Integrate Apple notarization process into Github Actions release pipeline #578
Conversation
.github/workflows/release.yaml
Outdated
| -C ../../ LICENSE.txt | ||
| CLI_CHECKSUM=$(shasum -a 256 dist/arduino-cli_${TAG}_macOS_64bit.tar.gz | cut -d " " -f 1) | ||
| perl -pi -w -e "s/.*arduino-cli_${TAG}_macOS_64bit.tar.gz/${CLI_CHECKSUM} arduino-cli_${TAG}_macOS_64bit.tar.gz/g;" dist/*-checksums.txt | ||
| rm -f apple-developer.keychain-db |
There was a problem hiding this comment.
this should be: rm -f ~/Library/Keychains/apple-developer.keychain-db?
BTW why deleting the file since the virtual machine is destroyed after the build?
There was a problem hiding this comment.
Extra paranoia + Typo 😄 but you're right, as per Github Documentation:
You can specify the runner type for each job in a workflow. Each job in a workflow executes in a fresh instance of the virtual machine. All steps in the job execute in the same instance of the virtual machine, allowing the actions in that job to share information using the filesystem.
We can remove that step, I'll update also the PR description.
.github/workflows/release.yaml
Outdated
| tag: ${{ github.ref }} | ||
| file_glob: true | ||
|
|
||
| - name: Downloads upload |
gon.config.hcl
Outdated
|
|
||
| zip { | ||
| output_path = "arduino-cli.zip" | ||
| } |
There was a problem hiding this comment.
Since we are ignoring the output zip file, can't we just remove this section and not produce it in the first place?
There was a problem hiding this comment.
Yes you're right, I misread the documentation. I thought that at least one output format was mandatory 👍
|
|
What:
This PR Integrates the Notarization process in the Arduino CLI Relese pipeline.
Why:
As per Apple announcement:
How:
The PR moves the responsibility of GitHub release creation and Arduino servers upload, from
goreleaserto GH Actions steps, and adds the notarization step leveraging Gon (Thanks to @mitchellh and to @zmoog who discovered the tool 😄 )The
notarize-macosjob must run on amacos-latestVM, in order to allowgonto orchestrate all the required notarization tools, this means that container steps cannot be used in the same job.This is why the release pipeline is split in 3 jobs that share artifacts via the
artifactsGithub Actions feature.A detailed explanation is required for the
Notarize binary, re-package it and update checksumstep, that configures the MacOskeychainwith obscure osx commands and callsgondoing the following:nnnnnn-checksums.txtfilePros:
This way we do not lose:
goreleaserplusmultiarch/crossbuildcontainer to produce the artifactsgoreleasergoreleaserCons:
releaseworkflow (that is acceptable in the end, having handy GitHub actions ready to use).