SY-2910: Fix macOS Core Signing (#1442)

Fix the macOS core signing by adding a timeout before the sign command so the macOS keychain doesn't stall.

Author: pjdotson

.github/workflows/deploy.core.yaml

@@ -5,16 +5,82 @@ on:
     branches:
       - main
       - rc
+    paths:
+      - .bazeliskrc
+      - .bazelrc
+      - .github/workflows/deploy.core.yaml
+      - alamos/go/**
+      - alamos/ts/**
+      - aspen/**
+      - cesium/**
+      - client/cpp/**
+      - client/ts/**
+      - configs/ts/**
+      - configs/vite/**
+      - console/**
+      - core/**
+      - drift/**
+      - driver/**
+      - Earthfile
+      - freighter/cpp/**
+      - freighter/go/**
+      - freighter/ts/**
+      - go.work
+      - go.work.sum
+      - MODULE.bazel
+      - MODULE.bazel.lock
+      - package.json
+      - pnpm-lock.yaml
+      - pnpm-workspace.yaml
+      - pluto/**
+      - relic.conf
+      - turbo.json
+      - vendor/mbedtls/**
+      - vendor/open62541/**
+      - x/cpp/**
+      - x/go/**
+      - x/ts/**
   pull_request:
     branches:
       - main
       - rc
+    paths:
+      - .bazeliskrc
+      - .bazelrc
+      - .github/workflows/deploy.core.yaml
+      - alamos/go/**
+      - alamos/ts/**
+      - aspen/**
+      - cesium/**
+      - client/cpp/**
+      - client/ts/**
+      - configs/ts/**
+      - configs/vite/**
+      - console/**
+      - core/**
+      - drift/**
+      - driver/**
+      - Earthfile
+      - freighter/cpp/**
+      - freighter/go/**
+      - freighter/ts/**
+      - go.work
+      - go.work.sum
+      - MODULE.bazel
+      - MODULE.bazel.lock
+      - package.json
+      - pnpm-lock.yaml
+      - pnpm-workspace.yaml
+      - pluto/**
+      - relic.conf
+      - turbo.json
+      - vendor/mbedtls/**
+      - vendor/open62541/**
+      - x/cpp/**
+      - x/go/**
+      - x/ts/**
   workflow_dispatch:
 
-permissions:
-  contents: write
-  packages: write
-
 env:
   CACHE_SCOPE: deploy-synnax
 
@@ -23,10 +89,9 @@ jobs:
     runs-on: ubuntu-latest
     outputs:
       VERSION: ${{ steps.version.outputs.VERSION }}
-      changed: ${{ steps.filter.outputs.changed }}
     steps:
       - name: Checkout Repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
 
       - name: Get Version
         id: version
@@ -38,29 +103,12 @@ jobs:
             echo "VERSION=$(cat pkg/version/VERSION)-rc" >> $GITHUB_OUTPUT
           fi
 
-      - name: Diff Changes
-        uses: dorny/paths-filter@v3
-        id: filter
-        with:
-          base: ${{ github.ref }}
-          filters: |
-            changed:
-              - .github/workflows/deploy.core.yaml
-              - alamos/go/**
-              - aspen/**
-              - cesium/**
-              - client/cpp/**
-              - core/**
-              - driver/**
-              - freighter/go/**
-              - x/cpp/**
-              - x/go/**
-              - WORKSPACE
-
   create-release:
     runs-on: ubuntu-latest
     needs: setup
-    if: github.event_name == 'push' && needs.setup.outputs.changed == 'true'
+    if: github.event_name == 'push'
+    permissions:
+      contents: write
     steps:
       - name: Create Release
         uses: actions/github-script@v7
@@ -82,9 +130,11 @@ jobs:
             });
 
   build:
-    needs: setup
+    needs: [setup, create-release]
     name: Build (${{ matrix.os }})
-    if: needs.setup.outputs.changed == 'true'
+    permissions:
+      contents: write
+      packages: write
     env:
       GH_TOKEN: ${{ github.token }}
       NODE_OPTIONS: "--max_old_space_size=4096"
@@ -95,12 +145,7 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
       - name: Checkout Repository
-        uses: actions/checkout@v4
-
-      - uses: GuillaumeFalourd/setup-windows10-sdk-action@v2
-        if: matrix.os == 'windows-latest'
-        with:
-          sdk-version: 22000
+        uses: actions/checkout@v5
 
       - name: Update Submodules
         run: git submodule update --init --recursive
@@ -181,6 +226,8 @@ jobs:
           security create-keychain -p "$KEYCHAIN_PASSWORD" build.keychain
           security default-keychain -s build.keychain
           security unlock-keychain -p "$KEYCHAIN_PASSWORD" build.keychain
+          # Prevent the keychain from getting locked during the build process
+          security set-keychain-settings -t 3600 -u build.keychain
           security import certificate.p12 -k build.keychain -P "$APPLE_CERTIFICATE_PASSWORD" -T /usr/bin/codesign
           security set-key-partition-list -S apple-tool:,apple:,codesign: -s -k "$KEYCHAIN_PASSWORD" build.keychain