External/5chan
1
0
Fork 0
mirror of https://github.com/bitsocialnet/5chan.git synced 2026-08-03 07:41:04 +02:00
Code Issues Packages Projects Releases Wiki Activity

feat(electron): sign and notarize mac release builds (#1171)

Browse Source 
* feat(electron): sign and notarize mac release builds when Apple credentials are present

* fix(electron): work around codesign PID parsing for digit-leading app name in @electron/notarize

codesign interprets a bare '5chan.app' argument as process ID 5, so
@electron/notarize 2.5.0's pre-upload signature check fails with 'No such
process'. Backport the './' basename prefix from electron/notarize#245 as
a yarn patch until forge depends on notarize >= 3.x.

* docs(agent-playbooks): record codesign PID parsing surprise for digit-leading app name

* fix(ci): keep mac signing env consistent with certificate availability
This commit is contained in:
Tommaso Casaburi
2026-06-13 15:26:31 +07:00
committed by GitHub
parent 3484963a59
commit 85b782e934
8 changed files with 115 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.github/workflows/release.yml
+26
View File
@@ -156,9 +156,35 @@ jobs:
run: node electron/download-ipfs && sudo chmod +x bin/mac/ipfs
- name: Build React app
run: CI='' NODE_ENV=production yarn build
# Import the Developer ID Application certificate into a throwaway keychain so
# forge can sign and notarize. Skipped (build stays unsigned) if secrets are absent.
- name: Import code signing certificate
env:
APPLE_CERT_P12_BASE64: ${{ secrets.APPLE_CERT_P12_BASE64 }}
APPLE_CERT_P12_PASSWORD: ${{ secrets.APPLE_CERT_P12_PASSWORD }}
run: |
if [ -z "$APPLE_CERT_P12_BASE64" ]; then
echo "No signing certificate configured, building unsigned"
exit 0
fi
KEYCHAIN_PATH="$RUNNER_TEMP/signing.keychain-db"
KEYCHAIN_PASSWORD=$(uuidgen)
echo "$APPLE_CERT_P12_BASE64" | base64 --decode > "$RUNNER_TEMP/cert.p12"
security create-keychain -p "$KEYCHAIN_PASSWORD" "$KEYCHAIN_PATH"
security set-keychain-settings -lut 21600 "$KEYCHAIN_PATH"
security unlock-keychain -p "$KEYCHAIN_PASSWORD" "$KEYCHAIN_PATH"
security import "$RUNNER_TEMP/cert.p12" -P "$APPLE_CERT_P12_PASSWORD" -A -f pkcs12 -k "$KEYCHAIN_PATH"
security set-key-partition-list -S apple-tool:,apple: -s -k "$KEYCHAIN_PASSWORD" "$KEYCHAIN_PATH"
security list-keychains -d user -s "$KEYCHAIN_PATH" login.keychain-db
rm "$RUNNER_TEMP/cert.p12"
- name: Build Electron app for Mac
env:
CSC_IDENTITY_AUTO_DISCOVERY: 'false'
# Pass signing credentials only when the certificate was imported above, so
# forge's signing gate stays consistent with the keychain state.
APPLE_ID: ${{ secrets.APPLE_CERT_P12_BASE64 != '' && secrets.APPLE_ID || '' }}
APPLE_APP_SPECIFIC_PASSWORD: ${{ secrets.APPLE_CERT_P12_BASE64 != '' && secrets.APPLE_APP_SPECIFIC_PASSWORD || '' }}
APPLE_TEAM_ID: ${{ secrets.APPLE_CERT_P12_BASE64 != '' && secrets.APPLE_TEAM_ID || '' }}
run: |
if [ "${{ matrix.arch }}" = "arm64" ]; then
yarn electron:build:mac:arm64