ci: set installer cert & password (#99)

Author: ethanndickson

.env

@@ -1,9 +1,9 @@
 # Build a release locally using: op run --env-file="./.env" -- make release
-APPLE_CERT="op://Apple/Apple DeveloperID Application PKCS12 base64/notesPlain"
-CERT_PASSWORD="op://Apple/DeveloperID Application p12 password/password"
+APPLE_DEVELOPER_ID_PKCS12_B64="op://Apple/Apple DeveloperID Application PKCS12 base64/notesPlain"
+APPLE_DEVELOPER_ID_PKCS12_PASSWORD="op://Apple/DeveloperID Application p12 password/password"
 
-APPLE_INSTALLER_CERT="op://Apple/Developer ID Installer PKCS12 base64/notesPlain"
-INSTALLER_CERT_PASSWORD="op://Apple/DeveloperID Installer Password/password"
+APPLE_INSTALLER_PKCS12_B64="op://Apple/Developer ID Installer PKCS12 base64/notesPlain"
+APPLE_INSTALLER_PKCS12_PASSWORD="op://Apple/DeveloperID Installer Password/password"
 
 APPLE_ID="op://Apple/3apcadvvcojjbpxnd7m5fgh5wm/username"
 APPLE_ID_PASSWORD="op://Apple/3apcadvvcojjbpxnd7m5fgh5wm/password"

.github/workflows/release.yml

@@ -41,11 +41,13 @@ jobs:
 
       - name: Build
         env:
-          APPLE_CERT: ${{ secrets.APPLE_DEVELOPER_ID_PKCS12_B64 }}
+          APPLE_DEVELOPER_ID_PKCS12_B64: ${{ secrets.APPLE_DEVELOPER_ID_PKCS12_B64 }}
+          APPLE_DEVELOPER_ID_PKCS12_PASSWORD: ${{ secrets.APPLE_DEVELOPER_ID_PKCS12_PASSWORD }}
+          APPLE_INSTALLER_PKCS12_B64: ${{ secrets.APPLE_INSTALLER_PKCS12_PASSWORD }}
+          APPLE_INSTALLER_PKCS12_PASSWORD: ${{ secrets.APPLE_INSTALLER_PKCS12_B64 }}
           APPLE_ID: ${{ secrets.APPLE_NOTARYTOOL_USERNAME  }}
           APPLE_ID_PASSWORD: ${{ secrets.APPLE_NOTARYTOOL_PASSWORD }}
           APP_PROF: ${{ secrets.CODER_DESKTOP_APP_PROVISIONPROFILE_B64 }}
-          CERT_PASSWORD: ${{ secrets.APPLE_DEVELOPER_ID_PKCS12_PASSWORD }}
           EXT_PROF: ${{ secrets.CODER_DESKTOP_EXTENSION_PROVISIONPROFILE_B64 }}
         run: make release
 

Makefile

@@ -53,12 +53,12 @@ $(KEYCHAIN_FILE):
 	security set-keychain-settings -lut 21600 "$(APP_SIGNING_KEYCHAIN)"
 	security unlock-keychain -p "" "$(APP_SIGNING_KEYCHAIN)"
 	@tempfile=$$(mktemp); \
-	echo "$$APPLE_CERT" | base64 -d > $$tempfile; \
-	security import $$tempfile -P '$(CERT_PASSWORD)' -A -t cert -f pkcs12 -k "$(APP_SIGNING_KEYCHAIN)"; \
+	echo "$$APPLE_DEVELOPER_ID_PKCS12_B64" | base64 -d > $$tempfile; \
+	security import $$tempfile -P '$(APPLE_DEVELOPER_ID_PKCS12_PASSWORD)' -A -t cert -f pkcs12 -k "$(APP_SIGNING_KEYCHAIN)"; \
 	rm $$tempfile
 	@tempfile=$$(mktemp); \
-	echo "$$APPLE_INSTALLER_CERT" | base64 -d > $$tempfile; \
-	security import $$tempfile -P '$(INSTALLER_CERT_PASSWORD)' -A -t cert -f pkcs12 -k "$(APP_SIGNING_KEYCHAIN)"; \
+	echo "$$APPLE_INSTALLER_PKCS12_B64" | base64 -d > $$tempfile; \
+	security import $$tempfile -P '$(APPLE_INSTALLER_PKCS12_PASSWORD)' -A -t cert -f pkcs12 -k "$(APP_SIGNING_KEYCHAIN)"; \
 	rm $$tempfile
 	security list-keychains -d user -s $$(security list-keychains -d user | tr -d '\"') "$(APP_SIGNING_KEYCHAIN)"