Build native Edit packages with the public SDK Actions

.github/workflows/package.yml

@@ -0,0 +1,104 @@
+name: Build native Edit MPKG
+on:
+  push:
+    branches: [main, master]
+  pull_request:
+    branches: [main, master]
+  workflow_dispatch:
+permissions:
+  contents: read
+concurrency:
+  group: edit-package-${{ github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+jobs:
+  build:
+    runs-on: ubuntu-24.04
+    timeout-minutes: 60
+    env:
+      CARGO_BUILD_JOBS: '4'
+    steps:
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262
+        with:
+          persist-credentials: false
+      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065
+        with:
+          python-version: '3.12'
+      - name: Install host dependencies
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y pkg-config libxkbcommon-dev libwayland-dev libfontconfig1-dev libx11-dev libxcursor-dev libxi-dev libxrandr-dev unzip curl perl cmake
+      - name: Prepare the pinned standalone Rust SDK
+        id: sdk
+        uses: mochiOS/devkit/actions/setup-rust-sdk@1ae906d7417e9882b11541e338552c3039c981fb
+        with:
+          output: ${{ runner.temp }}/mochios-rust-sdk
+      - name: Test, compile and stage Edit
+        env:
+          SDK: ${{ steps.sdk.outputs.sdk }}
+          HELPER: ${{ steps.sdk.outputs.helper }}
+        run: python3 "$HELPER" --source "$GITHUB_WORKSPACE" --sdk "$SDK" --output "$RUNNER_TEMP/app-build" --test
+      - name: Build unsigned MPKG using the public Action
+        id: package
+        uses: mochiOS/devkit/actions/build-mpkg@20d3fb71b952ae7a4ff583dafe8cc3d00e24d3a3
+        with:
+          manifest: ${{ runner.temp }}/app-build/stage/manifest.toml
+          payload: ${{ runner.temp }}/app-build/stage/payload
+          output: dist/Edit.mpkg
+      - name: Retain package and reviewable dependency resolution
+        shell: bash
+        run: |
+          cp "$RUNNER_TEMP/app-build/build-info.json" dist/build-info.json
+          cp "$RUNNER_TEMP/app-build/resolved.Cargo.lock" dist/resolved.Cargo.lock
+      - name: Upload distributable files only
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02
+        with:
+          name: edit-unsigned-mpkg
+          path: dist/
+          if-no-files-found: error
+          retention-days: 14
+  publish:
+    if: github.event_name == 'push' && github.ref == format('refs/heads/{0}', github.event.repository.default_branch) && vars.APP_RELEASE_ENABLED == 'true'
+    needs: build
+    runs-on: ubuntu-24.04
+    timeout-minutes: 30
+    environment: app-release
+    permissions:
+      actions: read
+      contents: write
+    steps:
+      - name: Download this run's verified build artifact
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093
+        with:
+          name: edit-unsigned-mpkg
+          path: unsigned-package
+      - name: Prepare trusted tooling without checking out application code
+        id: sdk
+        uses: mochiOS/devkit/actions/setup-rust-sdk@1ae906d7417e9882b11541e338552c3039c981fb
+        with:
+          output: ${{ runner.temp }}/mochios-rust-sdk
+      - name: Build the pinned signing tool
+        env:
+          SDK: ${{ steps.sdk.outputs.sdk }}
+          HELPER: ${{ steps.sdk.outputs.helper }}
+        run: python3 "$(dirname "$HELPER")/host-tool.py" --sdk "$SDK" --tool msign --output "$RUNNER_TEMP/host-tools"
+      - name: Sign, verify and publish the approved package
+        env:
+          GH_TOKEN: ${{ github.token }}
+          MSIGN_CERTIFICATE_B64: ${{ secrets.MSIGN_CERTIFICATE_B64 }}
+          MSIGN_PRIVATE_KEY_B64: ${{ secrets.MSIGN_PRIVATE_KEY_B64 }}
+          MSIGN_ROOT_PUBLIC_KEY_B64: ${{ vars.MSIGN_ROOT_PUBLIC_KEY_B64 }}
+          HELPER: ${{ steps.sdk.outputs.helper }}
+          SOURCE_COMMIT: ${{ github.sha }}
+          RELEASE_REPOSITORY: ${{ github.repository }}
+          RELEASE_BRANCH: ${{ github.event.repository.default_branch }}
+        run: |
+          python3 "$(dirname "$HELPER")/release.py" \
+            --artifacts "$GITHUB_WORKSPACE/unsigned-package" \
+            --msign "$RUNNER_TEMP/host-tools/release/msign" \
+            --package-id org.mochios.edit \
+            --commit "$SOURCE_COMMIT" \
+            --sdk-ref 1ae906d7417e9882b11541e338552c3039c981fb \
+            --repository "$RELEASE_REPOSITORY" \
+            --environment app-release \
+            --reviewer-team 17892808 \
+            --branch "$RELEASE_BRANCH"

BUILDING.md

@@ -0,0 +1,36 @@
+# Native package builds
+
+The PR workflow builds Edit independently of the OS workspace using the pinned
+DevKit setup Action and published shared.8 SDK. It runs host unit tests, builds
+the native mochiOS executable, and uses the public `build-mpkg` Action to create
+an unsigned package. Native programs are inspected, not executed on Linux.
+
+Download `edit-unsigned-mpkg` from the successful Actions run. It contains
+`Edit.mpkg`, `SHA256SUMS`, `build-info.json`, and `resolved.Cargo.lock`. Review and
+commit an updated dependency resolution when changing SDK/source pins. Runner
+paths and the local SDK description are not distributed. The normal source
+manifest still supports built-in/preview staging; the package build derives
+digest-bound ordinary `/applications/Edit.app` installation metadata without
+built-in provenance, preserving declared resources, document roles and capabilities.
+
+Changes go to `staging` and a PR targeting `main`. PRs never sign or release.
+After merging, the default-branch workflow builds again and, once releases have
+been enabled, waits for approval in the `app-release` Environment. That
+environment is restricted to the default branch and reviewed by
+`mochiOS/application-maintainers`.
+
+Publication is initially disabled. Before setting the repository variable
+`APP_RELEASE_ENABLED=true`, configure these Environment values:
+
+* Secret `MSIGN_CERTIFICATE_B64`: base64 of the issued app Developer Certificate file.
+* Secret `MSIGN_PRIVATE_KEY_B64`: base64 of its corresponding private-key file.
+* Variable `MSIGN_ROOT_PUBLIC_KEY_B64`: base64 of the trusted issuer public-key file.
+
+Do not commit key files or use development fixture identities. The approval job
+does not check out or run application code. It checks the build's source commit,
+SDK Action revision, actual package ID, and unsigned checksum, signs with msign,
+checks that the configured Team approval and branch restrictions are still present,
+then verifies the signature/certificate/payload before publishing. It creates a
+prerelease named `v<version>-r<revision>` and never replaces existing tags or assets.
+Increase `package.revision` before another release of the same version. An
+approval cannot override a missing, invalid, expired or insufficient signing identity.