Skip to content

Remove installbuilder from macos release artifact #785

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 16 commits into from
May 19, 2023
Merged
Changes from 1 commit
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Prev Previous commit
Next Next commit
remove code-sign-mac-installers job: we already have a notarized dmg
  • Loading branch information
umbynos committed May 19, 2023
commit bfcfbd615f5d1773b315b7d2ef18c6adfcfb100c
77 changes: 0 additions & 77 deletions .github/workflows/release.yml
Original file line number Diff line number Diff line change
Expand Up @@ -412,83 +412,6 @@ jobs:
path: ArduinoCreateAgent*
if-no-files-found: error

# This job will sign and notarize mac installers
code-sign-mac-installers:
needs: package
strategy:
matrix:
arch: [amd64]

runs-on: macos-12
steps:
- name: Download artifact
uses: actions/download-artifact@v3
with:
name: ArduinoCreateAgent-osx-${{ matrix.arch }}
path: ArduinoCreateAgent-osx

# zip artifacts do not mantain executable permission
- name: Make executable
run: chmod -v +x ArduinoCreateAgent-osx/ArduinoCreateAgent-${GITHUB_REF##*/}-osx-${{ matrix.arch }}-installer.app/Contents/MacOS/*

- name: Import Code-Signing Certificates
run: |
echo "${{ secrets.INSTALLER_CERT_MAC_P12 }}" | base64 --decode > "${{ env.INSTALLER_CERT_MAC_PATH }}"
security create-keychain -p "${{ env.KEYCHAIN_PASSWORD }}" "${{ env.KEYCHAIN }}"
security default-keychain -s "${{ env.KEYCHAIN }}"
security unlock-keychain -p "${{ env.KEYCHAIN_PASSWORD }}" "${{ env.KEYCHAIN }}"
security import \
"${{ env.INSTALLER_CERT_MAC_PATH }}" \
-k "${{ env.KEYCHAIN }}" \
-f pkcs12 \
-A \
-T "/usr/bin/codesign" \
-P "${{ secrets.INSTALLER_CERT_MAC_PASSWORD }}"
security set-key-partition-list \
-S apple-tool:,apple: \
-s \
-k "${{ env.KEYCHAIN_PASSWORD }}" \
"${{ env.KEYCHAIN }}"

- name: Install gon for code signing and app notarization
run: |
wget -q https://github.com/mitchellh/gon/releases/download/v0.2.5/gon_macos.zip
unzip gon_macos.zip -d /usr/local/bin

- name: Write gon config to file
# gon does not allow env variables in config file (https://github.com/mitchellh/gon/issues/20)
run: |
cat > gon.config_installer.hcl <<EOF
source = ["ArduinoCreateAgent-osx/ArduinoCreateAgent-${GITHUB_REF##*/}-osx-${{ matrix.arch }}-installer.app"]
bundle_id = "cc.arduino.${{ env.PROJECT_NAME }}-installer"

sign {
application_identity = "Developer ID Application: ARDUINO SA (7KT7ZWMCJT)"
}

dmg {
output_path = "ArduinoCreateAgent-${GITHUB_REF##*/}-osx-${{ matrix.arch }}-installer.dmg"
volume_name = "ArduinoCreateAgent"
}
EOF

- name: Code sign and notarize app
run: |
echo "gon will notarize executable in ArduinoCreateAgent-osx/ArduinoCreateAgent-${GITHUB_REF##*/}-osx-${{ matrix.arch }}-installer.app"
gon -log-level=debug -log-json gon.config_installer.hcl
timeout-minutes: 30

# tar dmg file to keep executable permission
- name: Tar files to keep permissions
run: tar -cvf ArduinoCreateAgent-${GITHUB_REF##*/}-osx-${{ matrix.arch }}-installer.tar ArduinoCreateAgent-${GITHUB_REF##*/}-osx-${{ matrix.arch }}-installer.dmg

- name: Upload artifacts
uses: actions/upload-artifact@v3
with:
name: ArduinoCreateAgent-osx-${{ matrix.arch }}
path: ArduinoCreateAgent*.tar
if-no-files-found: error

create-release:
runs-on: ubuntu-20.04
needs: [build, code-sign-mac-installers]
Expand Down