Skip to content
This repository was archived by the owner on Jun 24, 2025. It is now read-only.

Commit 60c0a6d

Browse files
eliandoraneliandoran
authored
Merge pull request #1521 from TriliumNext/renovate/apple-actions-import-codesign-certs-5.x
chore(deps): update apple-actions/import-codesign-certs action to v5
2 parents 93f645f + bbe697c commit 60c0a6d

File tree

1 file changed

+148
-139
lines changed

1 file changed

+148
-139
lines changed

‎.github/actions/build-electron/action.yml‎

Lines changed: 148 additions & 139 deletions
Original file line numberDiff line numberDiff line change
@@ -18,143 +18,152 @@ inputs:
1818
runs:
1919
using: composite
2020
steps:
21-
# Certificate setup
22-
- name: Import Apple certificates
23-
if: inputs.os == 'macos'
24-
uses: apple-actions/import-codesign-certs@v3
25-
with:
26-
p12-file-base64: ${{ env.APPLE_APP_CERTIFICATE_BASE64 }}
27-
p12-password: ${{ env.APPLE_APP_CERTIFICATE_PASSWORD }}
28-
keychain: build
29-
keychain-password: ${{ github.run_id }}
30-
31-
- name: Install Installer certificate
32-
if: inputs.os == 'macos'
33-
uses: apple-actions/import-codesign-certs@v3
34-
with:
35-
p12-file-base64: ${{ env.APPLE_INSTALLER_CERTIFICATE_BASE64 }}
36-
p12-password: ${{ env.APPLE_INSTALLER_CERTIFICATE_PASSWORD }}
37-
keychain: build
38-
keychain-password: ${{ github.run_id }}
39-
# We don't need to create a keychain here because we're using the build keychain that was created in the previous step
40-
create-keychain: false
41-
42-
- name: Verify certificates
43-
if: inputs.os == 'macos'
44-
shell: ${{ inputs.shell }}
45-
run: |
46-
echo "Available signing identities:"
47-
security find-identity -v -p codesigning build.keychain
48-
49-
- name: Set up Python and other macOS dependencies
50-
if: ${{ inputs.os == 'macos' }}
51-
shell: ${{ inputs.shell }}
52-
run: |
53-
brew install python-setuptools
54-
brew install create-dmg
55-
56-
- name: Install dependencies for RPM and Flatpak package building
57-
if: ${{ inputs.os == 'linux' }}
58-
shell: ${{ inputs.shell }}
59-
run: |
60-
sudo apt-get update && sudo apt-get install rpm flatpak-builder elfutils
61-
flatpak remote-add --user --if-not-exists flathub https://flathub.org/repo/flathub.flatpakrepo
62-
FLATPAK_ARCH=$(if [[ ${{ inputs.arch }} = 'arm64' ]]; then echo 'aarch64'; else echo 'x86_64'; fi)
63-
FLATPAK_VERSION='24.08'
64-
flatpak install --user --no-deps --arch $FLATPAK_ARCH --assumeyes runtime/org.freedesktop.Platform/$FLATPAK_ARCH/$FLATPAK_VERSION runtime/org.freedesktop.Sdk/$FLATPAK_ARCH/$FLATPAK_VERSION org.electronjs.Electron2.BaseApp/$FLATPAK_ARCH/$FLATPAK_VERSION
65-
66-
# Build setup
67-
- name: Install dependencies
68-
shell: ${{ inputs.shell }}
69-
run: npm ci
70-
71-
- name: Update build info
72-
shell: ${{ inputs.shell }}
73-
run: npm run chore:update-build-info
74-
75-
# Critical debugging configuration
76-
- name: Run electron-forge build with enhanced logging
77-
shell: ${{ inputs.shell }}
78-
env:
79-
# Pass through required environment variables for signing and notarization
80-
APPLE_TEAM_ID: ${{ env.APPLE_TEAM_ID }}
81-
APPLE_ID: ${{ env.APPLE_ID }}
82-
APPLE_ID_PASSWORD: ${{ env.APPLE_ID_PASSWORD }}
83-
WINDOWS_SIGN_EXECUTABLE: ${{ env.WINDOWS_SIGN_EXECUTABLE }}
84-
TRILIUM_ARTIFACT_NAME_HINT: TriliumNextNotes-${{ github.ref_name }}-${{ inputs.os }}-${{ inputs.arch }}
85-
run: npm run electron-forge:make -- --arch=${{ inputs.arch }} --platform=${{ inputs.forge_platform }}
86-
87-
# Add DMG signing step
88-
- name: Sign DMG
89-
if: inputs.os == 'macos'
90-
shell: ${{ inputs.shell }}
91-
run: |
92-
echo "Signing DMG file..."
93-
dmg_file=$(find ./dist -name "*.dmg" -print -quit)
94-
if [ -n "$dmg_file" ]; then
95-
echo "Found DMG: $dmg_file"
96-
# Get the first valid signing identity from the keychain
97-
SIGNING_IDENTITY=$(security find-identity -v -p codesigning build.keychain | grep "Developer ID Application" | head -1 | sed -E 's/.*"([^"]+)".*/\1/')
98-
if [ -z "$SIGNING_IDENTITY" ]; then
99-
echo "Error: No valid Developer ID Application certificate found in keychain"
100-
exit 1
21+
# Certificate setup
22+
- name: Import Apple certificates
23+
if: inputs.os == 'macos'
24+
uses: apple-actions/import-codesign-certs@v3
25+
with:
26+
p12-file-base64: ${{ env.APPLE_APP_CERTIFICATE_BASE64 }}
27+
p12-password: ${{ env.APPLE_APP_CERTIFICATE_PASSWORD }}
28+
keychain: build-app-${{ github.run_id }}
29+
keychain-password: ${{ github.run_id }}
30+
31+
- name: Install Installer certificate
32+
if: inputs.os == 'macos'
33+
uses: apple-actions/import-codesign-certs@v3
34+
with:
35+
p12-file-base64: ${{ env.APPLE_INSTALLER_CERTIFICATE_BASE64 }}
36+
p12-password: ${{ env.APPLE_INSTALLER_CERTIFICATE_PASSWORD }}
37+
keychain: build-installer-${{ github.run_id }}
38+
keychain-password: ${{ github.run_id }}
39+
40+
- name: Verify certificates
41+
if: inputs.os == 'macos'
42+
shell: ${{ inputs.shell }}
43+
run: |
44+
echo "Available signing identities in app keychain:"
45+
security find-identity -v -p codesigning build-app-${{ github.run_id }}.keychain
46+
47+
echo "Available signing identities in installer keychain:"
48+
security find-identity -v -p codesigning build-installer-${{ github.run_id }}.keychain
49+
50+
# Make the keychains searchable
51+
security list-keychains -d user -s build-app-${{ github.run_id }}.keychain build-installer-${{ github.run_id }}.keychain $(security list-keychains -d user | tr -d '"')
52+
security default-keychain -s build-app-${{ github.run_id }}.keychain
53+
security unlock-keychain -p ${{ github.run_id }} build-app-${{ github.run_id }}.keychain
54+
security unlock-keychain -p ${{ github.run_id }} build-installer-${{ github.run_id }}.keychain
55+
security set-keychain-settings -t 3600 -l build-app-${{ github.run_id }}.keychain
56+
security set-keychain-settings -t 3600 -l build-installer-${{ github.run_id }}.keychain
57+
58+
- name: Set up Python and other macOS dependencies
59+
if: ${{ inputs.os == 'macos' }}
60+
shell: ${{ inputs.shell }}
61+
run: |
62+
brew install python-setuptools
63+
brew install create-dmg
64+
65+
- name: Install dependencies for RPM and Flatpak package building
66+
if: ${{ inputs.os == 'linux' }}
67+
shell: ${{ inputs.shell }}
68+
run: |
69+
sudo apt-get update && sudo apt-get install rpm flatpak-builder elfutils
70+
flatpak remote-add --user --if-not-exists flathub https://flathub.org/repo/flathub.flatpakrepo
71+
FLATPAK_ARCH=$(if [[ ${{ inputs.arch }} = 'arm64' ]]; then echo 'aarch64'; else echo 'x86_64'; fi)
72+
FLATPAK_VERSION='24.08'
73+
flatpak install --user --no-deps --arch $FLATPAK_ARCH --assumeyes runtime/org.freedesktop.Platform/$FLATPAK_ARCH/$FLATPAK_VERSION runtime/org.freedesktop.Sdk/$FLATPAK_ARCH/$FLATPAK_VERSION org.electronjs.Electron2.BaseApp/$FLATPAK_ARCH/$FLATPAK_VERSION
74+
75+
# Build setup
76+
- name: Install dependencies
77+
shell: ${{ inputs.shell }}
78+
run: npm ci
79+
80+
- name: Update build info
81+
shell: ${{ inputs.shell }}
82+
run: npm run chore:update-build-info
83+
84+
# Critical debugging configuration
85+
- name: Run electron-forge build with enhanced logging
86+
shell: ${{ inputs.shell }}
87+
env:
88+
# Pass through required environment variables for signing and notarization
89+
APPLE_TEAM_ID: ${{ env.APPLE_TEAM_ID }}
90+
APPLE_ID: ${{ env.APPLE_ID }}
91+
APPLE_ID_PASSWORD: ${{ env.APPLE_ID_PASSWORD }}
92+
WINDOWS_SIGN_EXECUTABLE: ${{ env.WINDOWS_SIGN_EXECUTABLE }}
93+
TRILIUM_ARTIFACT_NAME_HINT: TriliumNextNotes-${{ github.ref_name }}-${{ inputs.os }}-${{ inputs.arch }}
94+
run: npm run electron-forge:make -- --arch=${{ inputs.arch }} --platform=${{ inputs.forge_platform }}
95+
96+
# Add DMG signing step
97+
- name: Sign DMG
98+
if: inputs.os == 'macos'
99+
shell: ${{ inputs.shell }}
100+
run: |
101+
echo "Signing DMG file..."
102+
dmg_file=$(find ./dist -name "*.dmg" -print -quit)
103+
if [ -n "$dmg_file" ]; then
104+
echo "Found DMG: $dmg_file"
105+
# Get the first valid signing identity from the keychain
106+
SIGNING_IDENTITY=$(security find-identity -v -p codesigning build-app-${{ github.run_id }}.keychain | grep "Developer ID Application" | head -1 | sed -E 's/.*"([^"]+)".*/\1/')
107+
if [ -z "$SIGNING_IDENTITY" ]; then
108+
echo "Error: No valid Developer ID Application certificate found in keychain"
109+
exit 1
110+
fi
111+
echo "Using signing identity: $SIGNING_IDENTITY"
112+
# Sign the DMG
113+
codesign --force --sign "$SIGNING_IDENTITY" --options runtime --timestamp "$dmg_file"
114+
# Notarize the DMG
115+
xcrun notarytool submit "$dmg_file" --apple-id "$APPLE_ID" --password "$APPLE_ID_PASSWORD" --team-id "$APPLE_TEAM_ID" --wait
116+
# Staple the notarization ticket
117+
xcrun stapler staple "$dmg_file"
118+
else
119+
echo "No DMG found to sign"
120+
fi
121+
122+
- name: Verify code signing
123+
if: inputs.os == 'macos'
124+
shell: ${{ inputs.shell }}
125+
run: |
126+
echo "Verifying code signing for all artifacts..."
127+
128+
# First check the .app bundle
129+
echo "Looking for .app bundle..."
130+
app_bundle=$(find ./dist -name "*.app" -print -quit)
131+
if [ -n "$app_bundle" ]; then
132+
echo "Found app bundle: $app_bundle"
133+
echo "Verifying app bundle signing..."
134+
codesign --verify --deep --strict --verbose=2 "$app_bundle"
135+
echo "Displaying app bundle signing info..."
136+
codesign --display --verbose=2 "$app_bundle"
137+
138+
echo "Checking entitlements..."
139+
codesign --display --entitlements :- "$app_bundle"
140+
141+
echo "Checking notarization status..."
142+
xcrun stapler validate "$app_bundle" || echo "Warning: App bundle not notarized yet"
143+
else
144+
echo "No .app bundle found to verify"
145+
fi
146+
147+
# Then check DMG if it exists
148+
echo "Looking for DMG..."
149+
dmg_file=$(find ./dist -name "*.dmg" -print -quit)
150+
if [ -n "$dmg_file" ]; then
151+
echo "Found DMG: $dmg_file"
152+
echo "Verifying DMG signing..."
153+
codesign --verify --deep --strict --verbose=2 "$dmg_file"
154+
echo "Displaying DMG signing info..."
155+
codesign --display --verbose=2 "$dmg_file"
156+
157+
echo "Checking DMG notarization..."
158+
xcrun stapler validate "$dmg_file" || echo "Warning: DMG not notarized yet"
159+
else
160+
echo "No DMG found to verify"
161+
fi
162+
163+
# Finally check ZIP if it exists
164+
echo "Looking for ZIP..."
165+
zip_file=$(find ./dist -name "*.zip" -print -quit)
166+
if [ -n "$zip_file" ]; then
167+
echo "Found ZIP: $zip_file"
168+
echo "Note: ZIP files are not code signed, but their contents should be"
101169
fi
102-
echo "Using signing identity: $SIGNING_IDENTITY"
103-
# Sign the DMG
104-
codesign --force --sign "$SIGNING_IDENTITY" --options runtime --timestamp "$dmg_file"
105-
# Notarize the DMG
106-
xcrun notarytool submit "$dmg_file" --apple-id "$APPLE_ID" --password "$APPLE_ID_PASSWORD" --team-id "$APPLE_TEAM_ID" --wait
107-
# Staple the notarization ticket
108-
xcrun stapler staple "$dmg_file"
109-
else
110-
echo "No DMG found to sign"
111-
fi
112-
113-
- name: Verify code signing
114-
if: inputs.os == 'macos'
115-
shell: ${{ inputs.shell }}
116-
run: |
117-
echo "Verifying code signing for all artifacts..."
118-
119-
# First check the .app bundle
120-
echo "Looking for .app bundle..."
121-
app_bundle=$(find ./dist -name "*.app" -print -quit)
122-
if [ -n "$app_bundle" ]; then
123-
echo "Found app bundle: $app_bundle"
124-
echo "Verifying app bundle signing..."
125-
codesign --verify --deep --strict --verbose=2 "$app_bundle"
126-
echo "Displaying app bundle signing info..."
127-
codesign --display --verbose=2 "$app_bundle"
128-
129-
echo "Checking entitlements..."
130-
codesign --display --entitlements :- "$app_bundle"
131-
132-
echo "Checking notarization status..."
133-
xcrun stapler validate "$app_bundle" || echo "Warning: App bundle not notarized yet"
134-
else
135-
echo "No .app bundle found to verify"
136-
fi
137-
138-
# Then check DMG if it exists
139-
echo "Looking for DMG..."
140-
dmg_file=$(find ./dist -name "*.dmg" -print -quit)
141-
if [ -n "$dmg_file" ]; then
142-
echo "Found DMG: $dmg_file"
143-
echo "Verifying DMG signing..."
144-
codesign --verify --deep --strict --verbose=2 "$dmg_file"
145-
echo "Displaying DMG signing info..."
146-
codesign --display --verbose=2 "$dmg_file"
147-
148-
echo "Checking DMG notarization..."
149-
xcrun stapler validate "$dmg_file" || echo "Warning: DMG not notarized yet"
150-
else
151-
echo "No DMG found to verify"
152-
fi
153-
154-
# Finally check ZIP if it exists
155-
echo "Looking for ZIP..."
156-
zip_file=$(find ./dist -name "*.zip" -print -quit)
157-
if [ -n "$zip_file" ]; then
158-
echo "Found ZIP: $zip_file"
159-
echo "Note: ZIP files are not code signed, but their contents should be"
160-
fi

0 commit comments

Comments
 (0)