Safari CI by birtles · Pull Request #2725 · birchill/10ten-ja-reader

birtles · 2026-01-15T06:17:18Z

Try to get our Safari builds to be created as part of triggering a release.

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: ba789143ad

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

chatgpt-codex-connector · 2026-02-16T07:45:00Z

+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v6


Build Safari artifacts from bumped commit

In the build_macos job, checkout uses the default workflow SHA instead of the commit created by bump (release-it pushes a new commit), so this job can produce iOS/macOS Safari artifacts from the previous revision while release tags and publishes needs.bump.outputs.sha. This can ship mismatched binaries/version metadata in the same release; set checkout ref to ${{ needs.bump.outputs.sha }} so all jobs build the same commit.

Useful? React with 👍 / 👎.

Copilot

Pull request overview

This PR automates Safari build creation as part of the release workflow. Previously, Safari builds had to be created manually on a Mac. Now they are built automatically when triggering a release.

Changes:

Adds export configuration plists for iOS and macOS Safari builds
Modifies release-it configuration to disable automatic tagging and GitHub release creation
Restructures the release workflow into three jobs: version bump, Safari builds, and release creation

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 8 comments.

File	Description
xcode13/ExportOptions-iOS.plist	Adds export configuration for iOS Safari app with App Store Connect settings and provisioning profiles
xcode13/ExportOptions-Mac.plist	Adds export configuration for macOS Safari app with App Store Connect settings and provisioning profiles (contains typo)
.release-it.json	Simplifies configuration to only bump version and push commit, removing hooks and GitHub release logic now handled by workflow
.github/workflows/release.yml	Restructures workflow into separate jobs for version bump, macOS builds (with signing and export), and release creation with artifact handling

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2026-02-16T07:53:03Z

+
+      - name: Build assets
+        run: |
+          pnpm install


The pnpm install command is missing the '--frozen-lockfile' flag. For consistency with the bump job (line 40) and to ensure reproducible builds, consider using 'pnpm install --frozen-lockfile' instead of just 'pnpm install'.

Suggested change

pnpm install

pnpm install --frozen-lockfile

Copilot · 2026-02-16T07:53:03Z

+    <key>jp.co.birchill.tenten-ja-reader</key>
+    <string>10ten Japanese Reader App Store Connect (Mac)</string>
+    <key>jp.co.birchill.tenten-ja-reader.Extension</key>
+    <string>10ten Japanese Reader Extension App Store ConnectM</string>


The provisioning profile name appears to have a typo. It should likely be "10ten Japanese Reader Extension App Store Connect (Mac)" to match the pattern on line 14, rather than "ConnectM".

Suggested change

<string>10ten Japanese Reader Extension App Store ConnectM</string>

<string>10ten Japanese Reader Extension App Store Connect (Mac)</string>

Copilot · 2026-02-16T07:53:03Z

+        run: |
+          # Save the cert and profiles to temp files
+          echo -n "$CERT_BASE64" | base64 --decode > cert.p12
+          echo -n "$MAC_INSTALLER_CERT_BASE64" | base64 --decode > mac-installer.p12
+          echo -n "$PROFILE_IOS" | base64 --decode > ios.mobileprovision
+          echo -n "$PROFILE_IOS_EXT" | base64 --decode > ios-ext.mobileprovision
+          echo -n "$PROFILE_MAC" | base64 --decode > mac.provisionprofile
+          echo -n "$PROFILE_MAC_EXT" | base64 --decode > mac-ext.provisionprofile
+
+          # Create a temporary keychain and import the .p12 certificate
+          security create-keychain -p "$KEYCHAIN_PASSWORD" build.keychain-db
+          security unlock-keychain -p "$KEYCHAIN_PASSWORD" build.keychain-db
+          security import cert.p12 -P "$P12_PASSWORD" -A -t cert -f pkcs12 -k build.keychain-db
+          security import mac-installer.p12 -P "$MAC_INSTALLER_CERT_PASSWORD" -A -t cert -f pkcs12 -k build.keychain-db
+          security set-key-partition-list -S apple-tool:,apple: -k "$KEYCHAIN_PASSWORD" build.keychain-db
+          security list-keychain -d user -s build.keychain-db
+
+          # Install provisioning profiles
+          mkdir -p ~/Library/MobileDevice/Provisioning\ Profiles
+          cp ios.mobileprovision ~/Library/MobileDevice/Provisioning\ Profiles/
+          cp ios-ext.mobileprovision ~/Library/MobileDevice/Provisioning\ Profiles/
+          cp mac.provisionprofile ~/Library/MobileDevice/Provisioning\ Profiles/
+          cp mac-ext.provisionprofile ~/Library/MobileDevice/Provisioning\ Profiles/


Sensitive files (cert.p12, mac-installer.p12, and provisioning profiles) are not cleaned up after use. These temporary files contain sensitive certificates and profiles that should be removed after installation. Consider adding a cleanup step or using a trap to ensure these files are deleted even if the build fails.

Copilot · 2026-02-16T07:53:04Z

+          security create-keychain -p "$KEYCHAIN_PASSWORD" build.keychain-db
+          security unlock-keychain -p "$KEYCHAIN_PASSWORD" build.keychain-db
+          security import cert.p12 -P "$P12_PASSWORD" -A -t cert -f pkcs12 -k build.keychain-db
+          security import mac-installer.p12 -P "$MAC_INSTALLER_CERT_PASSWORD" -A -t cert -f pkcs12 -k build.keychain-db
+          security set-key-partition-list -S apple-tool:,apple: -k "$KEYCHAIN_PASSWORD" build.keychain-db
+          security list-keychain -d user -s build.keychain-db


The temporary keychain 'build.keychain-db' is created but never deleted. After the build completes (or fails), the keychain should be removed to avoid leaving sensitive cryptographic material on the runner. Consider adding a cleanup step that runs even on failure, such as using a separate job step with 'if: always()' or adding cleanup commands after the export steps.

Copilot · 2026-02-16T07:53:04Z

+            -exportPath $GITHUB_WORKSPACE/build/10ten-ja-reader.ipa
+
+      - name: Export Mac app package
+        run: |
+          xcodebuild -exportArchive \
+            -archivePath $GITHUB_WORKSPACE/build/10ten-mac.xcarchive \
+            -exportOptionsPlist "xcode13/ExportOptions-Mac.plist" \
+            -exportPath $GITHUB_WORKSPACE/build/10ten-ja-reader.pkg


The exportPath is set to a directory path ending in '.ipa', but xcodebuild's -exportArchive expects a directory path, not a file path. The .ipa file will be created inside this directory. This means the actual file path will be something like '$GITHUB_WORKSPACE/build/10ten-ja-reader.ipa/10ten Japanese Reader.ipa', which won't match the artifact upload pattern '*.ipa'. The exportPath should be set to just '$GITHUB_WORKSPACE/build' or a proper directory name.

Suggested change

-exportPath $GITHUB_WORKSPACE/build/10ten-ja-reader.ipa

- name: Export Mac app package

run: |

xcodebuild -exportArchive \

-archivePath $GITHUB_WORKSPACE/build/10ten-mac.xcarchive \

-exportOptionsPlist "xcode13/ExportOptions-Mac.plist" \

-exportPath $GITHUB_WORKSPACE/build/10ten-ja-reader.pkg

-exportPath $GITHUB_WORKSPACE/build

- name: Export Mac app package

run: |

xcodebuild -exportArchive \

-archivePath $GITHUB_WORKSPACE/build/10ten-mac.xcarchive \

-exportOptionsPlist "xcode13/ExportOptions-Mac.plist" \

-exportPath $GITHUB_WORKSPACE/build

Copilot · 2026-02-16T07:53:04Z

+            -exportPath $GITHUB_WORKSPACE/build/10ten-ja-reader.ipa
+
+      - name: Export Mac app package
+        run: |
+          xcodebuild -exportArchive \
+            -archivePath $GITHUB_WORKSPACE/build/10ten-mac.xcarchive \
+            -exportOptionsPlist "xcode13/ExportOptions-Mac.plist" \
+            -exportPath $GITHUB_WORKSPACE/build/10ten-ja-reader.pkg


The exportPath is set to a directory path ending in '.pkg', but xcodebuild's -exportArchive expects a directory path, not a file path. The .pkg file will be created inside this directory. This means the actual file path will be something like '$GITHUB_WORKSPACE/build/10ten-ja-reader.pkg/10ten Japanese Reader.pkg', which won't match the artifact upload pattern '*.pkg'. The exportPath should be set to just '$GITHUB_WORKSPACE/build' or a proper directory name.

Suggested change

-exportPath $GITHUB_WORKSPACE/build/10ten-ja-reader.ipa

- name: Export Mac app package

run: |

xcodebuild -exportArchive \

-archivePath $GITHUB_WORKSPACE/build/10ten-mac.xcarchive \

-exportOptionsPlist "xcode13/ExportOptions-Mac.plist" \

-exportPath $GITHUB_WORKSPACE/build/10ten-ja-reader.pkg

-exportPath $GITHUB_WORKSPACE/build

- name: Export Mac app package

run: |

xcodebuild -exportArchive \

-archivePath $GITHUB_WORKSPACE/build/10ten-mac.xcarchive \

-exportOptionsPlist "xcode13/ExportOptions-Mac.plist" \

-exportPath $GITHUB_WORKSPACE/build

Copilot · 2026-02-16T07:53:04Z

+          echo -n "$PROFILE_MAC" | base64 --decode > mac.provisionprofile
+          echo -n "$PROFILE_MAC_EXT" | base64 --decode > mac-ext.provisionprofile
+
+          # Create a temporary keychain and import the .p12 certificate


The keychain creation command will fail if 'build.keychain-db' already exists from a previous run. Although GitHub Actions typically provides clean runners, it's safer to delete any existing keychain with the same name before creating a new one. Consider adding 'security delete-keychain build.keychain-db 2>/dev/null || true' before the create-keychain command.

