[email protected]

.github/workflows/update-release-tags.yml

@@ -1,7 +1,7 @@
 name: Update Release Tags
 on:
   push:
-    tags: '*'
+    tags: ['*']
   workflow_dispatch:
 jobs:
   update-release-tags:

.github/workflows/validate.yml

@@ -1,12 +1,10 @@
 name: validate
 on:
   push:
-    branches:
-      - 'main'
+    branches: ['main']
   pull_request:
     types: [opened, reopened, synchronize, ready_for_review]
-    branches:
-      - '*'
+    branches: ['*']
   # Allows you to run this workflow manually from the Actions tab
   workflow_dispatch:
 concurrency:
@@ -16,38 +14,35 @@ jobs:
   unity-build:
     if: github.event.pull_request.draft == false
     name: '(${{ matrix.unity-version }}) ${{ matrix.build-target }}'
+    permissions:
+      contents: read
     env:
       VERSION: ''
       TEMPLATE_PATH: ''
+      EXPORT_OPTION: ''
       UNITY_PROJECT_PATH: ''
     runs-on: ${{ matrix.os }}
     strategy:
       fail-fast: false
       matrix:
         os: [macos-latest]
-        unity-version: [2021.x, 2022.3.x, 6000.x]
-        build-target:
-          - iOS
-          - StandaloneOSX
-          - VisionOS
+        unity-version: [2021.x, 2022.x, 6000.x]
+        build-target: [iOS, StandaloneOSX, VisionOS]
         exclude:
           - os: macos-latest
             unity-version: 2021.x
             build-target: VisionOS
+          - os: macos-latest
+            unity-version: 2022.x
+            build-target: VisionOS
     steps:
       - uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
       - run: 'npm install -g openupm-cli'
-        # Installs the Unity Editor based on your project version text file
-        # sets -> env.UNITY_EDITOR_PATH
-        # sets -> env.UNITY_PROJECT_PATH
       - uses: RageAgainstThePixel/unity-setup@v1
         with:
           version-file: 'None'
           build-targets: ${{ matrix.build-target }}
           unity-version: ${{ matrix.unity-version }}
-          architecture: 'arm64'
       - name: Find Unity Template Path and Version
         run: |
           $rootPath = $env:UNITY_EDITOR_PATH -replace "Editor.*", ""
@@ -70,6 +65,21 @@ jobs:
               exit 1
             }
           echo "VERSION=$version" >> $env:GITHUB_ENV
+
+          # if the unity-version is 6000.x then set export option to app-store-connect otherwise set it to development
+          if ('${{ matrix.unity-version }}' -eq '6000.x') {
+            echo "EXPORT_OPTION=app-store-connect" >> $env:GITHUB_ENV
+          } else {
+            if ('${{ matrix.build-target }}' -eq 'StandaloneOSX') {
+                if ('${{ matrix.unity-version }}' -eq '2022.x') {
+                  echo "EXPORT_OPTION=steam" >> $env:GITHUB_ENV
+                } else {
+                  echo "EXPORT_OPTION=developer-id" >> $env:GITHUB_ENV
+                }
+            } else {
+              echo "EXPORT_OPTION=development" >> $env:GITHUB_ENV
+            }
+          }
         shell: pwsh
       - uses: RageAgainstThePixel/activate-unity-license@v1
