fix: add entitlements for Bun executable on macOS #19
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Release | |
| on: | |
| push: | |
| tags: | |
| - 'v*' | |
| jobs: | |
| build-and-release: | |
| runs-on: sre-eqx-kata | |
| permissions: | |
| contents: write | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: oven-sh/setup-bun@v2 | |
| - name: Install zip | |
| run: | | |
| for i in 1 2 3; do | |
| sudo apt-get install -y zip && break | |
| echo "Attempt $i failed, retrying in 5s..." | |
| sleep 5 | |
| done | |
| - run: bun install | |
| - run: bun run typecheck | |
| - run: bun test | |
| - run: bun run bundle:all | |
| - name: Download Codesign Client and signatures | |
| run: | | |
| curl -L -O https://codesign-distribution.labs.jb.gg/codesign-client-linux-amd64 | |
| curl -L -O https://codesign-distribution.labs.jb.gg/codesign-client-linux-amd64.sha256 | |
| curl -L -O https://codesign-distribution.labs.jb.gg/codesign-client-linux-amd64.sha256.asc | |
| - name: Import GPG public key | |
| run: | | |
| mkdir -p ~/.gnupg | |
| chmod 700 ~/.gnupg | |
| echo "batch" > ~/.gnupg/gpg.conf | |
| echo "no-tty" >> ~/.gnupg/gpg.conf | |
| echo "no-autostart" >> ~/.gnupg/gpg.conf | |
| curl -o - https://download-cdn.jetbrains.com/KEYS | gpg --batch --no-tty --no-autostart --import - | |
| - name: Verify SHA256 file signature | |
| run: | | |
| gpg --batch --no-tty --no-autostart --verify codesign-client-linux-amd64.sha256.asc codesign-client-linux-amd64.sha256 | |
| - name: Verify SHA256 checksum | |
| run: | | |
| sha256sum -c codesign-client-linux-amd64.sha256 | |
| chmod +x codesign-client-linux-amd64 | |
| - name: Sign Windows binary | |
| env: | |
| SERVICE_ACCOUNT_NAME: ${{ vars.SERVICE_ACCOUNT_NAME }} | |
| SERVICE_ACCOUNT_TOKEN: ${{ secrets.SERVICE_ACCOUNT_TOKEN }} | |
| run: | | |
| ./codesign-client-linux-amd64 -extensions "jsign_replace=true" dist/bin/codex-acp-x64-windows.exe | |
| - name: Package macOS binaries for signing | |
| run: | | |
| zip -j dist/bin/codex-acp-x64-darwin.zip dist/bin/codex-acp-x64-darwin | |
| zip -j dist/bin/codex-acp-arm64-darwin.zip dist/bin/codex-acp-arm64-darwin | |
| - name: Create entitlements for macOS | |
| run: | | |
| cat > entitlements.plist << 'EOF' | |
| <?xml version="1.0" encoding="UTF-8"?> | |
| <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"> | |
| <plist version="1.0"> | |
| <dict> | |
| <key>com.apple.security.cs.allow-jit</key> | |
| <true/> | |
| <key>com.apple.security.cs.allow-unsigned-executable-memory</key> | |
| <true/> | |
| <key>com.apple.security.cs.disable-executable-page-protection</key> | |
| <true/> | |
| <key>com.apple.security.cs.allow-dyld-environment-variables</key> | |
| <true/> | |
| <key>com.apple.security.cs.disable-library-validation</key> | |
| <true/> | |
| </dict> | |
| </plist> | |
| EOF | |
| ENTITLEMENTS_BASE64=$(gzip -c entitlements.plist | base64 -w 0) | |
| echo "ENTITLEMENTS_BASE64=$ENTITLEMENTS_BASE64" >> $GITHUB_ENV | |
| - name: Sign macOS binaries | |
| env: | |
| SERVICE_ACCOUNT_NAME: ${{ vars.SERVICE_ACCOUNT_NAME }} | |
| SERVICE_ACCOUNT_TOKEN: ${{ secrets.SERVICE_ACCOUNT_TOKEN }} | |
| run: | | |
| ./codesign-client-linux-amd64 \ | |
| -denoted-content-type="application/x-mac-app-zip" \ | |
| -extensions "mac_codesign_identity=Developer ID Application: JetBrains s.r.o. (2ZEFAR8TH3),mac_codesign_force=true,mac_codesign_options=runtime,mac_codesign_entitlements=$ENTITLEMENTS_BASE64" \ | |
| -log-format json \ | |
| dist/bin/codex-acp-x64-darwin.zip | |
| ./codesign-client-linux-amd64 \ | |
| -denoted-content-type="application/x-mac-app-zip" \ | |
| -extensions "mac_codesign_identity=Developer ID Application: JetBrains s.r.o. (2ZEFAR8TH3),mac_codesign_force=true,mac_codesign_options=runtime,mac_codesign_entitlements=$ENTITLEMENTS_BASE64" \ | |
| -log-format json \ | |
| dist/bin/codex-acp-arm64-darwin.zip | |
| - name: Move signed binaries | |
| run: | | |
| mv signed/codex-acp-x64-darwin.zip dist/bin/codex-acp-x64-darwin.zip | |
| mv signed/codex-acp-arm64-darwin.zip dist/bin/codex-acp-arm64-darwin.zip | |
| - name: Notarize macOS binaries | |
| env: | |
| SERVICE_ACCOUNT_NAME: ${{ vars.SERVICE_ACCOUNT_NAME }} | |
| SERVICE_ACCOUNT_TOKEN: ${{ secrets.SERVICE_ACCOUNT_TOKEN }} | |
| run: | | |
| ./codesign-client-linux-amd64 \ | |
| -denoted-content-type="application/x-mac-app-zip" \ | |
| -extensions "mac_notarize=true" \ | |
| -log-format json \ | |
| -max-wait 60m \ | |
| dist/bin/codex-acp-x64-darwin.zip | |
| ./codesign-client-linux-amd64 \ | |
| -denoted-content-type="application/x-mac-app-zip" \ | |
| -extensions "mac_notarize=true" \ | |
| -log-format json \ | |
| -max-wait 60m \ | |
| dist/bin/codex-acp-arm64-darwin.zip | |
| - name: Move notarized binaries | |
| run: | | |
| mv signed/codex-acp-x64-darwin.zip dist/bin/codex-acp-x64-darwin.zip | |
| mv signed/codex-acp-arm64-darwin.zip dist/bin/codex-acp-arm64-darwin.zip | |
| - name: Extract notarized binaries for packaging | |
| run: | | |
| unzip -o dist/bin/codex-acp-x64-darwin.zip -d dist/bin/ | |
| unzip -o dist/bin/codex-acp-arm64-darwin.zip -d dist/bin/ | |
| rm dist/bin/codex-acp-x64-darwin.zip dist/bin/codex-acp-arm64-darwin.zip | |
| - run: bun run package:all | |
| - name: Create Release | |
| uses: softprops/action-gh-release@v2 | |
| with: | |
| files: | | |
| dist/bin/codex-acp-x64-linux.zip | |
| dist/bin/codex-acp-arm64-linux.zip | |
| dist/bin/codex-acp-x64-darwin.zip | |
| dist/bin/codex-acp-arm64-darwin.zip | |
| dist/bin/codex-acp-x64-windows.zip | |
| generate_release_notes: true | |
| - name: Upload release artifacts | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: release-binaries | |
| path: dist/bin/*.zip | |
| retention-days: 1 | |
| deploy-to-s3: | |
| name: Deploy to S3 | |
| needs: build-and-release | |
| runs-on: ubuntu-latest | |
| permissions: | |
| id-token: write | |
| contents: read | |
| steps: | |
| - name: Download release artifacts | |
| uses: actions/download-artifact@v4 | |
| with: | |
| name: release-binaries | |
| path: release-assets | |
| - name: List downloaded artifacts | |
| run: | | |
| echo "Downloaded artifacts:" | |
| ls -lh release-assets/ | |
| - name: Configure AWS credentials | |
| uses: aws-actions/configure-aws-credentials@v5 | |
| with: | |
| role-to-assume: arn:aws:iam::379565177229:role/resources-codex-acp-deployer | |
| role-session-name: GitHub_to_AWS_via_FederatedOIDC | |
| aws-region: eu-west-1 | |
| - name: Upload to S3 | |
| run: | | |
| VERSION="${GITHUB_REF_NAME#v}" | |
| S3_PATH="s3://download-prod-cdn.jetbrains.com/resources/acp/${VERSION}/" | |
| LATEST_PATH="s3://download-prod-cdn.jetbrains.com/resources/acp/latest/" | |
| echo "Uploading version: $VERSION" | |
| echo "Destinations:" | |
| echo " - ${S3_PATH}" | |
| echo " - ${LATEST_PATH}" | |
| # Upload to versioned path | |
| echo "" | |
| echo "Uploading to versioned path..." | |
| aws s3 cp release-assets/ "${S3_PATH}" --recursive \ | |
| --cache-control "max-age=31536000, public" | |
| # Upload to latest path | |
| echo "" | |
| echo "Uploading to latest path..." | |
| aws s3 cp release-assets/ "${LATEST_PATH}" --recursive \ | |
| --cache-control "max-age=300, public" | |
| BASE_URL="https://download.jetbrains.com/resources/acp" | |
| echo "" | |
| echo "Artifacts uploaded to S3" | |
| echo "" | |
| echo "Download URLs (versioned):" | |
| for file in release-assets/*.zip; do | |
| filename=$(basename "$file") | |
| echo " ${BASE_URL}/${VERSION}/${filename}" | |
| done | |
| echo "" | |
| echo "Download URLs (latest):" | |
| for file in release-assets/*.zip; do | |
| filename=$(basename "$file") | |
| echo " ${BASE_URL}/latest/${filename}" | |
| done |