fix workflow

Author: jasonzh0

.github/workflows/release.yml

@@ -12,7 +12,7 @@ permissions:
 jobs:
   build:
     runs-on: macos-latest
-    
+
     steps:
       - name: Checkout code
         uses: actions/checkout@v5
@@ -26,48 +26,88 @@ jobs:
       - name: Install dependencies
         run: npm ci
 
-      - name: Import code signing certificate
+      - name: Setup code signing
         if: env.APPLE_CERTIFICATE != ''
         env:
           APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }}
           APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
         run: |
-          echo "$APPLE_CERTIFICATE" | base64 --decode > certificate.p12
-          security create-keychain -p "" build.keychain
+          # Create keychain
+          security create-keychain -p "build" build.keychain
           security default-keychain -s build.keychain
-          security unlock-keychain -p "" build.keychain
-          security import certificate.p12 -k build.keychain -P "$APPLE_CERTIFICATE_PASSWORD" -T /usr/bin/codesign -T /usr/bin/security
-          security set-key-partition-list -S apple-tool:,apple:,codesign: -s -k "" build.keychain
-          rm certificate.p12
+          security unlock-keychain -p "build" build.keychain
+          security set-keychain-settings -t 3600 -u build.keychain
+
+          # Import certificate
+          echo "$APPLE_CERTIFICATE" | base64 --decode > $RUNNER_TEMP/certificate.p12
+          security import $RUNNER_TEMP/certificate.p12 -k build.keychain -P "$APPLE_CERTIFICATE_PASSWORD" -T /usr/bin/codesign -T /usr/bin/security
+          security set-key-partition-list -S apple-tool:,apple:,codesign: -s -k "build" build.keychain
+          security list-keychains -d user -s build.keychain $(security list-keychains -d user | tr -d '"')
+          rm $RUNNER_TEMP/certificate.p12
+
+          # Verify certificate import
+          echo "=== Signing identities ==="
+          security find-identity -v -p codesigning
+
+          IDENTITY_COUNT=$(security find-identity -v -p codesigning | grep -c "valid identities found" || echo "0")
+          if echo "$IDENTITY_COUNT" | grep -q "0"; then
+            echo "WARNING: No code signing identity found. Check that APPLE_CERTIFICATE contains a Developer ID Application certificate with private key."
+          fi
 
       - name: Build application
         run: npm run build
 
+      - name: Sign native binary
+        if: env.APPLE_CERTIFICATE != ''
+        env:
+          APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }}
+        run: |
+          security unlock-keychain -p "build" build.keychain
+
+          IDENTITY=$(security find-identity -v -p codesigning | grep "Developer ID Application" | head -1 | awk -F'"' '{print $2}')
+
+          if [ -n "$IDENTITY" ] && [ -f "native/mouse-telemetry" ]; then
+            echo "Signing native/mouse-telemetry with: $IDENTITY"
+            codesign --force --options runtime --timestamp --sign "$IDENTITY" native/mouse-telemetry
+            codesign -vv native/mouse-telemetry
+          else
+            echo "Skipping native binary signing (no identity or binary not found)"
+          fi
+
       - name: Package application
         env:
-          APPLE_ID: ${{ secrets.APPLE_ID }}
-          APPLE_APP_SPECIFIC_PASSWORD: ${{ secrets.APPLE_APP_SPECIFIC_PASSWORD }}
-          APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
-        run: npm run package:mac -- --publish never
+          CSC_KEYCHAIN: build.keychain
+          CSC_KEYCHAIN_PASSWORD: build
+        run: |
+          security unlock-keychain -p "build" build.keychain
+          npm run package:mac -- --publish never
 
       - name: Notarize application
-        if: env.APPLE_ID != '' && env.APPLE_APP_SPECIFIC_PASSWORD != ''
         env:
           APPLE_ID: ${{ secrets.APPLE_ID }}
           APPLE_APP_SPECIFIC_PASSWORD: ${{ secrets.APPLE_APP_SPECIFIC_PASSWORD }}
           APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
         run: |
-          xcrun notarytool submit release/*.zip \
+          # Find the zip file
+          ZIP_FILE=$(find release -name "*.zip" | head -1)
+          echo "Notarizing: $ZIP_FILE"
+
+          # Submit for notarization
+          xcrun notarytool submit "$ZIP_FILE" \
             --apple-id "$APPLE_ID" \
             --password "$APPLE_APP_SPECIFIC_PASSWORD" \
             --team-id "$APPLE_TEAM_ID" \
             --wait
 
       - name: Staple notarization
-        if: env.APPLE_ID != '' && env.APPLE_APP_SPECIFIC_PASSWORD != ''
         run: |
-          xcrun stapler staple release/*.dmg
-          xcrun stapler staple release/*.zip
+          # Staple the app inside the DMG
+          for dmg in release/*.dmg; do
+            if [ -f "$dmg" ]; then
+              echo "Stapling $dmg"
+              xcrun stapler staple "$dmg" || echo "Failed to staple $dmg"
+            fi
+          done
 
       - name: Upload release artifacts
         uses: softprops/action-gh-release@v2
@@ -76,4 +116,3 @@ jobs:
           files: |
             release/*.dmg
             release/*.zip
-