Skip to content

Commit c9ca767

Browse files
cboulaycboulay
committed
Apple GHA - refactor to reuse certification setup across build and deploy jobs.
1 parent f45fe89 commit c9ca767

File tree

2 files changed

+89
-47
lines changed

2 files changed

+89
-47
lines changed

‎.github/actions/install-apple-certs/action.yml‎

Lines changed: 42 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,42 @@
1+
name: 'Install Apple Certificates'
2+
description: 'Installs Apple signing and notarization certificates and sets up the keychain'
3+
inputs:
4+
MACOS_CERTIFICATE_APP:
5+
required: true
6+
MACOS_CERTIFICATE_INST:
7+
required: true
8+
MACOS_CERTIFICATE_PWD:
9+
required: true
10+
MACOS_CI_KEYCHAIN_PWD:
11+
required: true
12+
runs:
13+
using: "composite"
14+
steps:
15+
- name: Install certificates and provisioning profiles
16+
shell: bash
17+
run: |
18+
# Create temporary keychain
19+
KEYCHAIN_PATH=$RUNNER_TEMP/build.keychain
20+
security create-keychain -p "${{ inputs.MACOS_CI_KEYCHAIN_PWD }}" $KEYCHAIN_PATH
21+
security default-keychain -s $KEYCHAIN_PATH
22+
security set-keychain-settings -lut 21600 $KEYCHAIN_PATH
23+
security unlock-keychain -p "${{ inputs.MACOS_CI_KEYCHAIN_PWD }}" $KEYCHAIN_PATH
24+
25+
# Import certificates from secrets ...
26+
CERTIFICATE_PATH_APP=$RUNNER_TEMP/build_certificate_app.p12
27+
CERTIFICATE_PATH_INST=$RUNNER_TEMP/build_certificate_inst.p12
28+
echo -n "${{ inputs.MACOS_CERTIFICATE_APP }}" | base64 --decode -o $CERTIFICATE_PATH_APP
29+
echo -n "${{ inputs.MACOS_CERTIFICATE_INST }}" | base64 --decode -o $CERTIFICATE_PATH_INST
30+
# ... to keychain
31+
security import $CERTIFICATE_PATH_APP -P "${{ inputs.MACOS_CERTIFICATE_PWD }}" -k $KEYCHAIN_PATH -A -t cert -f pkcs12
32+
security import $CERTIFICATE_PATH_INST -P "${{ inputs.MACOS_CERTIFICATE_PWD }}" -k $KEYCHAIN_PATH -A -t cert -f pkcs12
33+
34+
# Set trusted partitions (groups of applications) that can access the keychain items
35+
security set-key-partition-list -S apple-tool:,apple:,codesign: -s -k "${{ inputs.MACOS_CI_KEYCHAIN_PWD }}" $KEYCHAIN_PATH
36+
security list-keychain -d user -s $KEYCHAIN_PATH
37+
38+
# Get certificate identities into environment variables
39+
CERT_IDENTITY_APP=$(security find-identity -v -p codesigning $KEYCHAIN_PATH | grep "Developer ID Application" | head -1 | awk -F'"' '{print $2}')
40+
echo "APPLE_CODE_SIGN_IDENTITY_APP=$CERT_IDENTITY_APP" >> $GITHUB_ENV
41+
CERT_IDENTITY_INST=$(security find-identity -v -p basic $KEYCHAIN_PATH | grep "Developer ID Installer" | head -1 | awk -F'"' '{print $2}')
42+
echo "APPLE_CODE_SIGN_IDENTITY_INST=$CERT_IDENTITY_INST" >> $GITHUB_ENV

‎.github/workflows/apple.yml‎

Lines changed: 47 additions & 47 deletions
Original file line numberDiff line numberDiff line change
@@ -44,37 +44,12 @@ jobs:
4444
- uses: actions/checkout@v4
4545

