-
-
Notifications
You must be signed in to change notification settings - Fork 17
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
CI: Add codesign steps and update some workflows
Also updates the README in preparation for the first release.
- Loading branch information
Showing
9 changed files
with
252 additions
and
14 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,66 @@ | ||
| name: Codesign Godot Project | ||
| description: Codesign and notarize Godot project export artifacts. | ||
|
|
||
| inputs: | ||
| platform: | ||
| description: Target platform. | ||
| required: true | ||
|
|
||
| setup-env: | ||
| description: Flag that enables the setup step. | ||
| default: false | ||
| codesign: | ||
| description: Flag that enables the codesign step. | ||
| default: false | ||
|
|
||
| # Setup arguments. | ||
| apple-cert-base64: | ||
| required: true | ||
| apple-cert-password: | ||
| required: true | ||
|
|
||
| # Codesign arguments. | ||
| apple-dev-id: | ||
| required: true | ||
| apple-dev-app-id: | ||
| required: true | ||
| apple-dev-team-id: | ||
| required: true | ||
| apple-dev-password: | ||
| required: true | ||
|
|
||
| # Input/output arguments. | ||
| directory: | ||
| description: Path to the folder with the project. | ||
| required: true | ||
| target-name: | ||
| description: Name of the project executable file or folder (like on macOS). | ||
| required: true | ||
|
|
||
| runs: | ||
| using: composite | ||
| steps: | ||
| # macOS-specific steps. | ||
|
|
||
| # Setup. | ||
|
|
||
| - name: Set up the signing environment (macos) | ||
| if: ${{ inputs.platform == 'macos' && inputs.setup-env == 'true' }} | ||
| shell: bash | ||
| env: | ||
| APPLE_CERT_BASE64: ${{ inputs.apple-cert-base64 }} | ||
| APPLE_CERT_PASSWORD: ${{ inputs.apple-cert-password }} | ||
| run: $GITHUB_ACTION_PATH/macos/setup.sh | ||
|
|
||
| # Codesign. | ||
|
|
||
| - name: Sign and notarize the project (macos) | ||
| if: ${{ inputs.platform == 'macos' && inputs.codesign == 'true' }} | ||
| shell: bash | ||
| env: | ||
| APPLE_DEV_ID: ${{ inputs.apple-dev-id }} | ||
| APPLE_DEV_APP_ID: ${{ inputs.apple-dev-app-id }} | ||
| APPLE_DEV_TEAM_ID: ${{ inputs.apple-dev-team-id }} | ||
| APPLE_DEV_PASSWORD: ${{ inputs.apple-dev-password }} | ||
| APP_PATH: ${{ inputs.directory }}/${{ inputs.target-name }} | ||
| run: $GITHUB_ACTION_PATH/macos/sign.sh |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,42 @@ | ||
| #!/bin/bash | ||
|
|
||
| # Based on https://github.com/godot-jolt/godot-jolt/blob/master/scripts/ci_sign_macos.ps1 | ||
|
|
||
| certificate_base64="$APPLE_CERT_BASE64" | ||
| certificate_password="$APPLE_CERT_PASSWORD" | ||
|
|
||
| if [ -z "${certificate_base64}" ]; then | ||
| echo "ERROR: Missing codesign certificate." | ||
| exit 1 | ||
| fi | ||
| if [ -z "${certificate_password}" ]; then | ||
| echo "ERROR: Missing codesign certificate password." | ||
| exit 1 | ||
| fi | ||
|
|
||
| # Convert the certificate back to its file form. | ||
|
|
||
| echo "Decoding the base64 certificate..." | ||
|
|
||
| certificate_path="certificate.p12" | ||
| base64 --decode -o ${certificate_path} <<< "${certificate_base64}" | ||
|
|
||
| # Set up the keychain and import the certificate. | ||
|
|
||
| keychain="ephemeral.keychain" | ||
| keychain_password="$(openssl rand -base64 16)" | ||
|
|
||
| echo "Creating the default keychain..." | ||
|
|
||
| security create-keychain -p ${keychain_password} ${keychain} | ||
| security default-keychain -s ${keychain} | ||
|
|
||
| echo "Importing the certificate into the keychain..." | ||
|
|
||
| security import ${certificate_path} -k ~/Library/Keychains/${keychain} -P ${certificate_password} -T /usr/bin/codesign | ||
| security find-identity | ||
|
|
||
| echo "Granting access to the keychain..." | ||
|
|
||
| security set-key-partition-list -S "apple-tool:,apple:" -s -k ${keychain_password} ${keychain} | ||
| security set-keychain-settings ${keychain} |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,52 @@ | ||
| #!/bin/bash | ||
|
|
||
| # Based on https://github.com/godot-jolt/godot-jolt/blob/master/scripts/ci_sign_macos.ps1 | ||
|
|
||
| apple_dev_id="$APPLE_DEV_ID" | ||
| apple_dev_app_id="$APPLE_DEV_APP_ID" | ||
| apple_dev_team_id="$APPLE_DEV_TEAM_ID" | ||
| apple_dev_password="$APPLE_DEV_PASSWORD" | ||
|
|
||
| app_path="$APP_PATH" | ||
| archive_path="$APP_PATH.zip" | ||
|
|
||
| if [ -z "${apple_dev_id}" ]; then | ||
| echo "ERROR: Missing Apple developer ID." | ||
| exit 1 | ||
| fi | ||
| if [ -z "${apple_dev_app_id}" ]; then | ||
| echo "ERROR: Missing Apple developer application ID." | ||
| exit 1 | ||
| fi | ||
| if [ -z "${apple_dev_team_id}" ]; then | ||
| echo "ERROR: Missing Apple team ID." | ||
| exit 1 | ||
| fi | ||
| if [ -z "${apple_dev_password}" ]; then | ||
| echo "ERROR: Missing Apple developer password." | ||
| exit 1 | ||
| fi | ||
| if [ -z "${app_path}" ]; then | ||
| echo "ERROR: Missing application path to sign." | ||
| exit 1 | ||
| fi | ||
|
|
||
| # Sign, notarize, and staple the app. | ||
|
|
||
| echo "Signing and verifying the app at '${app_path}'..." | ||
|
|
||
| codesign --timestamp --verbose --deep --force --options runtime --sign "${apple_dev_app_id}" "${app_path}" | ||
| codesign --verify "${app_path}" | ||
|
|
||
| echo "Archiving and notarizing the signed app..." | ||
|
|
||
| ditto -ck --keepParent "${app_path}" "${archive_path}" | ||
| xcrun notarytool submit "${archive_path}" --apple-id ${apple_dev_id} --team-id ${apple_dev_team_id} --password ${apple_dev_password} --wait | ||
|
|
||
| echo "Stapling the notarization ticket to the signed app..." | ||
|
|
||
| xcrun stapler staple "${app_path}" | ||
|
|
||
| echo "Cleaning up..." | ||
|
|
||
| rm -f "${archive_path}" |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters