George Lambert
dcee1918dc
Some checks failed
windows-msi / full-msi-unsigned (push) Has been cancelled
DUAL-SHIP exit criteria A–E; notary CI sketch with secret names only.
109 lines
4.7 KiB
Text
109 lines
4.7 KiB
Text
# EXAMPLE ONLY — not a live workflow.
|
|
# Copy into .github/workflows/ or .forgejo/workflows/ and enable when Apple certs exist.
|
|
# Default job path is UNSIGNED (build-menubar-app.sh). Sign/notary steps stay gated off.
|
|
#
|
|
# Secret / var NAMES only — never commit .p8, .p12, passwords, or real Team IDs as values.
|
|
# See NOTARIZE-CHECKLIST.md and platform/windows/wix/CI-SIGN-NOTARY.md.
|
|
#
|
|
# GitHub Actions: secrets.* / vars.* as below.
|
|
# Forgejo Actions: same secret names; map runs-on to your macOS label; keep names identical.
|
|
#
|
|
# name: macos-menubar-notarize
|
|
# on:
|
|
# workflow_dispatch:
|
|
# # push:
|
|
# # tags: ["printstamp-v*"]
|
|
|
|
name: macos-menubar-ci-example
|
|
|
|
on:
|
|
workflow_dispatch:
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
jobs:
|
|
menubar-unsigned-default:
|
|
runs-on: macos-latest
|
|
steps:
|
|
- name: Checkout
|
|
uses: actions/checkout@v4
|
|
|
|
- name: Build unsigned menubar .app
|
|
working-directory: platform/macos/menubar
|
|
run: |
|
|
set -euo pipefail
|
|
# Default product path: no codesign, no notarytool, no secrets.
|
|
./build-menubar-app.sh "${RUNNER_TEMP}/Verae Menubar.app"
|
|
test -d "${RUNNER_TEMP}/Verae Menubar.app"
|
|
echo "Unsigned app at ${RUNNER_TEMP}/Verae Menubar.app"
|
|
cat "${RUNNER_TEMP}/Verae Menubar.app/Contents/Resources/VERSION" || true
|
|
|
|
- name: Upload unsigned .app zip (dev/CI smoke only)
|
|
if: ${{ true }}
|
|
run: |
|
|
set -euo pipefail
|
|
APP="${RUNNER_TEMP}/Verae Menubar.app"
|
|
ZIP="${RUNNER_TEMP}/VeraeMenubar-unsigned.zip"
|
|
ditto -c -k --keepParent "$APP" "$ZIP"
|
|
echo "UNSIGNED_ZIP=$ZIP" >> "$GITHUB_ENV"
|
|
# Forgejo: write GITHUB_ENV-equivalent or upload path directly.
|
|
|
|
- name: Upload artifact (unsigned)
|
|
uses: actions/upload-artifact@v4
|
|
with:
|
|
name: VeraeMenubar-macos-unsigned
|
|
path: ${{ env.UNSIGNED_ZIP }}
|
|
if-no-files-found: warn
|
|
retention-days: 14
|
|
|
|
# --- Future: Developer ID + notarytool (NOT enabled) ---
|
|
# Enable only when org secret store holds the names below. Keep unsigned job as default.
|
|
# Secret / var names (placeholders — values never in git):
|
|
# secrets.APPLE_API_KEY_P8_BASE64 # base64 of AuthKey_*.p8
|
|
# secrets.APPLE_API_KEY_ID
|
|
# secrets.APPLE_API_ISSUER_ID
|
|
# secrets.APPLE_TEAM_ID
|
|
# secrets.APPLE_CODESIGN_IDENTITY # "Developer ID Application: … (TEAMID)"
|
|
# secrets.APPLE_INSTALLER_IDENTITY # optional; product .pkg path, not menubar
|
|
# vars.NOTARY_KEYCHAIN_PROFILE # optional laptop path name; CI prefers API key trio
|
|
#
|
|
# menubar-notarize:
|
|
# if: ${{ false }} # flip only after secrets exist; do not ship Gatekeeper claims until green
|
|
# runs-on: macos-latest
|
|
# steps:
|
|
# - uses: actions/checkout@v4
|
|
# - name: Materialize notary API key
|
|
# env:
|
|
# APPLE_API_KEY_P8_BASE64: ${{ secrets.APPLE_API_KEY_P8_BASE64 }}
|
|
# APPLE_API_KEY_ID: ${{ secrets.APPLE_API_KEY_ID }}
|
|
# run: |
|
|
# # mkdir -p "$RUNNER_TEMP/private_keys"
|
|
# # echo "$APPLE_API_KEY_P8_BASE64" | base64 -d > \
|
|
# # "$RUNNER_TEMP/private_keys/AuthKey_${APPLE_API_KEY_ID}.p8"
|
|
# # chmod 600 "$RUNNER_TEMP/private_keys/AuthKey_${APPLE_API_KEY_ID}.p8"
|
|
# # Never upload .p8 as an artifact; delete in always() step.
|
|
# echo "TODO: materialize .p8 outside workspace"
|
|
# - name: Build + codesign + notarytool + staple
|
|
# env:
|
|
# APPLE_API_KEY_ID: ${{ secrets.APPLE_API_KEY_ID }}
|
|
# APPLE_API_ISSUER_ID: ${{ secrets.APPLE_API_ISSUER_ID }}
|
|
# APPLE_CODESIGN_IDENTITY: ${{ secrets.APPLE_CODESIGN_IDENTITY }}
|
|
# APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
|
|
# NOTARY_KEY_PATH: ${{ runner.temp }}/private_keys/AuthKey_${{ secrets.APPLE_API_KEY_ID }}.p8
|
|
# run: |
|
|
# set -euo pipefail
|
|
# # 1) ./build-menubar-app.sh "$RUNNER_TEMP/Verae Menubar.app"
|
|
# # 2) codesign --force --deep --options runtime --timestamp \
|
|
# # --entitlements … --sign "$APPLE_CODESIGN_IDENTITY" "$APP"
|
|
# # 3) ditto -c -k --keepParent "$APP" /tmp/VeraeMenubar.zip
|
|
# # 4) xcrun notarytool submit /tmp/VeraeMenubar.zip \
|
|
# # --key "$NOTARY_KEY_PATH" --key-id "$APPLE_API_KEY_ID" \
|
|
# # --issuer "$APPLE_API_ISSUER_ID" --wait
|
|
# # 5) xcrun stapler staple "$APP" && xcrun stapler validate "$APP"
|
|
# # 6) spctl --assess --type execute -vv "$APP"
|
|
# # Operator detail: NOTARIZE-CHECKLIST.md
|
|
# echo "TODO: notary path not enabled — unsigned default only"
|
|
# - name: Scrub API key material
|
|
# if: always()
|
|
# run: rm -rf "${RUNNER_TEMP}/private_keys" || true
|