build: setup macos keychain [build]

Author: forevanyeung

.github/workflows/build.yaml

@@ -67,8 +67,31 @@ jobs:
           name: guppy
           path: ./cli/dist/guppy
 
+      - name: Setup keychain
+        env:
+          CERTIFICATE_BASE64: ${{ secrets.DEVELOPER_ID_CERT }}
+          CERTIFICATE_PASSWORD: ${{ secrets.DEVELOPER_ID_CERT_PWD }}
+        run: |
+          # create variables
+          CERTIFICATE_PATH=$RUNNER_TEMP/build_certificate.p12
+          KEYCHAIN_PASSWORD: $(openssl rand -base64 32)
+          KEYCHAIN_PATH=$RUNNER_TEMP/app-signing.keychain-db
+
+          # import certificate and provisioning profile from secrets
+          echo -n "$BUILD_CERTIFICATE_BASE64" | base64 --decode -o $CERTIFICATE_PATH
+
+          # create temporary keychain
+          security create-keychain -p "$KEYCHAIN_PASSWORD" $KEYCHAIN_PATH
+          security set-keychain-settings -lut 21600 $KEYCHAIN_PATH
+          security unlock-keychain -p "$KEYCHAIN_PASSWORD" $KEYCHAIN_PATH
+
+          # import certificate to keychain
+          security import $CERTIFICATE_PATH -P "$P12_PASSWORD" -A -t cert -f pkcs12 -k $KEYCHAIN_PATH
+          security set-key-partition-list -S apple-tool:,apple: -k "$KEYCHAIN_PASSWORD" $KEYCHAIN_PATH
+          security list-keychain -d user -s $KEYCHAIN_PATH
+
       - name: Sign guppy binary
-        run: codesign -s - ./cli/dist/guppy
+        run: codesign -s "Developer ID Application" ./cli/dist/guppy
 
       - name: Build macOS archive
         env: 
@@ -93,7 +116,7 @@ jobs:
       - name: Notarize macOS installer
         run: |
           xcrun notarytool submit \
-            --team-id '' \
+            --team-id L8SL8KUNVD' \
             --apple-id ${{ secrets.NOTARY_USERNAME }} \
             --password ${{ secrets.NOTARY_PASSWORD }} \
             --wait \