fix: separate signing and notarization steps for macOS #17
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Release | |
| on: | |
| push: | |
| tags: | |
| - 'v*' | |
| jobs: | |
| build-and-release: | |
| runs-on: sre-eqx-kata | |
| permissions: | |
| contents: write | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: oven-sh/setup-bun@v2 | |
| - name: Install zip | |
| run: | | |
| for i in 1 2 3; do | |
| sudo apt-get install -y zip && break | |
| echo "Attempt $i failed, retrying in 5s..." | |
| sleep 5 | |
| done | |
| - run: bun install | |
| - run: bun run typecheck | |
| - run: bun test | |
| - run: bun run bundle:all | |
| - name: Download Codesign Client and signatures | |
| run: | | |
| curl -L -O https://codesign-distribution.labs.jb.gg/codesign-client-linux-amd64 | |
| curl -L -O https://codesign-distribution.labs.jb.gg/codesign-client-linux-amd64.sha256 | |
| curl -L -O https://codesign-distribution.labs.jb.gg/codesign-client-linux-amd64.sha256.asc | |
| - name: Import GPG public key | |
| run: | | |
| mkdir -p ~/.gnupg | |
| chmod 700 ~/.gnupg | |
| echo "batch" > ~/.gnupg/gpg.conf | |
| echo "no-tty" >> ~/.gnupg/gpg.conf | |
| echo "no-autostart" >> ~/.gnupg/gpg.conf | |
| curl -o - https://download-cdn.jetbrains.com/KEYS | gpg --batch --no-tty --no-autostart --import - | |
| - name: Verify SHA256 file signature | |
| run: | | |
| gpg --batch --no-tty --no-autostart --verify codesign-client-linux-amd64.sha256.asc codesign-client-linux-amd64.sha256 | |
| - name: Verify SHA256 checksum | |
| run: | | |
| sha256sum -c codesign-client-linux-amd64.sha256 | |
| chmod +x codesign-client-linux-amd64 | |
| - name: Sign Windows binary | |
| env: | |
| SERVICE_ACCOUNT_NAME: ${{ vars.SERVICE_ACCOUNT_NAME }} | |
| SERVICE_ACCOUNT_TOKEN: ${{ secrets.SERVICE_ACCOUNT_TOKEN }} | |
| run: | | |
| ./codesign-client-linux-amd64 -extensions "jsign_replace=true" dist/bin/codex-acp-x64-windows.exe | |
| - name: Package macOS binaries for signing | |
| run: | | |
| zip -j dist/bin/codex-acp-x64-darwin.zip dist/bin/codex-acp-x64-darwin | |
| zip -j dist/bin/codex-acp-arm64-darwin.zip dist/bin/codex-acp-arm64-darwin | |
| - name: Sign macOS binaries | |
| env: | |
| SERVICE_ACCOUNT_NAME: ${{ vars.SERVICE_ACCOUNT_NAME }} | |
| SERVICE_ACCOUNT_TOKEN: ${{ secrets.SERVICE_ACCOUNT_TOKEN }} | |
| run: | | |
| ./codesign-client-linux-amd64 \ | |
| -denoted-content-type="application/x-mac-app-zip" \ | |
| -extensions "mac_codesign_identity=Developer ID Application: JetBrains s.r.o. (2ZEFAR8TH3),mac_codesign_force=true,mac_codesign_options=runtime" \ | |
| -log-format json \ | |
| dist/bin/codex-acp-x64-darwin.zip | |
| ./codesign-client-linux-amd64 \ | |
| -denoted-content-type="application/x-mac-app-zip" \ | |
| -extensions "mac_codesign_identity=Developer ID Application: JetBrains s.r.o. (2ZEFAR8TH3),mac_codesign_force=true,mac_codesign_options=runtime" \ | |
| -log-format json \ | |
| dist/bin/codex-acp-arm64-darwin.zip | |
| - name: Move signed binaries | |
| run: | | |
| mv signed/codex-acp-x64-darwin.zip dist/bin/codex-acp-x64-darwin.zip | |
| mv signed/codex-acp-arm64-darwin.zip dist/bin/codex-acp-arm64-darwin.zip | |
| - name: Notarize macOS binaries | |
| env: | |
| SERVICE_ACCOUNT_NAME: ${{ vars.SERVICE_ACCOUNT_NAME }} | |
| SERVICE_ACCOUNT_TOKEN: ${{ secrets.SERVICE_ACCOUNT_TOKEN }} | |
| run: | | |
| ./codesign-client-linux-amd64 \ | |
| -denoted-content-type="application/x-mac-app-zip" \ | |
| -extensions "mac_notarize=true" \ | |
| -log-format json \ | |
| -max-wait 60m \ | |
| dist/bin/codex-acp-x64-darwin.zip | |
| ./codesign-client-linux-amd64 \ | |
| -denoted-content-type="application/x-mac-app-zip" \ | |
| -extensions "mac_notarize=true" \ | |
| -log-format json \ | |
| -max-wait 60m \ | |
| dist/bin/codex-acp-arm64-darwin.zip | |
| - name: Move notarized binaries | |
| run: | | |
| mv signed/codex-acp-x64-darwin.zip dist/bin/codex-acp-x64-darwin.zip | |
| mv signed/codex-acp-arm64-darwin.zip dist/bin/codex-acp-arm64-darwin.zip | |
| - name: Extract notarized binaries for packaging | |
| run: | | |
| unzip -o dist/bin/codex-acp-x64-darwin.zip -d dist/bin/ | |
| unzip -o dist/bin/codex-acp-arm64-darwin.zip -d dist/bin/ | |
| rm dist/bin/codex-acp-x64-darwin.zip dist/bin/codex-acp-arm64-darwin.zip | |
| - run: bun run package:all | |
| - name: Create Release | |
| uses: softprops/action-gh-release@v2 | |
| with: | |
| files: | | |
| dist/bin/codex-acp-x64-linux.zip | |
| dist/bin/codex-acp-arm64-linux.zip | |
| dist/bin/codex-acp-x64-darwin.zip | |
| dist/bin/codex-acp-arm64-darwin.zip | |
| dist/bin/codex-acp-x64-windows.zip | |
| generate_release_notes: true |