built in notarization #14
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Build and Release | |
| on: | |
| push: | |
| tags: | |
| - "v*.*.*" | |
| workflow_dispatch: | |
| permissions: | |
| contents: write | |
| jobs: | |
| build: | |
| runs-on: macos-latest | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@v5 | |
| - name: Setup Node.js | |
| uses: actions/setup-node@v4 | |
| with: | |
| node-version: '20' | |
| cache: 'npm' | |
| - name: Install dependencies | |
| run: npm ci | |
| - name: Setup code signing | |
| if: env.APPLE_CERTIFICATE != '' | |
| env: | |
| APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }} | |
| APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }} | |
| run: | | |
| # Create keychain | |
| security create-keychain -p "build" build.keychain | |
| security default-keychain -s build.keychain | |
| security unlock-keychain -p "build" build.keychain | |
| security set-keychain-settings -t 3600 -u build.keychain | |
| # Import certificate | |
| echo "$APPLE_CERTIFICATE" | base64 --decode > $RUNNER_TEMP/certificate.p12 | |
| security import $RUNNER_TEMP/certificate.p12 -k build.keychain -P "$APPLE_CERTIFICATE_PASSWORD" -T /usr/bin/codesign -T /usr/bin/security | |
| security set-key-partition-list -S apple-tool:,apple:,codesign: -s -k "build" build.keychain | |
| security list-keychains -d user -s build.keychain $(security list-keychains -d user | tr -d '"') | |
| rm $RUNNER_TEMP/certificate.p12 | |
| # Verify certificate import | |
| echo "=== Signing identities ===" | |
| security find-identity -v -p codesigning | |
| IDENTITY_COUNT=$(security find-identity -v -p codesigning | grep -c "valid identities found" || echo "0") | |
| if echo "$IDENTITY_COUNT" | grep -q "0"; then | |
| echo "WARNING: No code signing identity found. Check that APPLE_CERTIFICATE contains a Developer ID Application certificate with private key." | |
| fi | |
| - name: Build application | |
| run: npm run build | |
| - name: Sign native binary | |
| if: env.APPLE_CERTIFICATE != '' | |
| env: | |
| APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }} | |
| run: | | |
| security unlock-keychain -p "build" build.keychain | |
| IDENTITY=$(security find-identity -v -p codesigning | grep "Developer ID Application" | head -1 | awk -F'"' '{print $2}') | |
| if [ -n "$IDENTITY" ] && [ -f "native/mouse-telemetry" ]; then | |
| echo "Signing native/mouse-telemetry with: $IDENTITY" | |
| codesign --force --options runtime --timestamp --sign "$IDENTITY" native/mouse-telemetry | |
| codesign -vv native/mouse-telemetry | |
| else | |
| echo "Skipping native binary signing (no identity or binary not found)" | |
| fi | |
| - name: Package and notarize | |
| env: | |
| APPLE_ID: ${{ secrets.APPLE_ID }} | |
| APPLE_APP_SPECIFIC_PASSWORD: ${{ secrets.APPLE_APP_SPECIFIC_PASSWORD }} | |
| APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }} | |
| CSC_KEYCHAIN: build.keychain | |
| CSC_KEYCHAIN_PASSWORD: build | |
| run: | | |
| security unlock-keychain -p "build" build.keychain | |
| npm run package:mac -- --publish never | |
| - name: Staple notarization | |
| if: env.APPLE_ID != '' | |
| env: | |
| APPLE_ID: ${{ secrets.APPLE_ID }} | |
| run: | | |
| # Staple the DMG | |
| for dmg in release/*.dmg; do | |
| if [ -f "$dmg" ]; then | |
| echo "Stapling $dmg" | |
| xcrun stapler staple "$dmg" || echo "Failed to staple $dmg" | |
| fi | |
| done | |
| - name: Upload release artifacts | |
| uses: softprops/action-gh-release@v2 | |
| with: | |
| token: ${{ secrets.GITHUB_TOKEN }} | |
| files: | | |
| release/*.dmg | |
| release/*.zip |