4646
- name: Install certificates and provisioning profiles
47-
env:
47+
uses: ./.github/actions/install-apple-certs
48+
with:
4849
MACOS_CERTIFICATE_APP: ${{ secrets.PROD_MACOS_CERTIFICATE }}
4950
MACOS_CERTIFICATE_INST: ${{ secrets.PROD_MACOS_CERTIFICATE_INST }}
5051
MACOS_CERTIFICATE_PWD: ${{ secrets.PROD_MACOS_CERTIFICATE_PWD }}
5152
MACOS_CI_KEYCHAIN_PWD: ${{ secrets.PROD_MACOS_CI_KEYCHAIN_PWD }}
52-
run: |
53-
# Create temporary keychain
54-
KEYCHAIN_PATH=$RUNNER_TEMP/build.keychain
55-
security create-keychain -p "$MACOS_CI_KEYCHAIN_PWD" $KEYCHAIN_PATH
56-
security default-keychain -s $KEYCHAIN_PATH
57-
security set-keychain-settings -lut 21600 $KEYCHAIN_PATH
58-
security unlock-keychain -p "$MACOS_CI_KEYCHAIN_PWD" $KEYCHAIN_PATH
59-
60-
# Import certificates from secrets ...
61-
CERTIFICATE_PATH_APP=$RUNNER_TEMP/build_certificate_app.p12
62-
CERTIFICATE_PATH_INST=$RUNNER_TEMP/build_certificate_inst.p12
63-
echo -n "$MACOS_CERTIFICATE_APP" | base64 --decode -o $CERTIFICATE_PATH_APP
64-
echo -n "$MACOS_CERTIFICATE_INST" | base64 --decode -o $CERTIFICATE_PATH_INST
65-
# ... to keychain
66-
security import $CERTIFICATE_PATH_APP -P "$MACOS_CERTIFICATE_PWD" -k $KEYCHAIN_PATH -A -t cert -f pkcs12
67-
security import $CERTIFICATE_PATH_INST -P "$MACOS_CERTIFICATE_PWD" -k $KEYCHAIN_PATH -A -t cert -f pkcs12
68-
69-
# Set trusted partitions (groups of applications) that can access the keychain items
70-
security set-key-partition-list -S apple-tool:,apple:,codesign: -s -k "$MACOS_CI_KEYCHAIN_PWD" $KEYCHAIN_PATH
71-
security list-keychain -d user -s $KEYCHAIN_PATH
72-
73-
# Get certificate identities into environment variables
74-
CERT_IDENTITY_APP=$(security find-identity -v -p codesigning $KEYCHAIN_PATH | grep "Developer ID Application" | head -1 | awk -F'"' '{print $2}')
75-
echo "APPLE_CODE_SIGN_IDENTITY_APP=$CERT_IDENTITY_APP" >> $GITHUB_ENV
76-
CERT_IDENTITY_INST=$(security find-identity -v -p basic $KEYCHAIN_PATH | grep "Developer ID Installer" | head -1 | awk -F'"' '{print $2}')
77-
echo "APPLE_CODE_SIGN_IDENTITY_INST=$CERT_IDENTITY_INST" >> $GITHUB_ENV
7853

7954
- name: Configure CMake
8055
env:
@@ -158,43 +133,68 @@ jobs:
158133
name: build-iOS
159134
path: build-iOS
160135

