chore: update macOS workflow to use macos-14 and improve code signing process

Author: ChxGuillaume

.github/workflows/build-mac.yml

@@ -7,7 +7,7 @@ on:
 jobs:
   mac:
     name: macos
-    runs-on: macos-latest
+    runs-on: macos-14
     permissions:
       contents: write
     steps:
@@ -32,33 +32,36 @@ jobs:
 
       - name: Install Apple Code Signing Certificate
         env:
-          APPLE_THIRD_PARTY_INSTALLER_SIGNING_CERTIFICATE_BASE64: ${{ secrets.APPLE_3RD_PARTY_INSTALLER_SIGNING_CERTIFICATE_BASE64 }}
-          APPLE_THIRD_PARTY_SIGNING_CERTIFICATE_BASE64: ${{ secrets.APPLE_3RD_PARTY_SIGNING_CERTIFICATE_BASE64 }}
-          BUILD_CERTIFICATE_BASE64: ${{ secrets.APPLE_SIGNING_CERTIFICATE_BASE64 }}
-          P12_PASSWORD: ${{ secrets.APPLE_SIGNING_CERTIFICATE_PASSWORD }}
+          MAC_INSTALLER_CERTIFICATE_BASE64: ${{ secrets.APPLE_3RD_PARTY_INSTALLER_SIGNING_CERTIFICATE_BASE64 }}
+          MAC_DEVELOPMENT_CERTIFICATE_BASE64: ${{ secrets.APPLE_3RD_PARTY_SIGNING_CERTIFICATE_BASE64 }}
+          MAC_APP_CERTIFICATE_BASE64: ${{ secrets.APPLE_SIGNING_CERTIFICATE_BASE64 }}
+          MAC_INSTALLER_CERTIFICATE_PATH: ${{ runner.temp }}/mac_installer_certificate.p12
+          MAC_DEVELOPMENT_CERTIFICATE_PATH: ${{ runner.temp }}/mac_development_certificate.p12
+          MAC_APP_CERTIFICATE_PATH: ${{ runner.temp }}/mac_app_certificate.p12
+          KEYCHAIN_PATH: ${{ runner.temp }}/app-signing.keychain-db
           KEYCHAIN_PASSWORD: ${{ secrets.KEYCHAIN_PASSWORD }}
         run: |
-          THIRD_PARTY_INSTALLER_CERTIFICATE_PATH=$RUNNER_TEMP/3rd_party_installer_certificate.p12
-          THIRD_PARTY_CERTIFICATE_PATH=$RUNNER_TEMP/3rd_party_certificate.p12
-          CERTIFICATE_PATH=$RUNNER_TEMP/build_certificate.p12
-          KEYCHAIN_PATH=$RUNNER_TEMP/app-signing.keychain-db
+          echo -n "$MAC_INSTALLER_CERTIFICATE_BASE64" | base64 --decode -o $MAC_INSTALLER_CERTIFICATE_PATH
+          echo -n "$MAC_DEVELOPMENT_CERTIFICATE_BASE64" | base64 --decode -o $MAC_DEVELOPMENT_CERTIFICATE_PATH
+          echo -n "$MAC_APP_CERTIFICATE_BASE64" | base64 --decode -o $MAC_APP_CERTIFICATE_PATH
 
-          # import certificate and provisioning profile from secrets
-          echo -n "$APPLE_THIRD_PARTY_INSTALLER_SIGNING_CERTIFICATE_BASE64" | base64 --decode -o $THIRD_PARTY_INSTALLER_CERTIFICATE_PATH
-          echo -n "$APPLE_THIRD_PARTY_SIGNING_CERTIFICATE_BASE64" | base64 --decode -o $THIRD_PARTY_CERTIFICATE_PATH
-          echo -n "$BUILD_CERTIFICATE_BASE64" | base64 --decode -o $CERTIFICATE_PATH
-
-          # create temporary keychain
           security create-keychain -p "$KEYCHAIN_PASSWORD" $KEYCHAIN_PATH
           security set-keychain-settings -lut 21600 $KEYCHAIN_PATH
           security unlock-keychain -p "$KEYCHAIN_PASSWORD" $KEYCHAIN_PATH
 
-          # import certificate to keychain
-          security import $THIRD_PARTY_INSTALLER_CERTIFICATE_PATH -P "$P12_PASSWORD" -A -t cert -f pkcs12 -k $KEYCHAIN_PATH
-          security import $THIRD_PARTY_CERTIFICATE_PATH -P "$P12_PASSWORD" -A -t cert -f pkcs12 -k $KEYCHAIN_PATH
-          security import $CERTIFICATE_PATH -P "$P12_PASSWORD" -A -t cert -f pkcs12 -k $KEYCHAIN_PATH
+          security import $MAC_INSTALLER_CERTIFICATE_PATH -A -t cert -k $KEYCHAIN_PATH
+          security import $MAC_DEVELOPMENT_CERTIFICATE_PATH -A -t cert -k $KEYCHAIN_PATH
+          security import $MAC_APP_CERTIFICATE_PATH -A -t cert -k $KEYCHAIN_PATH
           security list-keychain -d user -s $KEYCHAIN_PATH
 
+      - name: Install Apple Code Signing Certificate
+        env:
+          APPLE_API_KEY_ID: ${{ secrets.APPLE_API_KEY_ID }}
+          APPLE_API_KEY: ${{ secrets.APPLE_API_KEY }}
+        run: |
+          mkdir -p ~/private_keys/
+          echo -n "$APPLE_API_KEY" | base64 --decode > ~/private_keys/AuthKey_$APPLE_API_KEY_ID.p8
+
       - name: Install Mac Profiles
         env:
           APPLE_APPLE_DEVELOPMENT_PROFILE: ${{ secrets.APPLE_APPLE_DEVELOPMENT_PROFILE }}
@@ -92,14 +95,14 @@ jobs:
         env:
           APPLE_API_ISSUER: ${{ secrets.APPLE_API_ISSUER }}
           APPLE_API_KEY_ID: ${{ secrets.APPLE_API_KEY_ID }}
-          APPLE_API_KEY: ${{ secrets.APPLE_API_KEY }}
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
-          mkdir -p ~/.private_keys
-          echo -n "$APPLE_API_KEY" ~/.private_keys/Auth_$APPLE_API_KEY_ID.p8
-
-          xcrun altool --validate-app -f dist/**/*.pkg --apiKey "$APPLE_API_KEY_ID" --apiIssuer "$APPLE_API_ISSUER"
-          xcrun altool --upload-app -f dist/**/*.pkg --apiKey "$APPLE_API_KEY_ID" --apiIssuer "$APPLE_API_ISSUER"
+          xcrun altool \
+            --notarize-app \
+            --file path/to/your/package.pkg \
+            --apiKey "$APPLE_API_KEY_ID" \
+            --apiIssuer "$APPLE_API_ISSUER" \
+            --output-format xml
 
       - name: Upload artifacts
         uses: actions/upload-artifact@v4