Add macOS pkg installer to deployment (#7554)

.github/workflows/deployment.yml

@@ -108,6 +108,19 @@ jobs:
  run: |
  shopt -s failglob
  script/sign dist/gh_*_macOS_*.zip
+ - name: Build universal macOS pkg installer
+ if: inputs.environment != 'production'
+ env:
+ TAG_NAME: ${{ inputs.tag_name }}
+ run: script/pkgmacos "$TAG_NAME"
+ - name: Build & notarize universal macOS pkg installer
+ if: inputs.environment == 'production'
+ env:
+ TAG_NAME: ${{ inputs.tag_name }}
+ APPLE_DEVELOPER_INSTALLER_ID: ${{ vars.APPLE_DEVELOPER_INSTALLER_ID }}
+ run: |
+ shopt -s failglob
+ script/pkgmacos "$TAG_NAME"
  - uses: actions/upload-artifact@v4
  with:
  name: macos
@@ -116,7 +129,8 @@ jobs:
  path: |
  dist/*.tar.gz
  dist/*.zip
-
+ dist/*.pkg
+
  windows:
  runs-on: windows-latest
  environment: ${{ inputs.environment }}

.gitignore

@@ -12,6 +12,8 @@
 /.goreleaser.generated.yml
 /script/build
 /script/build.exe
+/pkg_payload
+/build/macOS/resources
 
 # VS Code
 .vscode

build/macOS/distribution.xml

@@ -0,0 +1,16 @@
+<?xml version="1.0" encoding="utf-8" standalone="yes"?>
+<installer-gui-script minSpecVersion="1">
+ <title>GitHub CLI</title>
+ <license file="LICENSE" mime-type="text/plain"/>
+ <options hostArchitectures="arm64,x86_64" customize="never" require-scripts="false" allow-external-scripts="false"/>
+ <domains enable_localSystem="true"/>
+
+ <choices-outline>
+ <line choice="gh-cli"/>
+ </choices-outline>
+ <choice id="gh-cli" title="GitHub CLI (universal)">
+ <pkg-ref id="com.github.cli.pkg"/>
+ </choice>
+
+ <pkg-ref id="com.github.cli.pkg" auth="root">#com.github.cli.pkg</pkg-ref>
+</installer-gui-script>

script/pkgmacos

@@ -0,0 +1,131 @@
+#!/bin/zsh
+set -e
+
+print_help() {
+ cat <<EOF
+To build a universal pkg for macOS:
+ script/pkgmacos <tag-name>
+
+To build and sign set APPLE_DEVELOPER_INSTALLER_ID environment variable before.
+For example, if you have a signing identity with the identifier 
+"Developer ID Installer: Your Name (ABC123DEF)" set it in the variable.
+EOF
+}
+
+if [ $# -eq 0 ]; then
+ print_help >&2
+ exit 1
+fi
+
+tag_name=""
+
+while [ $# -gt 0 ]; do
+ case "$1" in
+ -h | --help )
+ print_help
+ exit 0
+ ;;
+ -* )
+ printf "unrecognized flag: %s\n" "$1" >&2
+ exit 1
+ ;;
+ * )
+ tag_name="$1"
+ shift 1
+ ;;
+ esac
+done
+
+# check os requirements: is running macOS 12+ and pkgbuild + productbuild are available
+os_version=$(sw_vers -productVersion)
+major_version=${os_version%%.*}
+
+if (( major_version < 12 )); then
+ echo "This script requires macOS 12 or later. You are running macOS ${os_version}." >&2
+ exit 1
+fi
+
+if ! command -v pkgbuild &> /dev/null; then
+ echo "pkgbuild could not be found. Please install Xcode Command Line Tools." >&2
+ exit 1
+fi
+
+if ! command -v productbuild &> /dev/null; then
+ echo "productbuild could not be found. Please install Xcode Command Line Tools." >&2
+ exit 1
+fi
+# end of os requirements check
+
+# gh-binary paths
+bin_path="/bin/gh"
+arm64_bin="dist/macos_darwin_arm64$bin_path"
+amd64_bin="dist/macos_darwin_amd64_v1$bin_path"
+# payload paths
+payload_root="pkg_payload"
+payload_local_bin="${payload_root}/usr/local/bin"
+payload_zsh_site_functions="${payload_root}/usr/local/share/zsh/site-functions"
+payload_man1="${payload_root}/usr/local/share/man/man1"
+
+merge_binaries() {
+ lipo -create -output "${payload_local_bin}/gh" "$arm64_bin" "$amd64_bin"
+}
+
+build_pkg() {
+ # setup payload
+ mkdir -p "${payload_local_bin}"
+ mkdir -p "${payload_man1}"
+ mkdir -p "${payload_zsh_site_functions}"
+
+ # copy man pages
+ for file in ./share/man/man1/gh*.1; do
+ cp "$file" "${payload_man1}"
+ done
+ # Include only Zsh completions,
+ # the recommended/only option on macOS since Catalina for default shell.
+ cp "./share/zsh/site-functions/_gh" "${payload_zsh_site_functions}"
+
+ # merge binaries
+ merge_binaries
+
+ # build pkg
+ pkgbuild \
+ --root "$payload_root" \
+ --identifier "com.github.cli" \
+ --version "$tag_name" \
+ --install-location "/" \
+ "dist/com.github.cli.pkg"
+
+ # setup resources
+ mkdir "build/macOS/resources"
+ cp "LICENSE" "build/macOS/resources"
+
+ # build distribution
+ if [ -n "$APPLE_DEVELOPER_INSTALLER_ID" ]; then
+ # build and sign production package with license
+ productbuild \
+ --distribution "./build/macOS/distribution.xml" \
+ --resources "./build/macOS/resources" \
+ --package-path "./dist" \
+ --timestamp \
+ --sign "${APPLE_DEVELOPER_INSTALLER_ID?}" \
+ "./dist/gh_${tag_name}_macOS_universal.pkg"
+ else
+ echo "skipping macOS pkg code-signing; APPLE_DEVELOPER_INSTALLER_ID not set" >&2
+
+ # build production package with license without signing
+ productbuild \
+ --distribution "./build/macOS/distribution.xml" \
+ --resources "./build/macOS/resources" \
+ --package-path "./dist" \
+ "./dist/gh_${tag_name}_macOS_universal.pkg"
+ fi
+}
+
+cleanup() {
+ # remove temp installer so it does not get uploaded
+ rm -f "dist/com.github.cli.pkg"
+}
+
+trap cleanup EXIT
+
+build_pkg