Skip to content

IEP-1720: ci(macos) switch to release-sign action for code signing #1406

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
kolipakakondal merged 1 commit into from
Apr 21, 2026
+23 −30
Merged

IEP-1720: ci(macos) switch to release-sign action for code signing #1406

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
53 changes: 23 additions & 30 deletions .github/workflows/ci.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -59,7 +59,7 @@ jobs:
runs-on: macos-latest

steps:
- uses: actions/checkout@v2
- uses: actions/checkout@v4

- name: Set up JDK 21
uses: actions/setup-java@v4
Expand Down Expand Up @@ -106,35 +106,28 @@ jobs:
path: releng/com.espressif.idf.product/target/products/Espressif-IDE-${{ env.VERSION }}-linux.gtk.aarch64.tar.gz

- name: Codesign Espressif-IDE
env:
MACOS_CERTIFICATE: ${{ secrets.MACOS_CERTIFICATE }}
MACOS_CERTIFICATE_PWD: ${{ secrets.MACOS_CERTIFICATE_PWD }}
run: |
echo $MACOS_CERTIFICATE | base64 --decode > certificate.p12
/usr/bin/security create-keychain -p espressif build.keychain
/usr/bin/security default-keychain -s build.keychain
/usr/bin/security unlock-keychain -p espressif build.keychain
/usr/bin/security import certificate.p12 -k build.keychain -P $MACOS_CERTIFICATE_PWD -T /usr/bin/codesign
/usr/bin/security set-key-partition-list -S apple-tool:,apple:,codesign: -s -k espressif build.keychain

echo "codesigning espressif-ide-macosx.cocoa.x86_64"
/usr/bin/codesign --entitlements $PWD/releng/com.espressif.idf.product/entitlements/espressif-ide.entitlement --options runtime --force -s "ESPRESSIF SYSTEMS (SHANGHAI) CO., LTD. (QWXF6GB4AV)" $PWD/releng/com.espressif.idf.product/target/products/com.espressif.idf.product/macosx/cocoa/x86_64/Espressif-IDE.app -v
/usr/bin/codesign -v -vvv --deep $PWD/releng/com.espressif.idf.product/target/products/com.espressif.idf.product/macosx/cocoa/x86_64/Espressif-IDE.app

echo "codesigning espressif-ide-macosx.cocoa.aarch64"
/usr/bin/codesign --entitlements $PWD/releng/com.espressif.idf.product/entitlements/espressif-ide.entitlement --options runtime --force -s "ESPRESSIF SYSTEMS (SHANGHAI) CO., LTD. (QWXF6GB4AV)" $PWD/releng/com.espressif.idf.product/target/products/com.espressif.idf.product/macosx/cocoa/aarch64/Espressif-IDE.app -v
/usr/bin/codesign -v -vvv --deep $PWD/releng/com.espressif.idf.product/target/products/com.espressif.idf.product/macosx/cocoa/aarch64/Espressif-IDE.app

echo "Creating dmg for espressif-ide-macosx.cocoa.x86_64"
$PWD/releng/ide-dmg-builder/ide-dmg-builder.sh
/usr/bin/codesign --entitlements $PWD/releng/com.espressif.idf.product/entitlements/espressif-ide.entitlement --options runtime --force -s "ESPRESSIF SYSTEMS (SHANGHAI) CO., LTD. (QWXF6GB4AV)" $PWD/releng/ide-dmg-builder/Espressif-IDE-macosx-cocoa-x86_64.dmg -v
/usr/bin/codesign -v -vvv --deep $PWD/releng/ide-dmg-builder/Espressif-IDE-macosx-cocoa-x86_64.dmg

echo "Creating dmg for espressif-ide-macosx.cocoa.aarch64"
$PWD/releng/ide-dmg-builder/ide-dmg-builder-aarch64.sh
/usr/bin/codesign --options runtime --force -s "ESPRESSIF SYSTEMS (SHANGHAI) CO., LTD. (QWXF6GB4AV)" $PWD/releng/ide-dmg-builder/Espressif-IDE-macosx-cocoa-aarch64.dmg -v
/usr/bin/codesign -v -vvv --deep $PWD/releng/ide-dmg-builder/Espressif-IDE-macosx-cocoa-aarch64.dmg

uses: espressif/release-sign@master
Copy link
Copy Markdown

@coderabbitai coderabbitai Bot Mar 3, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

🧩 Analysis chain

🏁 Script executed:

# First, let's check the file exists and view the relevant lines
cat -n .github/workflows/ci.yml | sed -n '105,130p'

Repository: espressif/idf-eclipse-plugin

Length of output: 1472

🏁 Script executed:

# Also verify the exact pattern at lines 109 and 124
sed -n '109p;124p' .github/workflows/ci.yml

Repository: espressif/idf-eclipse-plugin

Length of output: 155

🏁 Script executed:

# Search for all uses of espressif/release-sign in the file
rg -n 'espressif/release-sign' .github/workflows/ci.yml

Repository: espressif/idf-eclipse-plugin

Length of output: 163

🏁 Script executed:

# Search for all action uses in the workflow
rg -n 'uses:' .github/workflows/ci.yml | head -30

Repository: espressif/idf-eclipse-plugin

Length of output: 742

🏁 Script executed:

# Check what versions/tags are available for espressif/release-sign
# First let's see if there are any pinned versions in other workflows
fd -t f '\.yml$' -o '\.yaml$' .github/workflows/ -exec grep -l 'espressif/release-sign' {} \;

Repository: espressif/idf-eclipse-plugin

Length of output: 205

🏁 Script executed:

# Check for GitHub Actions best practices - search for pinned vs unpinned in entire workflow
rg '@(master|main|latest|develop|v[0-9])' .github/workflows/ci.yml | wc -l

Repository: espressif/idf-eclipse-plugin

Length of output: 74

Pin espressif/release-sign to a specific commit SHA.

Lines 109 and 124 use @master, which creates a mutable, non-reproducible release-signing path. All other actions in this workflow are pinned to specific versions. Replace both with a pinned commit SHA.

Suggested change 
-      uses: espressif/release-sign@master
+      uses: espressif/release-sign@<commit-sha>

Apply to both line 109 and line 124.

🤖 Prompt for AI Agents 
Verify each finding against the current code and only fix it if needed.

In @.github/workflows/ci.yml at line 109, The workflow currently references the
action string "uses: espressif/release-sign@master", which is mutable; update
both occurrences of that exact string to pin to a specific commit SHA (e.g.,
"uses: espressif/release-sign@<commit-sha>") so the release-sign action is
immutable and reproducible—replace both instances in the workflow.

with:
path: releng/com.espressif.idf.product/target/products/com.espressif.idf.product/macosx/cocoa
macos-signing-identity: ${{ secrets.MACOS_CS_IDENTITY_ID }}
macos-certificate: ${{ secrets.MACOS_CS_CERTIFICATE }}
macos-certificate-pwd: ${{ secrets.MACOS_CS_CERTIFICATE_PWD }}
macos-entitlements: releng/com.espressif.idf.product/entitlements/espressif-ide.entitlement

- name: Create DMG for macOS x86_64
run: $PWD/releng/ide-dmg-builder/ide-dmg-builder.sh

- name: Create DMG for macOS aarch64
run: $PWD/releng/ide-dmg-builder/ide-dmg-builder-aarch64.sh

- name: Codesign Espressif-IDE
uses: espressif/release-sign@master
with:
path: releng/ide-dmg-builder
macos-signing-identity: ${{ secrets.MACOS_CS_IDENTITY_ID }}
macos-certificate: ${{ secrets.MACOS_CS_CERTIFICATE }}
macos-certificate-pwd: ${{ secrets.MACOS_CS_CERTIFICATE_PWD }}

- name: Upload espressif-ide-macosx.cocoa.x86_64 dmg
if: ${{ !cancelled() }}
uses: actions/upload-artifact@v4
Expand Down
Loading