nanakura/moeka-project
1
0
Fork 0
Code Issues Pull Requests 1 Actions 1 Packages Projects Releases Wiki Activity

chore(ci): macOS app code signing

Browse Source
This commit is contained in:
Neko Ayaka
2026-02-26 23:11:59 +08:00
parent 58991a15fa
commit f04e106b13
5 changed files with 65 additions and 35 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.github/workflows/release-tamagotchi.yml
+9 -31
View File
@@ -104,31 +104,6 @@ jobs:
- uses: actions/checkout@v6
# https://docs.github.com/en/actions/how-tos/deploy/deploy-to-third-party-platforms/sign-xcode-applications
# - name: Install the Apple certificate (macOS Only)
# if: matrix.os == 'macos-15-intel' || matrix.os == 'macos-26'
# env:
# BUILD_CERTIFICATE_BASE64: ${{ secrets.BUILD_CERTIFICATE_BASE64 }}
# P12_PASSWORD: ${{ secrets.P12_PASSWORD }}
# KEYCHAIN_PASSWORD: ${{ secrets.KEYCHAIN_PASSWORD }}
# run: |
# # create variables
# CERTIFICATE_PATH=$RUNNER_TEMP/build_certificate.p12
# KEYCHAIN_PATH=$RUNNER_TEMP/app-signing.keychain-db
# # import certificate from secrets
# echo -n "$BUILD_CERTIFICATE_BASE64" | base64 --decode -o $CERTIFICATE_PATH
# # create temporary keychain
# security create-keychain -p "$KEYCHAIN_PASSWORD" $KEYCHAIN_PATH
# security set-keychain-settings -lut 21600 $KEYCHAIN_PATH
# security unlock-keychain -p "$KEYCHAIN_PASSWORD" $KEYCHAIN_PATH
# # import certificate to keychain
# security import $CERTIFICATE_PATH -P "$P12_PASSWORD" -A -t cert -f pkcs12 -k $KEYCHAIN_PATH
# security set-key-partition-list -S apple-tool:,apple: -k "$KEYCHAIN_PASSWORD" $KEYCHAIN_PATH
# security list-keychain -d user -s $KEYCHAIN_PATH
- name: macOS Select Xcode 26.2
if: matrix.os == 'macos-15-intel' || matrix.os == 'macos-26'
run: |
@@ -164,9 +139,17 @@ jobs:
- name: Build (macOS Only) # macOS
if: matrix.os == 'macos-15-intel' || matrix.os == 'macos-26'
run: pnpm run -F @proj-airi/stage-tamagotchi build && pnpm -F @proj-airi/stage-tamagotchi exec electron-builder build ${{ matrix.builder-args }} --publish=${{ (inputs.build_only || inputs.artifacts_only) && 'never' || 'onTagOrDraft' }}
run: |
echo "$CSC_CONTENT" | base64 --decode > apple-developer-code-signing.p12
export CSC_LINK="./apple-developer-code-signing.p12"
pnpm run -F @proj-airi/stage-tamagotchi build && pnpm -F @proj-airi/stage-tamagotchi exec electron-builder build ${{ matrix.builder-args }} --publish=${{ (inputs.build_only || inputs.artifacts_only) && 'never' || 'onTagOrDraft' }}
env:
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
CSC_CONTENT: ${{ secrets.CSC_CONTENT }}
CSC_KEY_PASSWORD: ${{ secrets.CSC_KEY_PASSWORD }}
APPLE_DEVELOPER_TEAM_ID: ${{ secrets.APPLE_DEVELOPER_TEAM_ID }}
APPLE_DEVELOPER_APPLE_ID: ${{ secrets.APPLE_DEVELOPER_APPLE_ID }}
APPLE_DEVELOPER_APPLE_APP_SPECIFIC_PASSWORD: ${{ secrets.APPLE_DEVELOPER_APPLE_APP_SPECIFIC_PASSWORD }}
- name: Build (Linux Only) # Linux
if: matrix.os == 'ubuntu-latest' || matrix.os == 'ubuntu-24.04-arm'
@@ -365,11 +348,6 @@ jobs:
apps/stage-tamagotchi/bundle/latest-*.yml
append_body: true
# - name: Clean up keychain and provisioning profile (macOS Only)
# if: ${{ always() && (matrix.os == 'macos-15-intel' || matrix.os == 'macos-26') }}
# run: |
# security delete-keychain $RUNNER_TEMP/app-signing.keychain-db
merge-mac-latest:
name: Merge macOS latest-mac.yml
if: ${{ github.event_name == 'release' }} # Skipping will only exist when triggered by workflow_dispatch. No need to handle here