Skip to content

Commit 4e6a08c

Browse files
Maurizio Brancaumbynos
Maurizio Branca
authored and
umbynos
committed
Add codesign and notarization for macOS binary (#567)
1 parent 0441a0c commit 4e6a08c

File tree

1 file changed

+141
-83
lines changed

1 file changed

+141
-83
lines changed

‎.github/workflows/release.yml

Lines changed: 141 additions & 83 deletions
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,7 @@ on:
44
push:
55
branches:
66
- umbynos/*
7+
- zmoog/notarize
78

89
jobs:
910

@@ -27,7 +28,6 @@ jobs:
2728
go-version: "1.15"
2829

2930
- name: Install Dependencies (Linux)
30-
# run: sudo apt-get install ninja-build
3131
run: sudo apt update && sudo apt install -y --no-install-recommends build-essential libgtk-3-dev libwebkit2gtk-4.0-dev libappindicator3-dev
3232
if: matrix.operating-system == 'ubuntu-latest'
3333

@@ -73,18 +73,70 @@ jobs:
7373
config.ini
7474
if-no-files-found: error
7575

76-
package:
76+
77+
code-sign-mac-executable:
7778
needs: build
79+
runs-on: macOS-latest
80+
env:
81+
INSTALLER_CERT_MAC_PASSWORD: ${{ secrets.INSTALLER_CERT_MAC_PASSWORD }}
82+
INSTALLER_CERT_MAC_P12: "/tmp/ArduinoCerts2020.p12"
83+
84+
steps:
85+
- name: Checkout
86+
uses: actions/checkout@v2
87+
with:
88+
repository: 'bcmi-labs/arduino-create-agent-installer'
89+
token: ${{ secrets.PAT_TEMP }} # use token organization instead
90+
91+
- name: Download artifacts
92+
uses: actions/download-artifact@v2
93+
with:
94+
name: arduino-create-agent-macOS-latest
95+
path: arduino-create-agent-macOS-latest
96+
97+
- name: Import Code-Signing Certificates
98+
uses: Apple-Actions/import-codesign-certs@v1
99+
with:
100+
# The certificates in a PKCS12 file encoded as a base64 string
101+
p12-file-base64: ${{ secrets.INSTALLER_CERT_MAC_P12 }}
102+
# The password used to import the PKCS12 file.
103+
p12-password: ${{ secrets.INSTALLER_CERT_MAC_PASSWORD }}
104+
105+
- name: Install gon via HomeBrew for code signing and app notarization
106+
run: |
107+
brew tap mitchellh/gon
108+
brew install mitchellh/gon/gon
109+
110+
- name: Code sign and notarize app
111+
run: |
112+
gon -log-level=debug -log-json gon.config.hcl
113+
# gon will notarize ezecutable in "arduino-create-agent-macOS-latest/arduino-create-agent
114+
# The CI will ignore the zip output, using the signed binary only.
115+
env:
116+
AC_USERNAME: ${{ secrets.AC_USERNAME }}
117+
AC_PASSWORD: ${{ secrets.AC_PASSWORD }}
118+
119+
- name: Upload artifacts
120+
uses: actions/upload-artifact@v2
121+
with:
122+
name: arduino-create-agent-macOS-latest
123+
path: arduino-create-agent-macOS-latest
124+
if-no-files-found: error
125+
126+
package:
127+
needs: code-sign-mac-executable
78128
runs-on: ubuntu-latest
79129

