Skip to content

Commit 444ecdc

Browse files
cjlapaocjlapao
authored
initial changes to sign the macOS file with notify (#265)
* initial changes to sign the macOS file with notify * fixed an issue with the publish step * attempt to fix the sed issue * further fixes with the signin process * further fixes to the sign of the file * fixed path issue * attempt without entitlements * attempt signing on self hosted * wip * fixing the keychain issues * wip * wip * wip * wip * updated the release version * final push * added fix to the linux pipeline * wip * fixing the md5 issue * final push to add the signed binary
1 parent 3e7beba commit 444ecdc

File tree

12 files changed

+319
-40
lines changed

12 files changed

+319
-40
lines changed

‎.github/workflows/automation.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -41,7 +41,7 @@ jobs:
4141
runs-on: ubuntu-latest
4242
steps:
4343
- name: git checkout
44-
uses: actions/checkout@v3
44+
uses: actions/checkout@v4
4545
- name: I
4646
run: |
4747
echo ${{ github.event_name }}
@@ -63,7 +63,7 @@ jobs:
6363
runs-on: ubuntu-latest
6464
steps:
6565
- name: git checkout
66-
uses: actions/checkout@v3
66+
uses: actions/checkout@v4
6767
- name: Assign Security Label
6868
if: ${{ github.event.pull_request.draft == false }}
6969
env:

‎.github/workflows/milestones.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,7 @@ jobs:
1515
runs-on: ubuntu-latest
1616
steps:
1717
- name: git checkout
18-
uses: actions/checkout@v3
18+
uses: actions/checkout@v4
1919
- name: Assign Milestone
2020
env:
2121
GH_TOKEN: ${{ secrets.PARALLELS_WORKFLOW_PAT }}

‎.github/workflows/pr.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -19,7 +19,7 @@ jobs:
1919
- goarch: "386"
2020
goos: darwin
2121
steps:
22-
- uses: actions/checkout@v1
22+
- uses: actions/checkout@v4
2323
- name: Setup Go 1.21.x
2424
uses: actions/setup-go@v4
2525
with:
@@ -42,7 +42,7 @@ jobs:
4242
name: Test
4343
runs-on: ubuntu-latest
4444
steps:
45-
- uses: actions/checkout@v1
45+
- uses: actions/checkout@v4
4646
- name: Setup Go 1.21.x
4747
uses: actions/setup-go@v4
4848
with:

‎.github/workflows/projects.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -14,7 +14,7 @@ jobs:
1414
runs-on: ubuntu-latest
1515
steps:
1616
- name: git checkout
17-
uses: actions/checkout@v3
17+
uses: actions/checkout@v4
1818

1919
- name: Assign Project
2020
env:

‎.github/workflows/publish.yml‎

Lines changed: 130 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -21,7 +21,7 @@ jobs:
2121
permissions:
2222
contents: read
2323
steps:
24-
- uses: actions/checkout@v3
24+
- uses: actions/checkout@v4
2525
- name: Check if version has changed
2626
id: check-version
2727
uses: actions/github-script@v6
@@ -76,7 +76,7 @@ jobs:
7676
outputs:
7777
version: ${{ env.EXT_VERSION }}
7878
steps:
79-
- uses: actions/checkout@v3
79+
- uses: actions/checkout@v4
8080
- name: Parse version from package.json
8181
run: |
8282
echo "EXT_VERSION=$(cat ./VERSION)" >> "$GITHUB_ENV"
@@ -109,17 +109,28 @@ jobs:
109109
fail-fast: false
110110
matrix:
111111
# build and publish in parallel: linux/386, linux/amd64, linux/arm64, windows/386, windows/amd64, darwin/amd64, darwin/arm64
112-
goos: [linux, windows, darwin]
112+
goos: [linux, windows]
113113
goarch: ["386", amd64, arm64]
114114
exclude:
115115
- goarch: "386"
116116
goos: darwin
117117
steps:
118-
- uses: actions/checkout@v3
118+
- uses: actions/checkout@v4
119+
- name: Setup Go 1.21.x
120+
uses: actions/setup-go@v4
121+
with:
122+
go-version: "1.21.x"
123+
cache-dependency-path: ${{ github.workspace }}/src/go.sum
119124
- name: Add Inbuilt Variables
120125
run: |
121-
sed -i "s/var AmplitudeApiKey = \"\"/var AmplitudeApiKey = \"${{ env.AmplitudeApiKey }}\"/g" ./src/constants/amplitude.go
126+
sed -i "/@version/c\//\t@version\t\t$EXT_VERSION" ./src/main.go
122127
128+
go install github.com/swaggo/swag/cmd/swag@latest
129+
cd src
130+
go mod tidy
131+
swag fmt
132+
swag init -g main.go
133+
cd ..
123134
- uses: wangyoucao577/go-release-action@v1
124135
timeout-minutes: 10
125136
with:
@@ -130,7 +141,114 @@ jobs:
130141
project_path: "./src"
131142
binary_name: "prldevops"
132143
release_name: "v${{ env.EXT_VERSION }}"
144+
ldflags: "-s -w -X main.ver=${{ env.EXT_VERSION }} -X 'github.com/Parallels/prl-devops-service/telemetry.AmplitudeApiKey=${{ env.AmplitudeApiKey }}'"
145+
releases-macos-matrix:
146+
needs:
147+
- release
148+
runs-on: macos-latest
149+
name: Release Go Binary
150+
env:
151+
EXT_VERSION: ${{ needs.beta-release.outputs.version }}
152+
AMPLITUDE_API_KEY: ${{ secrets.AMPLITUDE_API_KEY }}
153+
APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }}
154+
APPLE_CERT_PASSWORD: ${{ secrets.APPLE_CERT_PASSWORD }}
155+
APPLE_API_KEY_ID: ${{ secrets.APPLE_API_KEY_ID }}
156+
APPLE_API_KEY_ISSUER: ${{ secrets.APPLE_API_KEY_ISSUER }}
157+
APPLE_API_KEY: ${{ secrets.APPLE_API_KEY }}
158+
APPLE_DEVELOPER_IDENTITY: ${{ secrets.APPLE_DEVELOPER_IDENTITY }}
159+
strategy:
160+
fail-fast: false
161+
matrix:
162+
# build and publish in parallel: darwin/amd64, darwin/arm64
163+
goos: [darwin]
164+
goarch: [amd64, arm64]
165+
steps:
166+
- uses: actions/checkout@v4
167+
- name: Setup Go 1.21.x
168+
uses: actions/setup-go@v4
169+
with:
170+
go-version: "1.21.x"
171+
cache-dependency-path: ${{ github.workspace }}/src/go.sum
172+
- name: Add Inbuilt Variables
173+
run: |
174+
brew install gnu-sed
133175
176+
gsed -i "/@version/c\//\t@version\t\t$EXT_VERSION" ./src/main.go
177+
178+
go install github.com/swaggo/swag/cmd/swag@latest
179+
cd src
180+
go mod tidy
181+
swag fmt
182+
swag init -g main.go
183+
cd ..
184+
- name: Build
185+
run: |
186+
cd src && go build -ldflags="-s -w -X main.ver=$EXT_VERSION -X 'github.com/Parallels/prl-devops-service/constants.AmplitudeApiKey=$AMPLITUDE_API_KEY'" -o prldevops
187+
- name: Create and Unlock Temporary Keychain
188+
run: |
189+
security create-keychain -p "github" temp.keychain
190+
security unlock-keychain -p "github" temp.keychain
191+
security set-keychain-settings -lut 3600 temp.keychain
192+
security list-keychains -s temp.keychain
193+
194+
