mirrors/opencode
1
0
Fork 0
mirror of https://github.com/anomalyco/opencode.git synced 2026-11-09 22:25:02 +03:00
Code Issues Packages Projects Releases Wiki Activity

fix(ci): sign macOS builds with release environment credentials (#59760)

Browse Source
This commit is contained in:
Dax
2026-10-27 18:55:37 -04:00
committed by GitHub
Unverified
parent 6abf95b947
commit 426c7d8fa7
3 changed files with 15 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.github/release/sign-desktop-macos.sh
+3 -3
View File
@@ -3,7 +3,7 @@
# notarizes them in one submission, staples them, and only then builds opencode-desktop-mac-<arch>.{zip,dmg,app.tar.gz}
# from the stapled apps. Dry runs sign ad-hoc and skip notarization. Dev and beta trade larger files for faster
# packaging (zip and dmg at zlib level 1) and skip the .app.tar.gz, which only the retired Tauri updater feed read.
# Notarization reads APPLE_API_KEY_CONTENT, APPLE_API_KEY_ID and APPLE_API_ISSUER.
# Notarization reads APPLE_NOTARY_KEY (the .p8 contents), APPLE_NOTARY_KEY_ID and APPLE_NOTARY_ISSUER_ID.
. "$(dirname "$0")/lib.sh"
out=$1
@@ -60,9 +60,9 @@ done
if ! dry_run; then
key=$(mktemp)
printf '%s\n' "$APPLE_API_KEY_CONTENT" > "$key"
printf '%s\n' "$APPLE_NOTARY_KEY" > "$key"
ditto -c -k --sequesterRsrc "$apps" "$apps.zip"
xcrun notarytool submit "$apps.zip" --key "$key" --key-id "$APPLE_API_KEY_ID" --issuer "$APPLE_API_ISSUER" \
xcrun notarytool submit "$apps.zip" --key "$key" --key-id "$APPLE_NOTARY_KEY_ID" --issuer "$APPLE_NOTARY_ISSUER_ID" \
--wait --timeout 60m --output-format json > "$apps.json"
rm -f "$key"
cat "$apps.json"
.github/workflows/release-dry-run.yml
+6 -5
View File
@@ -385,8 +385,9 @@ jobs:
uses: apple-actions/import-codesign-certs@8f3fb608891dd2244cdab3d69cd68c0d37a7fe93 # v2.0.0
with:
keychain: build
p12-file-base64: ${{ secrets.APPLE_CERTIFICATE }}
p12-password: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
p12-file-base64: ${{ secrets.APPLE_SIGNING_CERTIFICATE }}
# The certificate has no password; the action passes this to `security import -P`.
p12-password: ""
- name: Sign CLI
if: needs.plan.outputs.cli == 'true'
run: bash .github/release/sign-cli-macos.sh "$RUNNER_TEMP/in/build-npm" "$RUNNER_TEMP/out"
@@ -396,9 +397,9 @@ jobs:
bash .github/release/sign-desktop-macos.sh "$RUNNER_TEMP/out" \
"$RUNNER_TEMP"/in/build-desktop-darwin-*/opencode-desktop-mac-*.app.tar
env:
APPLE_API_KEY_CONTENT: ${{ secrets.APPLE_API_KEY_PATH }}
APPLE_API_KEY_ID: ${{ secrets.APPLE_API_KEY }}
APPLE_API_ISSUER: ${{ secrets.APPLE_API_ISSUER }}
APPLE_NOTARY_KEY: ${{ secrets.APPLE_NOTARY_KEY }}
APPLE_NOTARY_KEY_ID: ${{ vars.APPLE_NOTARY_KEY_ID }}
APPLE_NOTARY_ISSUER_ID: ${{ vars.APPLE_NOTARY_ISSUER_ID }}
- id: upload
name: Upload
uses: ./.github/release/upload
.github/workflows/release.yml
+6 -5
View File
@@ -404,8 +404,9 @@ jobs:
uses: apple-actions/import-codesign-certs@8f3fb608891dd2244cdab3d69cd68c0d37a7fe93 # v2.0.0
with:
keychain: build
p12-file-base64: ${{ secrets.APPLE_CERTIFICATE }}
p12-password: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
p12-file-base64: ${{ secrets.APPLE_SIGNING_CERTIFICATE }}
# The certificate has no password; the action passes this to `security import -P`.
p12-password: ""
- name: Sign CLI
if: needs.plan.outputs.cli == 'true'
run: bash .github/release/sign-cli-macos.sh "$RUNNER_TEMP/in/build-npm" "$RUNNER_TEMP/out"
@@ -415,9 +416,9 @@ jobs:
bash .github/release/sign-desktop-macos.sh "$RUNNER_TEMP/out" \
"$RUNNER_TEMP"/in/build-desktop-darwin-*/opencode-desktop-mac-*.app.tar
env:
APPLE_API_KEY_CONTENT: ${{ secrets.APPLE_API_KEY_PATH }}
APPLE_API_KEY_ID: ${{ secrets.APPLE_API_KEY }}
APPLE_API_ISSUER: ${{ secrets.APPLE_API_ISSUER }}
APPLE_NOTARY_KEY: ${{ secrets.APPLE_NOTARY_KEY }}
APPLE_NOTARY_KEY_ID: ${{ vars.APPLE_NOTARY_KEY_ID }}
APPLE_NOTARY_ISSUER_ID: ${{ vars.APPLE_NOTARY_ISSUER_ID }}
- id: upload
name: Upload
uses: ./.github/release/upload