Amore Release Action

Build, sign, notarize, and publish a macOS app release via the Amore CLI, in one GitHub Actions step.

The action installs the Amore CLI on the runner, imports your Developer ID certificate, then runs amore release: archive, code sign, DMG, notarize, Sparkle sign, and upload.

Quick start

Copy this into .github/workflows/release.yml and fill in your scheme, runner, and Xcode. Pushing a v* tag ships a stable release; use the manual run for betas.

name: Release
run-name: Release ${{ github.event.repository.name }}${{ inputs.beta && ' (beta)' || '' }}

on:
  push:
    tags: ['v*']
  workflow_dispatch:
    inputs:
      beta:
        type: boolean
        default: false
        description: Publish as beta channel
      build-number:
        type: string
        default: timestamp
        description: Build number (integer or "timestamp")
      marketing-version:
        type: string
        default: ""
        description: Override marketing version (e.g. 1.0.1)

concurrency:
  group: amore-release
  cancel-in-progress: true

jobs:
  release:
    runs-on: macos-15          # pick the runner your project supports
    steps:
      - uses: actions/checkout@v4

      - uses: AmoreComputer/release-action@v1
        with:
          # Pin Xcode to what your project builds with. Do not rely on the runner
          # default drifting to a version that breaks your build.
          xcode-path: /Applications/Xcode_16.app
          scheme: YourScheme
          codesign-identity: ${{ secrets.CODESIGN_IDENTITY }}
          dev-id-cert-p12: ${{ secrets.DEV_ID_CERT_P12 }}
          dev-id-cert-password: ${{ secrets.DEV_ID_CERT_PASSWORD }}
          sparkle-private-key: ${{ secrets.SPARKLE_PRIVATE_KEY }}
          asc-api-key-id: ${{ secrets.ASC_API_KEY_ID }}
          asc-api-issuer: ${{ secrets.ASC_API_ISSUER }}
          asc-api-key: ${{ secrets.ASC_API_KEY }}
          amore-token: ${{ secrets.AMORE_TOKEN }}
          beta: ${{ inputs.beta || 'false' }}
          build-number: ${{ inputs.build-number || 'timestamp' }}
          marketing-version: ${{ inputs.marketing-version }}
          # --- Self-hosted S3 hosting only (uncomment if not using Amore hosting) ---
          # s3-bucket: ${{ vars.AMORE_S3_BUCKET }}
          # s3-region: ${{ vars.AMORE_S3_REGION }}
          # s3-public-url: ${{ vars.AMORE_S3_PUBLIC_URL }}
          # s3-endpoint: ${{ vars.AMORE_S3_ENDPOINT }}
          # aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
          # aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}

Secrets

Set these in your repo under Settings → Secrets and variables → Actions.

Amore-managed hosting (the common case) needs:

Secret	What it is
AMORE_TOKEN	Scoped Amore API token.
CODESIGN_IDENTITY	Developer ID Application identity string.
DEV_ID_CERT_P12	base64 of your Developer ID Application .p12.
DEV_ID_CERT_PASSWORD	Password for that .p12.
SPARKLE_PRIVATE_KEY	base64 Ed25519 Sparkle signing key.
ASC_API_KEY_ID	App Store Connect API key ID (for notarization).
ASC_API_ISSUER	App Store Connect API issuer ID.
ASC_API_KEY	base64 of the ASC .p8 key.

Self-hosting on S3 / R2 / MinIO instead of Amore hosting? Also set AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY, and uncomment the s3-* inputs.

Inputs

scheme is the Xcode scheme to build. Everything else has a sensible default; see action.yml for the full list, including path, release-notes, critical, draft, phased-rollout, and the s3-* hosting inputs.

Outputs

version, build-number, bundle-id, download-url, latest-url.

Versioning

Pin the major tag @v1 to get non-breaking fixes automatically. Breaking changes ship under @v2, which you opt into by editing the ref.