Add sign and notarize macOS x86_64 #35

.github/workflows/release.yml

@@ -3,8 +3,8 @@ name: goreleaser
 on:
   push:
     # run only against tags
-    tags:
-      - '*'
+    # tags:
+    #   - '*'
 
 permissions:
   contents: write
@@ -13,7 +13,7 @@ permissions:
 
 jobs:
   goreleaser:
-    runs-on: ubuntu-latest
+    runs-on: macos-latest
     steps:
       -
         name: Checkout
@@ -29,6 +29,7 @@ jobs:
           tag: v0.0.19
           fileName: saturn-webui.tar.gz
           out-file-path: resources/webui
+          token: ${{ secrets.GITHUB_TOKEN }}
       -
         name: Unpack web UI archive
         run: |
@@ -43,6 +44,33 @@ jobs:
         uses: actions/setup-go@v2
         with:
           go-version: 1.18
+      -
+        name: Install gon
+        run: |
+          brew tap mitchellh/gon
+          brew install mitchellh/gon/gon
+      -
+        name: Install the Apple certificate and provisioning profile
+        env:
+          BUILD_CERTIFICATE_BASE64: ${{ secrets.BUILD_CERTIFICATE_BASE64 }}
+          P12_PASSWORD: ${{ secrets.P12_PASSWORD }}
+          KEYCHAIN_PASSWORD: ${{ secrets.KEYCHAIN_PASSWORD }}
+        run: |
+          # create variables
+          CERTIFICATE_PATH=$RUNNER_TEMP/build_certificate.p12
+          KEYCHAIN_PATH=$RUNNER_TEMP/app-signing.keychain-db
+
+          # import certificate and provisioning profile from secrets
+          echo -n "$BUILD_CERTIFICATE_BASE64" | base64 --decode --output $CERTIFICATE_PATH
+
+          # create temporary keychain
+          security create-keychain -p "$KEYCHAIN_PASSWORD" $KEYCHAIN_PATH
+          security set-keychain-settings -lut 21600 $KEYCHAIN_PATH
+          security unlock-keychain -p "$KEYCHAIN_PASSWORD" $KEYCHAIN_PATH
+
+          # import certificate to keychain
+          security import $CERTIFICATE_PATH -P "$P12_PASSWORD" -A -t cert -f pkcs12 -k $KEYCHAIN_PATH
+          security list-keychain -d user -s $KEYCHAIN_PATH
       -
         name: Run GoReleaser
         uses: goreleaser/goreleaser-action@v2
@@ -53,5 +81,14 @@ jobs:
           args: release --rm-dist
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          AC_USERNAME: ${{ secrets.AC_USERNAME }}
+          AC_PASSWORD: ${{ secrets.AC_PASSWORD }}
           # Your GoReleaser Pro key, if you are using the 'goreleaser-pro' distribution
           # GORELEASER_KEY: ${{ secrets.GORELEASER_KEY }}
+      -
+        name: Attach produced packages to Github Action
+        uses: actions/upload-artifact@v2
+        with:
+          name: dist
+          path: dist/*.tar.gz
+          if-no-files-found: error

.goreleaser.yaml

@@ -7,17 +7,31 @@ before:
     # you may remove this if you don't need go generate
     - go generate ./...
 builds:
-  - env:
-      - CGO_ENABLED=0
+  - binary: saturn-L2-node
+    id: saturn-L2-node
     goos:
       - linux
       - windows
-      - darwin
     ignore:
     - goos: windows
       goarch: arm64
     main: ./cmd/saturn-l2
-    binary: saturn-L2-node
+    env:
+      - CGO_ENABLED=0
+  - binary: saturn-L2-node
+    id: saturn-L2-node-macos
+    goos:
+    - darwin
+    main: ./cmd/saturn-l2
+    env:
+      - CGO_ENABLED=0
+signs:
+  - ids:
+      - saturn-L2-node-macos
+    cmd: gon
+    args:
+    - gon.hcl
+    artifacts: all
 
 archives:
   - replacements:

gon.hcl

@@ -0,0 +1,18 @@
+# gon.hcl
+#
+# The path follows a pattern
+# ./dist/BUILD-ID_TARGET/BINARY-NAME
+source = [
+  "./dist/saturn-L2-node-macos_darwin_amd64_v1/saturn-L2-node",
+  "./dist/saturn-L2-node-macos_darwin_arm64/saturn-L2-node"
+]
+bundle_id = "filecoin.saturn.l2-node"
+
+apple_id {
+  username = "@env:AC_USERNAME"
+  password = "@env:AC_PASSWORD"
+}
+
+sign {
+  application_identity = "Developer ID Application: Protocol Labs, Inc."
+}