Suggested change

# Create a temporary keychain and import the .p12 certificate

# Create a temporary keychain and import the .p12 certificate

security delete-keychain build.keychain-db 2>/dev/null || true

Copilot · 2026-02-16T07:53:04Z

+
+      - name: Build extension code
+        run: |-
+          pnpm install


The pnpm install command is missing the '--frozen-lockfile' flag. For consistency with the bump job (line 40) and to ensure reproducible builds, consider using 'pnpm install --frozen-lockfile' instead of just 'pnpm install'.

Suggested change

pnpm install

pnpm install --frozen-lockfile

birtles force-pushed the safari-ci branch 3 times, most recently from 9e0c089 to d0a4c91 Compare February 2, 2026 08:04

birtles added 16 commits February 16, 2026 15:14

chore: switch to manual signing

3b4ca4d

wip: add Safari CI steps

3200244

chore: add profiles for extension parts too

c14c5da

fix: drop trailing apostrophe

43cdc5f

chore: fix Mac scheme

eb5ba11

feat: export packages

abfc20c

chore: fix part to export options file

47102cb

chore: try fixing export options a bit more

2bb7ba0

chore: add mac installer cert

fa7a03a

chore: try dropping some flags

aa4ff72

chore: add a parameter

0e8b5cd

chore: try the other parameter

76490a4

chore: some more stuff

2490359

chore: start integrating into release workflow

f5e1958

chore: merge conflicting changes

c08d76f

chore: more tweaks and testing

3a3d066

birtles force-pushed the safari-ci branch from d0a4c91 to 3a3d066 Compare February 16, 2026 06:31

birtles added 10 commits February 16, 2026 15:35

chore: more tweaks

0778bab

chore: more random stuff

c1d2b85

chore: more random stuff

56b1d67

chore: hard code input

3759563

chore: hard code input

5a7d5bc

chore: fix upload-artifacts path

7bcab32

chore: set git username for both jobs

2950a0a

chore: try some stuff

f5f08bb

chore: more tweaks

05b8ebe

chore: check release assets

153d259

birtles added 2 commits February 16, 2026 16:34

chore: drop release test workflow

97d99fd

chore: align export options a bit better

ba78914

birtles marked this pull request as ready for review February 16, 2026 07:40

chatgpt-codex-connector Bot reviewed Feb 16, 2026

View reviewed changes

chore: use correct ref for Mac building

f43051a

birtles requested a review from Copilot February 16, 2026 07:46

Copilot started reviewing on behalf of birtles February 16, 2026 07:47 View session

Copilot AI reviewed Feb 16, 2026

View reviewed changes

birtles added 13 commits February 17, 2026 14:11

chore: address review feedback

eaa4a38

chore: add --verify-tag

abfe2b2

chore: add temporary build test workflow

613a5a3

chore: try dropping hard-coded development team

e1d7240

chore: try dropping some more stuff

e3572bb

chore: try dropping the same stuff from the release profile

f1116ed

chore: restore provisioning profile

925e310

chore: restore some more stuff

e19af63

chore: restore some more stuff

4981240

chore: restore all the stuff

390a2d7

chore: try dropping provisioning profiles from export options

445a370

chore: restore export options changes

9337d8d

chore: drop temporary mac build test workflow

6dc6246

birtles merged commit d11463e into main Feb 17, 2026
2 checks passed

birtles deleted the safari-ci branch February 17, 2026 05:45

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Safari CI#2725

Safari CI#2725
birtles merged 42 commits intomainfrom
safari-ci

birtles commented Jan 15, 2026 •

edited

Loading

Uh oh!

chatgpt-codex-connector Bot left a comment

Uh oh!

chatgpt-codex-connector Bot Feb 16, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI Feb 16, 2026

Uh oh!

Copilot AI Feb 16, 2026

Uh oh!

Copilot AI Feb 16, 2026

Uh oh!

Copilot AI Feb 16, 2026

Uh oh!

Copilot AI Feb 16, 2026

Uh oh!

Copilot AI Feb 16, 2026

Uh oh!

Copilot AI Feb 16, 2026

Uh oh!

Copilot AI Feb 16, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

	<string>10ten Japanese Reader Extension App Store ConnectM</string>
	<string>10ten Japanese Reader Extension App Store Connect (Mac)</string>

	# Create a temporary keychain and import the .p12 certificate
	# Create a temporary keychain and import the .p12 certificate
	security delete-keychain build.keychain-db 2>/dev/null \|\| true

Conversation

birtles commented Jan 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

chatgpt-codex-connector Bot Feb 16, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Copilot AI Feb 16, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 16, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 16, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 16, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 16, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 16, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 16, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 16, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

birtles commented Jan 15, 2026 •

edited

Loading