build: MacOS code signing (#1795)

Co-authored-by: Himself65 <himself65@outlook.com>
toeverything · Apr 3, 2023 · b1618e9 · b1618e9 · vercel · Apr 3, 2023
1 parent b365887
commit b1618e9
Show file tree

Hide file tree

Showing 3 changed files with 36 additions and 0 deletions.
diff --git a/.github/workflows/release-desktop-app.yml b/.github/workflows/release-desktop-app.yml
@@ -98,9 +98,19 @@ jobs:
       - name: move octobase Binary
         run: cp ./packages/octobase-node/octobase.*.node ./apps/electron/dist/layers/main/
 
+      - name: Signing By Apple Developer ID
+        uses: apple-actions/import-codesign-certs@v2
+        with:
+          p12-file-base64: ${{ secrets.CERTIFICATES_P12 }}
+          p12-password: ${{ secrets.CERTIFICATES_P12_PASSWORD }}
+
       - name: make build
         run: yarn make-macos-x64
         working-directory: apps/electron
+        env:
+          APPLE_ID: ${{ secrets.APPLE_ID }}
+          APPLE_PASSWORD: ${{ secrets.APPLE_PASSWORD }}
+          APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
 
       - name: Save x64 artifacts
         run: |
@@ -151,9 +161,19 @@ jobs:
       - name: move octobase Binary
         run: cp ./packages/octobase-node/octobase.*.node ./apps/electron/dist/layers/main/
 
+      - name: Signing By Apple Developer ID
+        uses: apple-actions/import-codesign-certs@v2
+        with:
+          p12-file-base64: ${{ secrets.CERTIFICATES_P12 }}
+          p12-password: ${{ secrets.CERTIFICATES_P12_PASSWORD }}
+
       - name: make build
         run: yarn make-macos-arm64
         working-directory: apps/electron
+        env:
+          APPLE_ID: ${{ secrets.APPLE_ID }}
+          APPLE_PASSWORD: ${{ secrets.APPLE_PASSWORD }}
+          APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
 
       - name: Save arm64 artifacts
         run: |

diff --git a/apps/electron/forge.config.js b/apps/electron/forge.config.js
@@ -2,6 +2,16 @@ module.exports = {
   packagerConfig: {
     name: 'AFFiNE',
     icon: './resources/icons/icon.icns',
+    osxSign: {
+      identity: 'Developer ID Application: TOEVERYTHING PTE. LTD.',
+      'hardened-runtime': true,
+    }, // object must exist even if empty
+    osxNotarize: {
+      tool: 'notarytool',
+      appleId: process.env.APPLE_ID,
+      appleIdPassword: process.env.APPLE_PASSWORD,
+      teamId: process.env.APPLE_TEAM_ID,
+    },
   },
   makers: [
     {

diff --git a/apps/electron/yarn.lock b/apps/electron/yarn.lock
@@ -5552,6 +5552,12 @@ __metadata:
   languageName: node
   linkType: hard
 
+"@toeverything/hooks@workspace:../../packages/hooks":
+  version: 0.0.0-use.local
+  resolution: "@toeverything/hooks@workspace:../../packages/hooks"
+  languageName: unknown
+  linkType: soft
+
 "@toeverything/y-indexeddb@workspace:*, @toeverything/y-indexeddb@workspace:../../packages/y-indexeddb":
   version: 0.0.0-use.local
   resolution: "@toeverything/y-indexeddb@workspace:../../packages/y-indexeddb"