80130
env:
81131
INSTALLER_VARS: "project.outputDirectory=$PWD project.version=${GITHUB_REF##*/} workspace=$PWD realname=Arduino_Create_Bridge"
82132
CERT_INSTALL: "ask_certificates_install=CI" # win(edge),mac(safari)
83133
NO_CERT_INSTALL: "ask_certificates_install=CS" # linux
84134
CHOICE_CERT_INSTALL: "ask_certificates_install=CC" # win,mac:(ff,chrome)
85-
CREATE_OSX_BUNDLED_MG: 1
135+
CREATE_OSX_BUNDLED_MG: 0 # do not create the DMG, gon will take care of that
86136
INSTALLER_CERT_WINDOWS_PASSWORD: ${{ secrets.INSTALLER_CERT_WINDOWS_PASSWORD }}
87137
INSTALLER_CERT_WINDOWS_PFX: "/tmp/ArduinoCerts2020.pfx"
138+
INSTALLER_CERT_MAC_PASSWORD: ${{ secrets.INSTALLER_CERT_MAC_PASSWORD }}
139+
INSTALLER_CERT_MAC_P12: "/tmp/ArduinoCerts2020.p12"
88140

89141
strategy:
90142
fail-fast: false # if one os is failing continue nonetheless
@@ -93,23 +145,19 @@ jobs:
93145

94146
include:
95147
- operating-system: ubuntu-latest
96-
bowser: ''
97148
install-builder-name: linux-x64
98149
executable-path: artifacts/linux-amd64/
99-
extension: ''
100-
installer-extension: ''
101150
- operating-system: windows-latest
102151
browser: edge
103152
install-builder-name: windows
104153
executable-path: artifacts/windows/
105154
extension: .exe
106155
installer-extension: .exe
107156
- operating-system: macOS-latest
108-
bowser: safari
157+
browser: safari
109158
install-builder-name: osx
110159
executable-path: 'skel/ArduinoCreateAgent.app/Contents/MacOS/'
111-
extension: ''
112-
installer-extension: .dmg
160+
installer-extension: .app
113161

114162
container:
115163
image: floydpink/ubuntu-install-builder:latest
@@ -129,14 +177,14 @@ jobs:
129177
path: ${{ matrix.executable-path }}
130178

131179
- name: Make executable
132-
run: chmod +x ${{ matrix.executable-path }}arduino-create-agent*
180+
run: chmod -v +x ${{ matrix.executable-path }}arduino-create-agent*
133181
if: matrix.operating-system == 'ubuntu-latest' || matrix.operating-system == 'macOS-latest'
134182

135183
- name: Rename executable to Arduino_Create_Bridge
136-
run: mv ${{ matrix.executable-path }}arduino-create-agent${{ matrix.extension }} ${{ matrix.executable-path }}Arduino_Create_Bridge${{ matrix.extension }}
184+
run: mv -v ${{ matrix.executable-path }}arduino-create-agent${{ matrix.extension }} ${{ matrix.executable-path }}Arduino_Create_Bridge${{ matrix.extension }}
137185

138186
- name: Rename executable to Arduino_Create_Bridge_cli
139-
run: mv ${{ matrix.executable-path }}arduino-create-agent_cli${{ matrix.extension }} ${{ matrix.executable-path }}Arduino_Create_Bridge_cli${{ matrix.extension }}
187+
run: mv -v ${{ matrix.executable-path }}arduino-create-agent_cli${{ matrix.extension }} ${{ matrix.executable-path }}Arduino_Create_Bridge_cli${{ matrix.extension }}
140188
if: matrix.operating-system == 'ubuntu-latest'
141189

142190
- name: Save InstallBuilder license to file
@@ -146,25 +194,30 @@ jobs:
146194
run: echo "${{ secrets.INSTALLER_CERT_WINDOWS_PFX }}" | base64 --decode > /tmp/ArduinoCerts2020.pfx
147195
if: matrix.operating-system == 'windows-latest'
148196