- name: Import sign certificate
195+
run: |
196+
echo "${{ secrets.APPLE_CERTIFICATE }}" | base64 --decode > apple_developer_identity.p12
197+
security import apple_developer_identity.p12 -k temp.keychain -P ${{ secrets.APPLE_CERT_PASSWORD }} -T /usr/bin/codesign
198+
rm apple_developer_identity.p12
199+
security set-key-partition-list -S apple-tool:,apple: -s -k "github" temp.keychain
200+
security list-keychains
201+
security find-identity -v -p codesigning temp.keychain
202+
203+
- name: Import notary credentials
204+
run: |
205+
echo "${{ secrets.APPLE_API_KEY }}" | base64 --decode > apple_api_key.p8
206+
xcrun notarytool store-credentials "notary-credentials" \
207+
--key apple_api_key.p8 \
208+
--key-id ${{ secrets.APPLE_API_KEY_ID }} \
209+
--issuer ${{ secrets.APPLE_API_KEY_ISSUER }}
210+
211+
- name: Sign binary
212+
run: |
213+
cd src
214+
codesign --force --deep --strict --verbose --options=runtime,library --sign "${{ secrets.APPLE_DEVELOPER_IDENTITY }}" prldevops
215+
ditto -c -k --sequesterRsrc prldevops prldevops.zip
216+
xcrun notarytool submit prldevops.zip --keychain-profile "notary-credentials" --wait
217+
218+
- name: Verify signed binary
219+
run: |
220+
cd src
221+
codesign --verify --verbose prldevops
222+
spctl -t open --context context:primary-signature -a -vvv prldevops
223+
224+
- name: Compress asset to tar.gz
225+
run: |
226+
cd src
227+
tar -czf prldevops--${{ matrix.goos }}-${{ matrix.goarch }}.tar.gz prldevops
228+
md5 prldevops--${{ matrix.goos }}-${{ matrix.goarch }}.tar.gz | awk '{print $4}' > prldevops--${{ matrix.goos }}-${{ matrix.goarch }}.tar.gz.md5
229+
230+
- name: Upload release asset
231+
uses: actions/[email protected]
232+
env:
233+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
234+
with:
235+
upload_url: ${{ needs.beta-release.outputs.upload_url }}
236+
asset_path: src/prldevops--${{ matrix.goos }}-${{ matrix.goarch }}.tar.gz
237+
asset_name: prldevops--${{ matrix.goos }}-${{ matrix.goarch }}.tar.gz
238+
asset_content_type: application/octet-stream
239+
- name: Upload release asset checksum
240+
uses: actions/[email protected]
241+
env:
242+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
243+
with:
244+
upload_url: ${{ needs.beta-release.outputs.upload_url }}
245+
asset_path: src/prldevops--${{ matrix.goos }}-${{ matrix.goarch }}.tar.gz.md5
246+
asset_name: prldevops--${{ matrix.goos }}-${{ matrix.goarch }}.tar.gz.md5
247+
asset_content_type: application/octet-stream
248+
- name: Clean Up Keychain
249+
if: always()
250+
run: |
251+
security delete-keychain temp.keychain
134252
build-containers:
135253
needs: release
136254
env:
@@ -139,21 +257,22 @@ jobs:
139257
name: Build Docker Images
140258
runs-on: ubuntu-latest
141259
steps:
142-
- uses: actions/checkout@v3
143-
- name: Add Inbuilt Variables
144-
run: |
145-
sed -i "s/var AmplitudeApiKey = \"\"/var AmplitudeApiKey = \"${{ env.AmplitudeApiKey }}\"/g" ./src/constants/amplitude.go
146-
- uses: docker/setup-buildx-action@v1
260+
- uses: actions/checkout@v4
261+
- uses: docker/setup-buildx-action@v3
147262
- uses: docker/login-action@v1
148263
with:
149264
username: ${{ secrets.DOCKER_USERNAME }}
150265
password: ${{ secrets.DOCKER_PASSWORD }}
151-
- uses: docker/build-push-action@v2
266+
- uses: docker/build-push-action@v6
152267
with:
153268
context: .
154269
file: ./Dockerfile
155270
platforms: linux/amd64,linux/arm64
156271
push: true
272+
build-args: |
273+
VERSION=${{ env.EXT_VERSION }}
274+
secrets: |
275+
amplitude_api_key=${{ secrets.AMPLITUDE_API_KEY }}
157276
tags: |
158277
${{ secrets.DOCKER_USERNAME }}/prl-devops-service:latest
159278
${{ secrets.DOCKER_USERNAME }}/prl-devops-service:${{ env.EXT_VERSION }}

0 commit comments

Comments
 (0)