         with:
@@ -96,6 +106,31 @@ jobs:
           build-target: ${{ matrix.build-target }}
           log-name: '${{ matrix.build-target }}-Build'
           args: '-quit -nographics -batchmode -executeMethod Utilities.Editor.BuildPipeline.UnityPlayerBuildTools.StartCommandLineBuild -sceneList Assets/Scenes/SampleScene.unity -export -enableAppleAutomaticSigning -bundleIdentifier com.rageagainstthepixel.xcode -versionName ${{ env.VERSION }}'
+      - name: Update Info.Plist with encryption compliance
+        shell: bash
+        run: |
+          set -xe
+          # find the Info.plist file in the build directory
+          # MacOSStandalone Info.plist path: /Users/runner/work/unity-xcode-builder/unity-xcode-builder/UnityProject/Builds/StandaloneOSX/com.test.buildalon.xcode/UnityProject/UnityProject/Info.plist
+          # all others: /Users/runner/work/unity-xcode-builder/unity-xcode-builder/UnityProject/Builds/iOS/com.test.buildalon.xcode/Info.plist
+          EXPORT_OPTION=${{ env.EXPORT_OPTION }}
+          if [ "$EXPORT_OPTION" != "app-store-connect" ]; then
+            exit 0
+          fi
+          TARGET_PLATFORM=${{ matrix.build-target }}
+          if [ "$TARGET_PLATFORM" == "StandaloneOSX" ]; then
+            INFO_PLIST_PATH="${{ env.UNITY_PROJECT_PATH }}/Builds/${{ matrix.build-target }}/com.test.buildalon.xcode/UnityProject/UnityProject/Info.plist"
+          else
+            INFO_PLIST_PATH="${{ env.UNITY_PROJECT_PATH }}/Builds/${{ matrix.build-target }}/com.test.buildalon.xcode/Info.plist"
+          fi
+          # make sure plist buddy is installed
+          if ! command -v /usr/libexec/PlistBuddy &> /dev/null
+          then
+              echo "PlistBuddy could not be found"
+              exit 1
+          fi
+          # set ITSAppUsesNonExemptEncryption to false in Info.plist using PlistBuddy
+          /usr/libexec/PlistBuddy -c "Add :ITSAppUsesNonExemptEncryption bool false" "$INFO_PLIST_PATH"
       - uses: ./ # RageAgainstThePixel/unity-xcode-builder
         id: xcode-build
         with:
@@ -104,8 +139,14 @@ jobs:
           app-store-connect-key-id: ${{ secrets.APP_STORE_CONNECT_KEY_ID }}
           app-store-connect-issuer-id: ${{ secrets.APP_STORE_CONNECT_ISSUER_ID }}
           team-id: ${{ secrets.APPLE_TEAM_ID }}
-          export-option: app-store
-          upload: ${{ matrix.unity-version == '6000.x' }}
+          export-option: ${{ env.EXPORT_OPTION }}
+          notarize: ${{ matrix.unity-version != '6000.x' }}
+          archive-type: pkg
+          test-groups: Beta
+          developer-id-application-certificate: ${{ secrets.DEVELOPER_ID_APPLICATION_CERT }}
+          developer-id-application-certificate-password: ${{ secrets.SIGNING_CERT_PASSWORD }}
+          developer-id-installer-certificate: ${{ secrets.DEVELOPER_ID_INSTALLER_CERT }}
+          developer-id-installer-certificate-password: ${{ secrets.SIGNING_CERT_PASSWORD }}
       - name: print outputs
         if: always()
         run: |