197+
- name: Save macOS signing certificate to file
198+
run: echo "${{ secrets.INSTALLER_CERT_MAC_P12 }}" | base64 --decode > /tmp/ArduinoCerts2020.p12
199+
if: matrix.operating-system == 'macOS-latest'
200+
149201
# win(edge),mac(safari) -> CERT_INSTALL and win,mac:(ff,chrome) -> CHOICE_CERT_INSTALL
202+
# installbuilder reads the env vars with certs paths and use it to sign the installer.
150203
- name: Launch Bitrock installbuilder-20 with CERT_INSTALL && CHOICE_CERT_INSTALL
151204
run: |
152205
/opt/installbuilder-20.3.0/bin/builder build installer.xml ${{ matrix.install-builder-name }} --verbose --license /tmp/license.xml --setvars ${{ env.INSTALLER_VARS }} ${{ env.CERT_INSTALL }}
153-
mv ArduinoCreateAgent-${GITHUB_REF##*/}-${{ matrix.install-builder-name }}-installer-CI${{matrix.installer-extension}} ArduinoCreateAgent-${GITHUB_REF##*/}-${{ matrix.install-builder-name }}-installer-${{matrix.browser}}${{matrix.installer-extension}}
206+
mv -v ArduinoCreateAgent-${GITHUB_REF##*/}-${{ matrix.install-builder-name }}-installer-CI${{matrix.installer-extension}} ArduinoCreateAgent-${GITHUB_REF##*/}-${{ matrix.install-builder-name }}-installer-${{matrix.browser}}${{matrix.installer-extension}}
154207
/opt/installbuilder-20.3.0/bin/builder build installer.xml ${{ matrix.install-builder-name }} --verbose --license /tmp/license.xml --setvars ${{ env.INSTALLER_VARS }} ${{ env.CHOICE_CERT_INSTALL }}
155-
cp ArduinoCreateAgent-${GITHUB_REF##*/}-${{ matrix.install-builder-name }}-installer-CC${{matrix.installer-extension}} ArduinoCreateAgent-${GITHUB_REF##*/}-${{ matrix.install-builder-name }}-installer-chrome${{matrix.installer-extension}}
156-
mv ArduinoCreateAgent-${GITHUB_REF##*/}-${{ matrix.install-builder-name }}-installer-CC${{matrix.installer-extension}} ArduinoCreateAgent-${GITHUB_REF##*/}-${{ matrix.install-builder-name }}-installer-firefox${{matrix.installer-extension}}
208+
cp -vr ArduinoCreateAgent-${GITHUB_REF##*/}-${{ matrix.install-builder-name }}-installer-CC${{matrix.installer-extension}} ArduinoCreateAgent-${GITHUB_REF##*/}-${{ matrix.install-builder-name }}-installer-chrome${{matrix.installer-extension}}
209+
mv -v ArduinoCreateAgent-${GITHUB_REF##*/}-${{ matrix.install-builder-name }}-installer-CC${{matrix.installer-extension}} ArduinoCreateAgent-${GITHUB_REF##*/}-${{ matrix.install-builder-name }}-installer-firefox${{matrix.installer-extension}}
157210
rm -r ArduinoCreateAgent-${GITHUB_REF##*/}-${{ matrix.install-builder-name }}-installer-C*
158211
if: matrix.operating-system == 'windows-latest' || matrix.operating-system == 'macOS-latest'
159212

