fix workflow #7
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Build and Release | |
| on: | |
| push: | |
| tags: | |
| - "v*.*.*" | |
| workflow_dispatch: | |
| permissions: | |
| contents: write | |
| jobs: | |
| build: | |
| runs-on: macos-latest | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@v5 | |
| - name: Setup Node.js | |
| uses: actions/setup-node@v4 | |
| with: | |
| node-version: '20' | |
| cache: 'npm' | |
| - name: Install dependencies | |
| run: npm ci | |
| - name: Import code signing certificate | |
| if: env.APPLE_CERTIFICATE != '' | |
| env: | |
| APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }} | |
| APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }} | |
| run: | | |
| echo "$APPLE_CERTIFICATE" | base64 --decode > certificate.p12 | |
| security create-keychain -p "" build.keychain | |
| security default-keychain -s build.keychain | |
| security unlock-keychain -p "" build.keychain | |
| security import certificate.p12 -k build.keychain -P "$APPLE_CERTIFICATE_PASSWORD" -T /usr/bin/codesign -T /usr/bin/security | |
| security set-key-partition-list -S apple-tool:,apple:,codesign: -s -k "" build.keychain | |
| rm certificate.p12 | |
| - name: Build application | |
| run: npm run build | |
| - name: Sign native binaries | |
| if: env.APPLE_CERTIFICATE != '' | |
| env: | |
| APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }} | |
| run: | | |
| # Find the signing identity | |
| IDENTITY=$(security find-identity -v -p codesigning build.keychain | grep "Developer ID Application" | head -1 | awk -F'"' '{print $2}') | |
| echo "Using identity: $IDENTITY" | |
| # Sign the native mouse-telemetry binary with hardened runtime | |
| if [ -f "native/mouse-telemetry" ]; then | |
| codesign --force --options runtime --timestamp --sign "$IDENTITY" native/mouse-telemetry | |
| echo "Signed native/mouse-telemetry" | |
| codesign -vv native/mouse-telemetry | |
| fi | |
| - name: Package application | |
| env: | |
| APPLE_ID: ${{ secrets.APPLE_ID }} | |
| APPLE_APP_SPECIFIC_PASSWORD: ${{ secrets.APPLE_APP_SPECIFIC_PASSWORD }} | |
| APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }} | |
| CSC_KEYCHAIN: build.keychain | |
| run: npm run package:mac -- --publish never | |
| - name: Verify code signatures | |
| run: | | |
| echo "=== Verifying app bundle signature ===" | |
| APP_PATH=$(find release -name "*.app" -type d | head -1) | |
| echo "App path: $APP_PATH" | |
| # Verify the main app signature | |
| codesign -vv --deep "$APP_PATH" || echo "Deep verification failed" | |
| # List all Mach-O binaries and their signing status | |
| echo "=== Checking all binaries ===" | |
| find "$APP_PATH" -type f \( -perm +111 -o -name "*.dylib" -o -name "*.so" -o -name "*.node" \) 2>/dev/null | while read binary; do | |
| echo "Checking: $binary" | |
| codesign -vv "$binary" 2>&1 || echo " UNSIGNED or INVALID" | |
| done | |
| # Show the main executable info | |
| echo "=== Main executable info ===" | |
| codesign -dvv "$APP_PATH" | |
| - name: Notarize application | |
| if: env.APPLE_ID != '' && env.APPLE_APP_SPECIFIC_PASSWORD != '' | |
| env: | |
| APPLE_ID: ${{ secrets.APPLE_ID }} | |
| APPLE_APP_SPECIFIC_PASSWORD: ${{ secrets.APPLE_APP_SPECIFIC_PASSWORD }} | |
| APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }} | |
| run: | | |
| # Submit for notarization and capture output | |
| SUBMIT_OUTPUT=$(xcrun notarytool submit release/*.zip \ | |
| --apple-id "$APPLE_ID" \ | |
| --password "$APPLE_APP_SPECIFIC_PASSWORD" \ | |
| --team-id "$APPLE_TEAM_ID" \ | |
| --wait 2>&1) || true | |
| echo "$SUBMIT_OUTPUT" | |
| # Extract submission ID | |
| SUBMISSION_ID=$(echo "$SUBMIT_OUTPUT" | grep -m1 "id:" | awk '{print $2}') | |
| echo "Submission ID: $SUBMISSION_ID" | |
| # Check if notarization was successful | |
| if echo "$SUBMIT_OUTPUT" | grep -q "status: Accepted"; then | |
| echo "Notarization successful!" | |
| else | |
| echo "Notarization failed. Fetching detailed log..." | |
| xcrun notarytool log "$SUBMISSION_ID" \ | |
| --apple-id "$APPLE_ID" \ | |
| --password "$APPLE_APP_SPECIFIC_PASSWORD" \ | |
| --team-id "$APPLE_TEAM_ID" \ | |
| notarization-log.json | |
| cat notarization-log.json | |
| exit 1 | |
| fi | |
| - name: Staple notarization | |
| if: env.APPLE_ID != '' && env.APPLE_APP_SPECIFIC_PASSWORD != '' | |
| run: | | |
| xcrun stapler staple release/*.dmg | |
| xcrun stapler staple release/*.zip | |
| - name: Upload release artifacts | |
| uses: softprops/action-gh-release@v2 | |
| with: | |
| token: ${{ secrets.GITHUB_TOKEN }} | |
| files: | | |
| release/*.dmg | |
| release/*.zip | |