macos/.github/workflows/package.yml

name: Build install packages

on:
  workflow_dispatch:
  push:
    branches:
      - dev
    paths:
      - '.github/workflows/package.yml'
      - 'src/install/admin/**'
      - 'src/install/setup/**'
      - 'assets/install/setup/**'

jobs:
  package:
    runs-on: macos-15

    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Build install packages
        shell: bash
        run: |
          set -Eeuo pipefail

          work="$RUNNER_TEMP/macos-packages"
          rm -rf "$work"
          mkdir -p \
            "$work/admin/root/private/tmp" \
            "$work/admin/scripts" \
            "$work/setup/root/private/var/db" \
            "$work/setup/root/Library/User Template/English.lproj" \
            "$work/setup/scripts" \
            assets/install/package

          # Match pycreateuserpkg's known-working startosinstall layout:
          # a real (but effectively empty) payload plus the account logic in scripts.
          chmod 1777 "$work/admin/root/private/tmp"

          python3 src/install/admin/create.py \
            "$work/admin/scripts" \
            admin \
            admin \
            Y

          cp src/install/admin/postinstall "$work/admin/scripts/postinstall"
          chmod 0755 "$work/admin/scripts/postinstall" "$work/admin/scripts/config"
          chmod 0600 "$work/admin/scripts/user.plist"
          [ ! -f "$work/admin/scripts/kcpassword" ] || chmod 0600 "$work/admin/scripts/kcpassword"

          python3 src/install/admin/validate.py \
            "$work/admin/scripts/user.plist" \
            admin

          pkgbuild \
            --root "$work/admin/root" \
            --ownership recommended \
            --identifier com.macos.install.admin \
            --version 1.0 \
            --scripts "$work/admin/scripts" \
            "$work/admin/component.pkg"

          productbuild \
            --package "$work/admin/component.pkg" \
            --identifier com.macos.install.admin \
            --version 1.0 \
            assets/install/package/admin.pkg

          # Put the two critical Setup Assistant markers in the payload itself.
          # The postinstall remains responsible for generating the version-specific
          # SetupAssistant preference plist.
          touch "$work/setup/root/private/var/db/.AppleSetupDone"
          touch "$work/setup/root/Library/User Template/English.lproj/.skipbuddy"
          chmod 0644 \
            "$work/setup/root/private/var/db/.AppleSetupDone" \
            "$work/setup/root/Library/User Template/English.lproj/.skipbuddy"

          cp src/install/setup/postinstall "$work/setup/scripts/postinstall"
          cp assets/install/setup/com.apple.SetupAssistant.plist \
            "$work/setup/scripts/com.apple.SetupAssistant.plist"
          chmod 0755 "$work/setup/scripts/postinstall"
          chmod 0644 "$work/setup/scripts/com.apple.SetupAssistant.plist"

          bash -n "$work/setup/scripts/postinstall"

          pkgbuild \
            --root "$work/setup/root" \
            --ownership recommended \
            --identifier com.macos.install.skipsetup \
            --version 1.0 \
            --scripts "$work/setup/scripts" \
            "$work/setup/component.pkg"

          productbuild \
            --package "$work/setup/component.pkg" \
            --identifier com.macos.install.skipsetup \
            --version 1.0 \
            assets/install/package/skipsetup.pkg

      - name: Verify install packages
        shell: bash
        run: |
          set -Eeuo pipefail

          for package in admin skipsetup; do
            file="assets/install/package/$package.pkg"
            [ -s "$file" ]

            listing=$(xar -tf "$file")
            grep -Fxq 'Distribution' <<< "$listing"
            grep -Fxq 'component.pkg/PackageInfo' <<< "$listing"
            grep -Fxq 'component.pkg/Payload' <<< "$listing"
            grep -Fxq 'component.pkg/Scripts' <<< "$listing"

            dir="$RUNNER_TEMP/verify-$package"
            rm -rf "$dir"
            mkdir -p "$dir"
            (cd "$dir" && xar -xf "$GITHUB_WORKSPACE/$file")

            grep -Fq "<product id=\"com.macos.install.$package\"" \
              "$dir/Distribution"

            scripts_listing=$(gzip -dc "$dir/component.pkg/Scripts" | cpio -it 2>/dev/null)
            grep -Fxq './postinstall' <<< "$scripts_listing"

            payload_listing=$(gzip -dc "$dir/component.pkg/Payload" | cpio -it 2>/dev/null)

            case "$package" in
              admin)
                grep -Fxq './private/tmp' <<< "$payload_listing"
                ;;
              skipsetup)
                grep -Fxq './private/var/db/.AppleSetupDone' <<< "$payload_listing"
                grep -Fxq './Library/User Template/English.lproj/.skipbuddy' <<< "$payload_listing"
                ;;
            esac
          done

          shasum -a 256 \
            assets/install/package/admin.pkg \
            assets/install/package/skipsetup.pkg

      - name: Upload install packages
        uses: actions/upload-artifact@v4
        with:
          name: macos-install-packages-${{ github.run_id }}-${{ github.run_attempt }}
          if-no-files-found: error
          path: |
            assets/install/package/admin.pkg
            assets/install/package/skipsetup.pkg