README.md

@@ -13,7 +13,7 @@ To archive, export, and upload directly to Apple App Store Connect, use the foll
 
 ```yaml
 steps:
-  - uses: RageAgainstThePixel/unity-xcode-builder@v1
+  - uses: buildalon/unity-xcode-builder@v1
     id: xcode-build
     with:
       project-path: '/path/to/your/build/output/directory'
@@ -49,25 +49,32 @@ This action requires several secrets that need to be setup in the repository or
 | `app-store-connect-key` | The App Store Connect API AuthKey_*.p8 key encoded as base64 string. | true |
 | `app-store-connect-key-id` | The App Store Connect API key id. | true |
 | `app-store-connect-issuer-id` | The issuer ID of the App Store Connect API key. | true |
-| `certificate` | Exported signing certificate.p12 encoded as base64 string. Overrides the automatic signing in Xcode. | Defaults to Automatic signing. |
-| `certificate-password` | The password for the exported certificate. | Required if `certificate` is provided. |
-| `signing-identity` | The signing identity to use for signing the Xcode project. | Parsed from the `certificate` if not provided. |
+| `manual-signing-certificate` | Exported signing certificate.p12 encoded as base64 string. Overrides the automatic signing in Xcode. | Defaults to Automatic signing. |
+| `manual-signing-certificate-password` | The password for the exported certificate. | Required if `manual-signing-certificate` is provided. |
+| `manual-signing-identity` | The signing identity to use for signing the Xcode project. | Parsed from the `manual-signing-certificate` if not provided. |
 | `provisioning-profile` | The provisioning profile to use as base64 string. Use when manually signing the Xcode project. | Defaults to Automatic signing. |
 | `provisioning-profile-name` | The name of the provisioning profile file, including the type to use for signing the Xcode project. Must end with either `.mobileprovision` or `.provisionprofile`. | Required if `provisioning-profile` is provided. |
-| `team-id` | The team ID to use for signing the Xcode project. | Defaults to parsing team ID from `certificate` if provided. |
+| `team-id` | The team ID to use for signing the Xcode project. | Defaults to parsing team ID from `manual-signing-certificate` if provided. |
 | `bundle-id` | The bundle ID of the Xcode project. Overrides the value in the exported Unity project. | Defaults to parsing bundle ID from `.xcodeproj`. |
 | `configuration` | The configuration to build the Xcode project with. | Defaults to `Release`. |
 | `scheme` | The scheme to use when building the xcode project. | false |
 | `destination` | The destination to use when building the xcode project. | Defaults to `generic/platform={platform}`. |
 | `platform` | The platform to build for. Can be one of `iOS`, `macOS`, `tvOS`, `visionOS`. | Defaults to parsing platform from `.xcodeproj`. |
 | `platform-sdk-version` | The version of the platform SDK to use for building the Xcode project. | Defaults to the latest version of the platform SDK defined in the `.xcodeproj`. |
-| `export-option` | The export option to use for exporting the Xcode project. Can be one of `app-store-connect`, `steam`, `release-testing`, `package`, `enterprise`, `debugging`, `developer-id`, `mac-application`. | Defaults to `development` |
+| `export-option` | The export option to use for exporting the Xcode project. Can be one of `app-store-connect`, `steam`, `release-testing`, `enterprise`, `debugging`, `developer-id`, `mac-application`. | Defaults to `development` |
 | `export-option-plist` | The path to custom export option plist file to use when exporting the Xcode project. | Overrides `export-option`. |
 | `entitlements-plist` | The path to custom entitlements plist file. | Generates [default hardened runtime entitlements](https://developer.apple.com/documentation/security/hardened-runtime) if not provided. |
 | `notarize` | Whether to notarize the exported Xcode project. | Defaults to `true` if `export-option !== app-store-connect`. |
+| `archive-type` | The archive type to use when exporting macOS applications when not uploading to the App Store. Can be one of `app` or `pkg`. | Defaults to `app`. Forces `app` if `export-option === steam`. |
 | `upload` | Whether to upload the exported Xcode project to App Store Connect. | Defaults to `true` if `export-option === app-store-connect`. |
-| `whats-new` | When `uploading === true`, Let your testers know what you would like them to test in this build. This information will be available to testers in all groups who have access to this build. | Defaults to the last git commit sha, current branch name, and commit message. |
-| `auto-increment-build-number` | Whether to automatically increment the CFBundleVersion in the Xcode project. | Defaults to `true` if `export-option === app-store-connect`. |
+| `whats-new` | When `uploading === true`, Let your testers know what you would like them to test in this build. This information will be available to testers in all groups who have access to this build. | Defaults to the last git commit sha, current branch name, and commit message up to 4000 characters. |
+| `auto-increment-build-number` | Whether to automatically increment the `CFBundleVersion` in the Xcode project. | Defaults to `true` if `export-option === app-store-connect`. |
+| `test-groups` | One or more test groups to automatically add to the build when uploading to TestFlight. When using multiple groups, separate them with commas. | None by default. |
+| `submit-for-review` | Whether to submit the build for review when uploading to App Store Connect. | Defaults to `false`. |
+| `developer-id-application-certificate` | The `Developer ID Application` certificate encoded as base64 string. | Required if `export-option === steam` or `export-option === developer-id` or `notarize === true`. |
+| `developer-id-application-certificate-password` | The password for the `Developer ID Application` certificate. | Required if `developer-id-application-certificate` is provided. |
+| `developer-id-installer-certificate` | The `Developer ID Installer` certificate encoded as base64 string. | Required when creating an installer package for macOS application. |
+| `developer-id-installer-certificate-password` | The password for the `Developer ID Installer` certificate. | Required if `developer-id-installer-certificate` is provided. |
 
 ### outputs