Code sign macOS binaries

metabrainz · Dec 7, 2024 · 8f003a6 · 8f003a6
1 parent 9ae7214
commit 8f003a6
Showing 1 changed file with 19 additions and 0 deletions.
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
@@ -127,6 +127,25 @@ jobs:
         done
         cp -Rv include artifacts/
         cp -v ../COPYING ../README ../ChangeLog artifacts
+    - name: Prepare code signing certificate
+      run: |
+        if [ -n "$CODESIGN_MACOS_P12_URL" ] && [ -n "$AWS_ACCESS_KEY_ID" ]; then
+          pip3 install awscli
+          aws s3 cp "$CODESIGN_MACOS_P12_URL" ./appledev.p12
+        else
+          echo "::warning::No code signing certificate available, skipping code signing."
+        fi
+      env:
+        AWS_DEFAULT_REGION: eu-central-1
+        AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
+        AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
+        CODESIGN_MACOS_P12_URL: ${{ secrets.CODESIGN_MACOS_P12_URL }}
+    - name: Sign a Mach-O binary
+      uses: indygreg/apple-code-sign-action@v1
+      with:
+        input_path: artifacts
+        p12_file: ./appledev.p12
+        p12_password: ${{ secrets.CODESIGN_MACOS_P12_PASSWORD }}
     - name: Archive production artifacts
       uses: actions/upload-artifact@v4
       with: