Merge pull request #13490 from gitbutlerapp/add-macos-signing-to-lite-packaging

ci(lite): add signing and notarizing to macOS distribution

Author: slarse

.github/workflows/lite.yml

@@ -45,6 +45,11 @@ jobs:
         env:
           CHANNEL: nightly
           VERSION: "0.0.${{ github.run_number }}"
+          CSC_LINK: ${{ runner.os == 'macOS' && secrets.APPLE_CERTIFICATE || '' }}
+          CSC_KEY_PASSWORD: ${{ runner.os == 'macOS' && secrets.APPLE_CERTIFICATE_PASSWORD || '' }}
+          APPLE_ID: ${{ runner.os == 'macOS' && secrets.APPLE_ID || '' }}
+          APPLE_APP_SPECIFIC_PASSWORD: ${{ runner.os == 'macOS' && secrets.APPLE_PASSWORD || '' }}
+          APPLE_TEAM_ID: ${{ runner.os == 'macOS' && secrets.APPLE_PROVIDER_SHORT_NAME || '' }}
         run: |
           pnpm --filter @gitbutler/but-sdk build
           pnpm --filter @gitbutler/lite bundle

apps/lite/package.json

@@ -33,7 +33,11 @@
 			"package.json"
 		],
 		"mac": {
-			"target": "dmg"
+			"target": "dmg",
+			"hardenedRuntime": true,
+			"gatekeeperAssess": false,
+			"entitlements": "resources/entitlements.mac.plist",
+			"entitlementsInherit": "resources/entitlements.mac.inherit.plist"
 		},
 		"linux": {
 			"target": [
@@ -88,9 +92,9 @@
 		"@typescript/native-preview": "7.0.0-dev.20260311.1",
 		"@vitejs/plugin-react": "^5.2.0",
 		"babel-plugin-react-compiler": "^1.0.0",
-		"electron": "^41.1.0",
 		"concurrently": "^9.2.1",
 		"cross-env": "^10.1.0",
+		"electron": "^41.1.0",
 		"electron-builder": "^26.8.1",
 		"jsdom": "28.1.0",
 		"vite": "catalog:",

apps/lite/resources/entitlements.mac.inherit.plist

@@ -0,0 +1,10 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+  <dict>
+    <key>com.apple.security.cs.allow-unsigned-executable-memory</key>
+    <true/>
+    <key>com.apple.security.cs.allow-jit</key>
+    <true/>
+  </dict>
+</plist>

apps/lite/resources/entitlements.mac.plist

@@ -0,0 +1,10 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+  <dict>
+    <key>com.apple.security.cs.allow-unsigned-executable-memory</key>
+    <true/>
+    <key>com.apple.security.cs.allow-jit</key>
+    <true/>
+  </dict>
+</plist>