ci(mac): enable code signing and notarization (#819)

Author: antonreshetov

.github/workflows/build-sponsored.yml

@@ -55,6 +55,11 @@ jobs:
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           VITE_SPONSORED: true
+          CSC_LINK: ${{ secrets.CSC_LINK }}
+          CSC_KEY_PASSWORD: ${{ secrets.CSC_KEY_PASSWORD }}
+          APPLE_ID: ${{ secrets.APPLE_ID }}
+          APPLE_APP_SPECIFIC_PASSWORD: ${{ secrets.APPLE_APP_SPECIFIC_PASSWORD }}
+          APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
 
       - name: Build application (sponsored other platforms)
         if: matrix.platform != 'mac'

.github/workflows/release.yml

@@ -62,6 +62,11 @@ jobs:
         run: pnpm run build:${{ matrix.platform }}:${{ matrix.arch }}
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          CSC_LINK: ${{ secrets.CSC_LINK }}
+          CSC_KEY_PASSWORD: ${{ secrets.CSC_KEY_PASSWORD }}
+          APPLE_ID: ${{ secrets.APPLE_ID }}
+          APPLE_APP_SPECIFIC_PASSWORD: ${{ secrets.APPLE_APP_SPECIFIC_PASSWORD }}
+          APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
 
       - name: Build application (other platforms)
         if: matrix.platform != 'mac'

.gitignore

@@ -13,6 +13,7 @@ auto-imports.d.ts
 .github/*-instructions.md
 .env
 .env.*
+electron-builder.env
 docs/superpowers
 docs/website/.vitepress/cache
 docs/website/.vitepress/dist

electron-builder.json

@@ -17,7 +17,7 @@
     "entitlements": "build/entitlements.mac.inherit.plist",
     "category": "public.app-category.productivity",
     "hardenedRuntime": true,
-    "identity": null
+    "notarize": true
   },
   "win": {
     "target": ["nsis", "portable"],

electron-builder.sponsored.json

@@ -18,7 +18,7 @@
     "entitlements": "build/entitlements.mac.inherit.plist",
     "category": "public.app-category.productivity",
     "hardenedRuntime": true,
-    "identity": null
+    "notarize": true
   },
   "win": {
     "target": ["nsis", "portable"],