161-
- name: Create XCFramework
136+
- name: Install certificates and provisioning profiles
137+
uses: ./.github/actions/install-apple-certs
138+
with:
139+
MACOS_CERTIFICATE_APP: ${{ secrets.PROD_MACOS_CERTIFICATE }}
140+
MACOS_CERTIFICATE_INST: ${{ secrets.PROD_MACOS_CERTIFICATE_INST }}
141+
MACOS_CERTIFICATE_PWD: ${{ secrets.PROD_MACOS_CERTIFICATE_PWD }}
142+
MACOS_CI_KEYCHAIN_PWD: ${{ secrets.PROD_MACOS_CI_KEYCHAIN_PWD }}
143+
144+
- name: Package and Notarize macOS Installer
145+
env:
146+
APPLE_DEVELOPMENT_TEAM: ${{ secrets.PROD_MACOS_NOTARIZATION_TEAM_ID }}
147+
APPLE_NOTARIZE_USERNAME: ${{ secrets.PROD_MACOS_NOTARIZATION_APPLE_ID }}
148+
APPLE_NOTARIZE_PASSWORD: ${{ secrets.PROD_MACOS_NOTARIZATION_PWD }}
149+
run: |
150+
# Get the version number from the framework's Info.plist
151+
VERSION=$(plutil -extract CFBundleShortVersionString xml1 -o - build-macOS-latest/install/Frameworks/lsl.framework/Versions/A/Resources/Info.plist | sed -n 's/.*<string>\(.*\)<\/string>.*/\1/p')
152+
echo "LSL_VERSION=$VERSION" >> $GITHUB_ENV
153+
154+
mkdir -p package
155+
productbuild --sign "$APPLE_CODE_SIGN_IDENTITY_INST" \
156+
--component build-macOS-latest/install/Frameworks/lsl.framework \
157+
/Library/Frameworks package/liblsl-${LSL_VERSION}-Darwin-universal.pkg
158+
# Notarize the package
159+
xcrun notarytool submit package/liblsl-${LSL_VERSION}-Darwin-universal.pkg \
160+
--apple-id "$APPLE_NOTARIZE_USERNAME" \
161+
--password "$APPLE_NOTARIZE_PASSWORD" \
162+
--team-id "$APPLE_DEVELOPMENT_TEAM" \
163+
--wait
164+
# Staple the notarization ticket to the package
165+
xcrun stapler staple package/liblsl-${LSL_VERSION}-Darwin-universal.pkg
166+
167+
- name: Create, Sign, and Notarize XCFramework
168+
env:
169+
APPLE_DEVELOPMENT_TEAM: ${{ secrets.PROD_MACOS_NOTARIZATION_TEAM_ID }}
170+
APPLE_NOTARIZE_USERNAME: ${{ secrets.PROD_MACOS_NOTARIZATION_APPLE_ID }}
171+
APPLE_NOTARIZE_PASSWORD: ${{ secrets.PROD_MACOS_NOTARIZATION_PWD }}
162172
run: |
163173
xcodebuild -create-xcframework \
164174
-framework build-macOS-latest/install/Frameworks/lsl.framework \
165175
-framework build-iOS/install/Frameworks/lsl.framework \
166176
-output lsl.xcframework
167-
xcodebuild -show-sdk-version
168-
169-
- name: Codesign XCFramework
170-
env:
171-
APPLE_CODE_SIGN_IDENTITY_APP: ${{ secrets.PROD_MACOS_CERTIFICATE_IDENTITY_APP }}
172-
run: |
177+
173178
codesign -vvv --force --deep --sign "$APPLE_CODE_SIGN_IDENTITY_APP" lsl.xcframework
174179
echo "✅ Verifying binary signatures in XCFramework..."
175180
codesign -vvv --verify --deep --strict lsl.xcframework
176181
177-
- name: Create zip archive
178-
run: ditto -c -k --sequesterRsrc --keepParent lsl.xcframework lsl.xcframework.zip
182+
ditto -c -k --sequesterRsrc --keepParent lsl.xcframework lsl.xcframework.zip
179183
180-
- name: Notarize XCFramework
181-
env:
182-
APPLE_DEVELOPMENT_TEAM: ${{ secrets.PROD_MACOS_NOTARIZATION_TEAM_ID }}
183-
APPLE_NOTARIZE_USERNAME: ${{ secrets.PROD_MACOS_NOTARIZATION_APPLE_ID }}
184-
APPLE_NOTARIZE_PASSWORD: ${{ secrets.PROD_MACOS_NOTARIZATION_PWD }}
185-
run: |
186184
xcrun notarytool submit lsl.xcframework.zip \
187185
--apple-id "$APPLE_NOTARIZE_USERNAME" \
188186
--password "$APPLE_NOTARIZE_PASSWORD" \
189187
--team-id "$APPLE_DEVELOPMENT_TEAM" \
190188
--wait
191189
xcrun stapler staple lsl.xcframework
192190
193-
- name: upload xcframework
191+
- name: upload artifacts
194192
uses: actions/upload-artifact@v4
195193
with:
196-
name: xcframework
197-
path: lsl.xcframework.zip
194+
name: mac-packages
195+
path: |
196+
lsl.xcframework.zip
197+
package/
198198
199199
- name: upload to release page
200200
if: github.event_name == 'release'
@@ -204,8 +204,8 @@ jobs:
204204
UPLOAD_URL: ${{ github.event.release.upload_url }}
205205
run: |
206206
UPLOAD_URL=${UPLOAD_URL%\{*} # remove "{name,label}" suffix
207-
for pkg in lsl.xcframework.zip; do
207+
for pkg in lsl.xcframework.zip package/*.*; do
208208
NAME=$(basename $pkg)
209209
MIME=$(file --mime-type $pkg|cut -d ' ' -f2)
210210
curl -X POST -H "Accept: application/vnd.github.v3+json" -H "Authorization: $TOKEN" -H "Content-Type: $MIME" --data-binary @$pkg $UPLOAD_URL?name=$NAME
211-
done
211+
done

0 commit comments

Comments
 (0)