Skip to content

Build packages with GitHub Actions - #1

Open
guacforlife wants to merge 1 commit into
Lessica:mainfrom
guacforlife:ci/github-actions-build
Open

Build packages with GitHub Actions#1
guacforlife wants to merge 1 commit into
Lessica:mainfrom
guacforlife:ci/github-actions-build

Conversation

@guacforlife

Copy link
Copy Markdown

Adds a workflow that builds both packages in CI, so people on iOS 17 can install the fix without setting up Theos locally. No source, control, or Makefile changes.

What it builds

A macOS runner checks out both Theos forks, links the iOS SDK Xcode already provides on the runner, and builds twice from the same source:

Package Scheme Slices
iphoneos-arm64e roothide, as the Makefile declares arm64e
iphoneos-arm64 rootless arm64, arm64e

Both are uploaded as a packages artifact on every push and pull request. Pushing a v* tag publishes them as a release.

TARGET is overridden on the command line to iphone:clang:latest:17.0, so the build picks up whichever SDK the runner image ships while keeping the 17.0 deployment target the Makefile asks for.

codesign rather than ldid

The builds pass TARGET_CODESIGN=codesign with ad-hoc flags. ldid writes a signature that leaves the arm64e slice effectively unsigned, and current bootstraps then refuse to load the dylib.

Verify step

Two packaging mistakes produce a package that installs cleanly and then does nothing, because ElleKit skips the dylib without logging anything:

  • a filter plist that is not world readable
  • a dylib with no arm64e slice, on A12 and up

CI fails on either, so neither can reach a release.

Green run on the fork, including the published release: https://github.com/guacforlife/CranePKDServerFix/releases/tag/v0.0.1

Thanks for writing the fix.

Adds a workflow that builds the roothide (iphoneos-arm64e) and rootless
(iphoneos-arm64) packages on macOS runners, using the iOS SDK the runner
already provides through Xcode, so both are downloadable without a local
Theos setup.

Both builds sign with codesign instead of ldid. ldid writes a signature
that leaves the arm64e slice effectively unsigned, and current
bootstraps refuse to load it.

The verify step guards the two failure modes that produce a package
which installs cleanly and then does nothing: a filter plist that is not
world readable, and a dylib with no arm64e slice. ElleKit skips both
without logging anything.

Pushing a v* tag publishes the packages as a release.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant