Sign and Verify steps | |
| # operate on (paths relative to iOS_SDK/OneSignalSDK). Keep in sync with the | |
| # frameworks built by build_all_frameworks.sh. | |
| XCFRAMEWORKS: >- | |
| OneSignal_Core/OneSignalCore.xcframework | |
| OneSignal_OSCore/OneSignalOSCore.xcframework | |
| OneSignal_Outcomes/OneSignalOutcomes.xcframework | |
| OneSignal_Extension/OneSignalExtension.xcframework | |
| OneSignal_Notifications/OneSignalNotifications.xcframework | |
| OneSignal_User/OneSignalUser.xcframework | |
| OneSignal_LiveActivities/OneSignalLiveActivities.xcframework | |
| OneSignal_Location/OneSignalLocation.xcframework | |
| OneSignal_InAppMessages/OneSignalInAppMessages.xcframework | |
| OneSignal_XCFramework/OneSignalFramework.xcframework | |
| steps: | |
| - name: 📋 Display Configuration | |
| run: | | |
| echo "============================================" | |
| echo "📦 Release Version: $VERSION" | |
| echo "🎯 Base Branch (PR Target): $BASE_BRANCH" | |
| echo "🌿 Release Branch: $RELEASE_BRANCH" | |
| echo "============================================" | |
| - name: Checkout OneSignal-iOS-SDK | |
| uses: actions/checkout@v4 | |
| with: | |
| ref: ${{ needs.prep.outputs.release_branch }} | |
| fetch-depth: 0 | |
| - name: Setup Git User | |
| uses: OneSignal/sdk-shared/.github/actions/setup-git-user@main | |
| - name: Extract Current Version | |
| id: extract_version | |
| run: | | |
| CURRENT_VERSION=$(grep -E "s.version\s*=" OneSignal.podspec | sed -E 's/.*"(.*)".*/\1/') | |
| echo "current_version=$CURRENT_VERSION" >> $GITHUB_OUTPUT | |
| echo "Current version: $CURRENT_VERSION" | |
| - name: Setup Xcode | |
| uses: maxim-lobanov/setup-xcode@v1 | |
| with: | |
| xcode-version: "15.2" | |
| - name: Install the Apple distribution certificate (OneSignal) | |
| uses: apple-actions/import-codesign-certs@v2 | |
| with: | |
| keychain-password: ${{ secrets.CERTIFICATES_P12_PASSWORD }} | |
| p12-file-base64: ${{ secrets.CERTIFICATES_P12 }} | |
| p12-password: ${{ secrets.CERTIFICATES_P12_PASSWORD }} | |
| - name: Update Version in SDK and Podspec Files | |
| run: | | |
| cd iOS_SDK/OneSignalSDK | |
| chmod +x ./update_version.sh | |
| ./update_version.sh $VERSION | |
| shell: bash | |
| - name: Commit Version Bump and Push Changes | |
| run: | | |
| git commit -am "chore: bump version to $VERSION" | |
| git push origin $RELEASE_BRANCH | |
| - name: Build Binaries | |
| run: | | |
| cd iOS_SDK/OneSignalSDK | |
| chmod +x ./build_all_frameworks.sh | |
| ./build_all_frameworks.sh | |
| shell: bash | |
| - name: Code Sign | |
| run: | | |
| cd iOS_SDK/OneSignalSDK | |
| set -e | |
| IDENTITY="Apple Distribution: OneSignal, Inc. (J3J28YJX9L)" | |
| for XCF in $XCFRAMEWORKS; do | |
| # Sign inside-out: each slice's .framework binary first, then the | |
| # .xcframework wrapper. -f replaces the linker's ad-hoc signature left | |
| # by the unsigned archive build, so both inner and outer end up signed | |
| # with the official OneSignal Apple Distribution identity. | |
| while IFS= read -r FW; do | |
| echo "Signing inner framework: $FW" | |
| codesign --timestamp -f -v --sign "$IDENTITY" "$FW" | |
| done < <(find "$XCF" -type d -name "*.framework") | |
| echo "Signing wrapper: $XCF" | |
| codesign --timestamp -f -v --sign "$IDENTITY" "$XCF" | |
| done | |
| shell: bash | |
| - name: Verify Code Signing | |
| run: | | |
| cd iOS_SDK/OneSignalSDK | |
| set -e | |
| # Fail the release if any slice or wrapper is tampered/unsigned or not | |
| # signed by the OneSignal team. --deep is unreliable across xcframework | |
| # slices, so each inner .framework is verified explicitly. | |
| REQUIREMENT="anchor apple generic and certificate leaf[subject.OU] = J3J28YJX9L" | |
| for XCF in $XCFRAMEWORKS; do | |
| while IFS= read -r FW; do | |
| echo "Verifying inner framework: $FW" | |
| codesign --verify --strict --verbose=2 "$FW" | |
| codesign --verify -R="$REQUIREMENT" "$FW" | |