160213
# linux
161214
- name: Launch Bitrock installbuilder-20 with NO_CERT_INSTALL
162215
run: |
163216
/opt/installbuilder-20.3.0/bin/builder build installer.xml ${{ matrix.install-builder-name }} --verbose --license /tmp/license.xml --setvars ${{ env.INSTALLER_VARS }} ${{ env.NO_CERT_INSTALL }}
164-
cp ArduinoCreateAgent-${GITHUB_REF##*/}-${{ matrix.install-builder-name }}-installer-CS.run ArduinoCreateAgent-${GITHUB_REF##*/}-${{ matrix.install-builder-name }}-installer-chrome.run
165-
mv ArduinoCreateAgent-${GITHUB_REF##*/}-${{ matrix.install-builder-name }}-installer-CS.run ArduinoCreateAgent-${GITHUB_REF##*/}-${{ matrix.install-builder-name }}-installer-firefox.run
166-
cp ArduinoCreateAgent-${GITHUB_REF##*/}-${{ matrix.install-builder-name }}-installer-CS.tar.gz ArduinoCreateAgent-${GITHUB_REF##*/}-${{ matrix.install-builder-name }}-installer-chrome.tar.gz
167-
mv ArduinoCreateAgent-${GITHUB_REF##*/}-${{ matrix.install-builder-name }}-installer-CS.tar.gz ArduinoCreateAgent-${GITHUB_REF##*/}-${{ matrix.install-builder-name }}-installer-firefox.tar.gz
217+
cp -v ArduinoCreateAgent-${GITHUB_REF##*/}-${{ matrix.install-builder-name }}-installer-CS.run ArduinoCreateAgent-${GITHUB_REF##*/}-${{ matrix.install-builder-name }}-installer-chrome.run
218+
mv -v ArduinoCreateAgent-${GITHUB_REF##*/}-${{ matrix.install-builder-name }}-installer-CS.run ArduinoCreateAgent-${GITHUB_REF##*/}-${{ matrix.install-builder-name }}-installer-firefox.run
219+
cp -v ArduinoCreateAgent-${GITHUB_REF##*/}-${{ matrix.install-builder-name }}-installer-CS.tar.gz ArduinoCreateAgent-${GITHUB_REF##*/}-${{ matrix.install-builder-name }}-installer-chrome.tar.gz
220+
mv -v ArduinoCreateAgent-${GITHUB_REF##*/}-${{ matrix.install-builder-name }}-installer-CS.tar.gz ArduinoCreateAgent-${GITHUB_REF##*/}-${{ matrix.install-builder-name }}-installer-firefox.tar.gz
168221
if: matrix.operating-system == 'ubuntu-latest'
169222

170223
- name: Upload artifacts
@@ -174,67 +227,72 @@ jobs:
174227
path: ArduinoCreateAgent*
175228
if-no-files-found: error
176229

