|
| 1 | +#!/usr/bin/env bash |
| 2 | +set -euo pipefail |
| 3 | + |
| 4 | +require_signing="${REQUIRE_MACOS_SIGNING:-false}" |
| 5 | +require_signing="$(printf '%s' "$require_signing" | tr '[:upper:]' '[:lower:]')" |
| 6 | + |
| 7 | +decode_base64_to_file() { |
| 8 | + local encoded="$1" |
| 9 | + local output_path="$2" |
| 10 | + |
| 11 | + if printf '%s' "$encoded" | base64 --decode > "$output_path" 2>/dev/null; then |
| 12 | + return 0 |
| 13 | + fi |
| 14 | + |
| 15 | + printf '%s' "$encoded" | base64 -D > "$output_path" |
| 16 | +} |
| 17 | + |
| 18 | +has_cert=false |
| 19 | +if [[ -n "${APPLE_CERTIFICATE:-}" && -n "${APPLE_CERTIFICATE_PASSWORD:-}" ]]; then |
| 20 | + has_cert=true |
| 21 | +fi |
| 22 | + |
| 23 | +has_notary_api=false |
| 24 | +if [[ -n "${APPLE_API_KEY:-}" && -n "${APPLE_API_ISSUER:-}" && -n "${APPLE_API_KEY_BASE64:-}" ]]; then |
| 25 | + has_notary_api=true |
| 26 | +fi |
| 27 | + |
| 28 | +has_notary_apple_id=false |
| 29 | +if [[ -n "${APPLE_ID:-}" && -n "${APPLE_PASSWORD:-}" && -n "${APPLE_TEAM_ID:-}" ]]; then |
| 30 | + has_notary_apple_id=true |
| 31 | +fi |
| 32 | + |
| 33 | +if [[ "$has_cert" != true ]]; then |
| 34 | + if [[ "$require_signing" == "true" ]]; then |
| 35 | + echo "::error::Tag releases require APPLE_CERTIFICATE and APPLE_CERTIFICATE_PASSWORD secrets." |
| 36 | + exit 1 |
| 37 | + fi |
| 38 | + echo "::notice::Skipping macOS signing setup because certificate secrets are not configured." |
| 39 | + exit 0 |
| 40 | +fi |
| 41 | + |
| 42 | +if [[ "$has_notary_api" != true && "$has_notary_apple_id" != true ]]; then |
| 43 | + if [[ "$require_signing" == "true" ]]; then |
| 44 | + echo "::error::Tag releases require notarization credentials. Set either APPLE_API_KEY + APPLE_API_ISSUER + APPLE_API_KEY_BASE64 or APPLE_ID + APPLE_PASSWORD + APPLE_TEAM_ID." |
| 45 | + exit 1 |
| 46 | + fi |
| 47 | + echo "::notice::Skipping notarization configuration because notarization secrets are not configured." |
| 48 | +fi |
| 49 | + |
| 50 | +if [[ -z "${RUNNER_TEMP:-}" || -z "${GITHUB_ENV:-}" ]]; then |
| 51 | + echo "::error::RUNNER_TEMP and GITHUB_ENV must be available in GitHub Actions." |
| 52 | + exit 1 |
| 53 | +fi |
| 54 | + |
| 55 | +cert_path="$RUNNER_TEMP/agent-workspace-macos-signing.p12" |
| 56 | +keychain_path="$RUNNER_TEMP/agent-workspace-signing.keychain-db" |
| 57 | +keychain_password="${KEYCHAIN_PASSWORD:-agent-workspace-$(date +%s)-$$}" |
| 58 | + |
| 59 | +decode_base64_to_file "$APPLE_CERTIFICATE" "$cert_path" |
| 60 | + |
| 61 | +security create-keychain -p "$keychain_password" "$keychain_path" |
| 62 | +security set-keychain-settings -lut 21600 "$keychain_path" |
| 63 | +security unlock-keychain -p "$keychain_password" "$keychain_path" |
| 64 | +security import "$cert_path" \ |
| 65 | + -k "$keychain_path" \ |
| 66 | + -P "$APPLE_CERTIFICATE_PASSWORD" \ |
| 67 | + -T /usr/bin/codesign \ |
| 68 | + -T /usr/bin/security \ |
| 69 | + -T /usr/bin/productbuild |
| 70 | +security set-key-partition-list -S apple-tool:,apple:,codesign: -s -k "$keychain_password" "$keychain_path" |
| 71 | +security list-keychains -d user -s "$keychain_path" |
| 72 | +security default-keychain -d user -s "$keychain_path" |
| 73 | + |
| 74 | +signing_identity="${APPLE_SIGNING_IDENTITY:-}" |
| 75 | +if [[ -z "$signing_identity" ]]; then |
| 76 | + signing_identity="$(security find-identity -v -p codesigning "$keychain_path" | awk -F'"' '/Developer ID Application/ { print $2; exit }')" |
| 77 | +fi |
| 78 | +if [[ -z "$signing_identity" ]]; then |
| 79 | + signing_identity="$(security find-identity -v -p codesigning "$keychain_path" | awk -F'"' 'NR == 1 { print $2 }')" |
| 80 | +fi |
| 81 | +if [[ -z "$signing_identity" ]]; then |
| 82 | + echo "::error::Unable to resolve a macOS code-signing identity from the imported certificate." |
| 83 | + exit 1 |
| 84 | +fi |
| 85 | + |
| 86 | +{ |
| 87 | + echo "APPLE_SIGNING_IDENTITY=$signing_identity" |
| 88 | + echo "MACOS_SIGNING_KEYCHAIN=$keychain_path" |
| 89 | +} >> "$GITHUB_ENV" |
| 90 | + |
| 91 | +if [[ "$has_notary_api" == true ]]; then |
| 92 | + api_key_path="$RUNNER_TEMP/AuthKey_${APPLE_API_KEY}.p8" |
| 93 | + decode_base64_to_file "$APPLE_API_KEY_BASE64" "$api_key_path" |
| 94 | + { |
| 95 | + echo "APPLE_API_KEY_PATH=$api_key_path" |
| 96 | + echo "APPLE_API_KEY=$APPLE_API_KEY" |
| 97 | + echo "APPLE_API_ISSUER=$APPLE_API_ISSUER" |
| 98 | + } >> "$GITHUB_ENV" |
| 99 | +fi |
| 100 | + |
| 101 | +if [[ "$has_notary_apple_id" == true ]]; then |
| 102 | + { |
| 103 | + echo "APPLE_ID=$APPLE_ID" |
| 104 | + echo "APPLE_PASSWORD=$APPLE_PASSWORD" |
| 105 | + echo "APPLE_TEAM_ID=$APPLE_TEAM_ID" |
| 106 | + } >> "$GITHUB_ENV" |
| 107 | +fi |
| 108 | + |
| 109 | +echo "::notice::Configured macOS signing identity: $signing_identity" |
0 commit comments