| done < <(find "$XCF" -type d -name "*.framework") | |
| echo "Verifying wrapper: $XCF" | |
| codesign --verify --strict --verbose=2 "$XCF" | |
| codesign --verify -R="$REQUIREMENT" "$XCF" | |
| done | |
| echo "All XCFrameworks verified: intact and signed by OneSignal (J3J28YJX9L)." | |
| shell: bash | |
| - name: Commit Build and Push Changes | |
| run: | | |
| git commit -am "chore: build binaries" | |
| git push origin $RELEASE_BRANCH | |
| - name: Update Swift Package | |
| run: | | |
| cd iOS_SDK/OneSignalSDK | |
| chmod +x ./update_swift_package.sh | |
| ./update_swift_package.sh $VERSION | |
| shell: bash | |
| - name: Commit Swift Package and Push Changes | |
| run: | | |
| git add . | |
| git commit -m "chore: update Swift package" | |
| git push origin $RELEASE_BRANCH | |
| # Step 3: Use reusable workflow to create iOS SDK PR with release notes | |
| create-ios-pr: | |
| needs: [prep, update-and-build] | |
| uses: OneSignal/sdk-shared/.github/workflows/create-release.yml@main | |
| with: | |
| release_branch: ${{ needs.prep.outputs.release_branch }} | |
| target_branch: ${{ github.event.inputs.base_branch }} | |
| # Step 4: Update XCFramework repository | |
| update-xcframework: | |
| needs: [prep, update-and-build, create-ios-pr] | |
| runs-on: macos-14 | |
| env: | |
| VERSION: ${{ github.event.inputs.version }} | |
| BASE_BRANCH: ${{ github.event.inputs.base_branch }} | |
| RELEASE_BRANCH: ${{ needs.prep.outputs.release_branch }} | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| steps: | |
| - name: Checkout OneSignal-iOS-SDK | |
| uses: actions/checkout@v4 | |
| with: | |
| ref: ${{ needs.prep.outputs.release_branch }} | |
| path: ios-sdk-repo | |
| - name: Get iOS SDK PR Body | |
| run: | | |
| cd ios-sdk-repo | |
| # Find the PR that was just created for this version | |
| PR_NUMBER=$(gh pr list --state open --search "Release $VERSION in:title" --json number --jq '.[0].number // empty') | |
| if [[ -n "$PR_NUMBER" ]]; then | |
| echo "Found iOS SDK PR: #$PR_NUMBER" | |
| gh pr view "$PR_NUMBER" --json body --jq '.body' > ../pr_body.md | |
| else | |
| echo "Warning: Could not find iOS SDK PR, using default body" | |
| echo "## Release $VERSION" > ../pr_body.md | |
| echo "" >> ../pr_body.md | |
| echo "See iOS SDK release: https://github.com/OneSignal/OneSignal-iOS-SDK/releases/tag/$VERSION" >> ../pr_body.md | |
| fi | |
| - name: Checkout OneSignal-XCFramework | |
| uses: actions/checkout@v4 | |
| with: | |
| repository: OneSignal/OneSignal-XCFramework | |
| ref: ${{ env.BASE_BRANCH }} | |
| path: xcframework-repo | |
| token: ${{ secrets.PAT_TOKEN_ONESIGNAL_XCFRAMEWORK }} | |
| - name: Update Package.swift in XCFramework Repository | |
| run: | | |
| # Copy Package.swift from iOS SDK to XCFramework repo | |
| cp ios-sdk-repo/Package.swift xcframework-repo/Package.swift | |
| # Update package name to OneSignalXCFramework (only line 7, the package declaration) | |
| sed -i '' '7s/name: "OneSignalFramework"/name: "OneSignalXCFramework"/' xcframework-repo/Package.swift | |
| # Navigate to XCFramework repo | |
| cd xcframework-repo | |
| # Delete remote branch if it exists | |
| git push origin --delete $RELEASE_BRANCH || true | |
| # Create release branch | |
| git checkout -b $RELEASE_BRANCH | |
| # Configure git | |
| git config --local user.email "noreply@onesignal.com" | |
| git config --local user.name "github-actions[bot]" | |
| # Commit changes | |
| git commit -am "Release $VERSION" | |
| # Push to remote | |
| git push origin $RELEASE_BRANCH | |
| env: | |
| GH_TOKEN: ${{ secrets.PAT_TOKEN_ONESIGNAL_XCFRAMEWORK }} | |
| - name: Create Pull Request for XCFramework Repository | |
| env: | |
| GH_TOKEN: ${{ secrets.PAT_TOKEN_ONESIGNAL_XCFRAMEWORK }} | |
| run: | | |
| cd xcframework-repo | |
| gh pr create \ | |
| --title "Release $VERSION" \ | |
| --body-file ../pr_body.md \ | |
| --head "$RELEASE_BRANCH" \ | |
| --base "$BASE_BRANCH" |