177-
# - name: Send unit tests coverage to Codecov
178-
# if: >
179-
# matrix.operating-system == 'ubuntu-latest' &&
180-
# github.event_name == 'push'
181-
# uses: codecov/codecov-action@v1
182-
# with:
183-
# file: ./coverage_unit.txt
184-
# flags: unit
185-
186-
# - name: Send legacy tests coverage to Codecov
187-
# if: >
188-
# matrix.operating-system == 'ubuntu-latest' &&
189-
# github.event_name == 'push'
190-
# uses: codecov/codecov-action@v1
191-
# with:
192-
# file: ./coverage_legacy.txt
193-
# flags: unit
194-
195-
# - name: Send integration tests coverage to Codecov
196-
# if: >
197-
# matrix.operating-system == 'ubuntu-latest' &&
198-
# github.event_name == 'push'
199-
# uses: codecov/codecov-action@v1
200-
# with:
201-
# file: ./coverage_integ.txt
202-
# flags: integ
203-
204-
# package-macOS:
205-
# needs: build
206-
# strategy:
207-
# matrix:
208-
# # operating-system: [windows-latest, macOS-latest]
209-
# operating-system: [macOS-latest]
210-
211-
# runs-on: ${{ matrix.operating-system }}
212-
213-
# steps:
214-
# # - name: Disable EOL conversions
215-
# # run: git config --global core.autocrlf false
216-
217-
# - name: Checkout
218-
# uses: actions/checkout@v2
219-
220-
# - name: Download artifacts
221-
# uses: actions/download-artifact@v2
222-
# with:
223-
# name: arduino-create-agent-${{ matrix.operating-system }}
224-
# path: arduino-create-agent
225-
226-
# - name: Build .app
227-
# run: |
228-
# mkdir build
229-
# cp -r skel/ build
230-
# cp arduino-create-agent/arduino-create-agent build/ArduinoCreateAgent.app/Contents/MacOS/Arduino_Create_Bridge
231-
# cp config.ini build/ArduinoCreateAgent.app/Contents/MacOS/
232-
233-
# find build
234-
# shell: bash
235-
236-
# - name: Download Gon
237-
# run: |
238-
# wget -q https://github.com/mitchellh/gon/releases/download/v0.2.2/gon_0.2.2_macos.zip
239-
# unzip gon_0.2.2_macos.zip -d /usr/local/bin
240-
# rm -f gon_0.2.2_macos.zip
230+
code-sign-mac-installers:
231+
needs: package
232+
runs-on: macOS-latest
233+
env:
234+
INSTALLER_CERT_MAC_PASSWORD: ${{ secrets.INSTALLER_CERT_MAC_PASSWORD }}
235+
INSTALLER_CERT_MAC_P12: "/tmp/ArduinoCerts2020.p12"
236+
237+
strategy:
238+
matrix:
239+
browser: [safari, firefox, chrome]
240+
241+
steps:
242+
243+
- name: Download artifacts
244+
uses: actions/download-artifact@v2
245+
with:
246+
name: ArduinoCreateAgent-osx
247+
path: ArduinoCreateAgent-osx
248+
249+
- name: Make executable
250+
run: chmod -v +x ArduinoCreateAgent-osx/ArduinoCreateAgent-${GITHUB_REF##*/}-osx-installer-${{ matrix.browser }}.app/Contents/MacOS/*
251+
252+
- name: Import Code-Signing Certificates
253+
uses: Apple-Actions/import-codesign-certs@v1
254+
with:
255+
# The certificates in a PKCS12 file encoded as a base64 string
256+
p12-file-base64: ${{ secrets.INSTALLER_CERT_MAC_P12 }}
257+
# The password used to import the PKCS12 file.
258+
p12-password: ${{ secrets.INSTALLER_CERT_MAC_PASSWORD }}
259+
260+
- name: Install gon via HomeBrew for code signing and app notarization
261+
run: |
262+
brew tap mitchellh/gon
263+
brew install mitchellh/gon/gon
264+
265+
- name: Write gon config to file
266+
# gon does not allow env variables in config file (https://github.com/mitchellh/gon/issues/20)
267+
run: |
268+
cat > gon.config_installer.hcl <<EOF
269+
source = ["ArduinoCreateAgent-osx/ArduinoCreateAgent-${GITHUB_REF##*/}-osx-installer-${{ matrix.browser }}.app"]
270+
bundle_id = "cc.arduino.arduino-agent-installer"
271+
272+
sign {
273+
application_identity = "Developer ID Application: ARDUINO SA (7KT7ZWMCJT)"
274+
}
275+
276+
dmg {
277+
output_path = "ArduinoCreateAgent-${GITHUB_REF##*/}-osx-installer-${{ matrix.browser }}.dmg"
278+
volume_name = "ArduinoCreateAgent"
279+
}
280+
EOF
281+
282+
- name: Code sign and notarize app
283+
run: |
284+
echo "gon will notarize executable in ArduinoCreateAgent-osx/ArduinoCreateAgent-${GITHUB_REF##*/}-osx-installer-${{ matrix.browser }}.app"
285+
gon -log-level=debug -log-json gon.config_installer.hcl
286+
env:
287+
AC_USERNAME: ${{ secrets.AC_USERNAME }}
288+
AC_PASSWORD: ${{ secrets.AC_PASSWORD }}
289+
290+
- name: Tar files to keep permissions
291+
run: tar -cvf ArduinoCreateAgent-${GITHUB_REF##*/}-osx-installer-${{ matrix.browser }}.tar ArduinoCreateAgent-${GITHUB_REF##*/}-osx-installer-${{ matrix.browser }}.dmg
292+
293+
- name: Upload artifacts
294+
uses: actions/upload-artifact@v2
295+
with:
296+
name: ArduinoCreateAgent-osx
297+
path: ArduinoCreateAgent*.tar
298+
if-no-files-found: error

0 commit comments

Comments
 (0)