Build, sign, and notarize binaries on Buildkite

.buildkite/commands/build-sign-notarize.sh

@@ -0,0 +1,40 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+bun_version="$(sed -nE 's/.*"packageManager": *"bun@([^"]+)".*/\1/p' package.json)"
+if [ -z "$bun_version" ]; then
+  echo >&2 "could not read the Bun version from package.json's packageManager"
+  exit 1
+fi
+
+echo "--- :bun: install Bun $bun_version"
+curl -fsSL https://bun.sh/install | bash -s "bun-v$bun_version"
+export PATH="$HOME/.bun/bin:$PATH"
+bun --version
+
+echo "--- :package: install dependencies"
+bun install --frozen-lockfile
+
+echo "--- :hammer_and_wrench: build binaries"
+bun run --cwd packages/cli binary
+
+bin_dir="packages/cli/dist/bin"
+
+echo "--- :key: set up Ruby tooling"
+install_gems
+
+echo "--- :closed_lock_with_key: sign and notarize macOS binaries"
+bundle exec fastlane configure_code_signing
+bundle exec fastlane sign_macos_binaries
+
+echo "--- :mag: check binaries.json checksums"
+ruby -rjson -e '
+  JSON.parse(File.read(ARGV.fetch(0))).fetch("artifacts").each do |artifact|
+    puts "#{artifact.fetch("sha256")}  #{artifact.fetch("file")}"
+  end
+' "$bin_dir/binaries.json" | (cd "$bin_dir" && shasum -a 256 -c -)
+
+echo "--- :package: build release archives"
+# binaries.json records absolute paths on this agent, so the archives must be built here.
+bun run --cwd packages/cli scripts/build-homebrew-archive.ts

.buildkite/pipeline.yml

@@ -0,0 +1,20 @@
+# yaml-language-server: $schema=https://raw.githubusercontent.com/buildkite/pipeline-schema/main/schema.json
+---
+
+agents:
+  queue: mac
+
+env:
+  IMAGE_ID: $IMAGE_ID
+
+steps:
+  - label: ":apple: Build binaries, sign and notarize macOS"
+    key: build-sign-notarize
+    command: .buildkite/commands/build-sign-notarize.sh
+    plugins: [$CI_TOOLKIT_PLUGIN]
+    artifact_paths:
+      - packages/cli/dist/bin/binaries.json
+      - packages/cli/dist/release/*
+    notify:
+      - github_commit_status:
+          context: Build, Sign & Notarize

.buildkite/shared-pipeline-vars

@@ -0,0 +1,11 @@
+#!/bin/sh
+
+# Sourced before `buildkite-agent pipeline upload` so the values land in the
+# rendered pipeline, keeping plugin pins and the agent image id out of pipeline.yml.
+
+CI_TOOLKIT_PLUGIN_VERSION='7.1.0'
+
+XCODE_VERSION=$(sed -E 's/^~> ?//' .xcode-version)
+
+export IMAGE_ID="xcode-$XCODE_VERSION"
+export CI_TOOLKIT_PLUGIN="automattic/a8c-ci-toolkit#$CI_TOOLKIT_PLUGIN_VERSION"

.bundle/config

@@ -0,0 +1,3 @@
+---
+BUNDLE_PATH: "vendor/bundle"
+BUNDLE_FORCE_RUBY_PLATFORM: "true"

.gitignore

@@ -5,3 +5,8 @@ node_modules/
 /beeper-desktop-cli
 .upstream/
 *.exe
+
+# Ruby and fastlane
+/vendor/bundle/
+/fastlane/README.md
+/fastlane/report.xml

.ruby-version

@@ -0,0 +1 @@
+3.4.9

.xcode-version

@@ -0,0 +1 @@
+27.1

Gemfile

@@ -0,0 +1,5 @@
+# frozen_string_literal: true
+
+source 'https://rubygems.org'
+
+gem 'fastlane', '~> 2.241'