CI macOS: print notary log and submission info on notarization failure

Author: justinvforvendetta

.github/workflows/ci.yml

@@ -233,11 +233,42 @@ jobs:
             exit 1
           fi
 
-          xcrun notarytool submit "$DMG_PATH" \
+          SUBMIT_OUTPUT="$(xcrun notarytool submit "$DMG_PATH" \
             --apple-id "$APPLE_ID" \
             --password "$APPLE_APP_SPECIFIC_PASSWORD" \
             --team-id "$APPLE_TEAM_ID" \
-            --wait
+            --output-format json)"
+          echo "$SUBMIT_OUTPUT"
+
+          SUBMISSION_ID="$(echo "$SUBMIT_OUTPUT" | sed -n 's/.*"id"[[:space:]]*:[[:space:]]*"\([^"]*\)".*/\1/p' | head -n1)"
+          if [ -z "${SUBMISSION_ID:-}" ]; then
+            echo "Failed to parse notarization submission id"
+            exit 1
+          fi
+          echo "Notary submission id: $SUBMISSION_ID"
+
+          set +e
+          xcrun notarytool wait "$SUBMISSION_ID" \
+            --apple-id "$APPLE_ID" \
+            --password "$APPLE_APP_SPECIFIC_PASSWORD" \
+            --team-id "$APPLE_TEAM_ID" \
+            --timeout 30m
+          WAIT_RC=$?
+          set -e
+
+          xcrun notarytool info "$SUBMISSION_ID" \
+            --apple-id "$APPLE_ID" \
+            --password "$APPLE_APP_SPECIFIC_PASSWORD" \
+            --team-id "$APPLE_TEAM_ID" || true
+
+          if [ "$WAIT_RC" -ne 0 ]; then
+            echo "Notarization failed or timed out; printing Apple notary log for diagnostics"
+            xcrun notarytool log "$SUBMISSION_ID" \
+              --apple-id "$APPLE_ID" \
+              --password "$APPLE_APP_SPECIFIC_PASSWORD" \
+              --team-id "$APPLE_TEAM_ID" || true
+            exit "$WAIT_RC"
+          fi
 
           xcrun stapler staple "$DMG_PATH"
           xcrun stapler validate "$DMG_PATH"