ci: finalize notarization asynchronously

2026-07-15 19:55:12 +02:00
parent e7d5455ec4
commit 11dfd97801
4 changed files with 265 additions and 66 deletions
@@ -0,0 +1,139 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+APP_NAME="Meetingnotes"
+RUNNER_TEMP="${RUNNER_TEMP:-/tmp}"
+PENDING_DIR="${PENDING_DIR:-$RUNNER_TEMP/meetingnotes-pending}"
+WORK_ROOT="${WORK_ROOT:-$RUNNER_TEMP/meetingnotes-finalize}"
+APP_PATH="$WORK_ROOT/$APP_NAME.app"
+RELEASE_DIR="$WORK_ROOT/release"
+VERSION_PATH="$PENDING_DIR/version"
+COMMIT_SHA_PATH="$PENDING_DIR/commit-sha"
+SUBMISSION_PATH="$PENDING_DIR/notary-submission.json"
+PRE_NOTARY_ZIP="$PENDING_DIR/$APP_NAME-pre-notary.zip"
+
+required_variables=(
+  APPLE_ID
+  APPLE_TEAM_ID
+  APPLE_APP_PASSWORD
+  SPARKLE_PRIVATE_KEY
+  GH_TOKEN
+  GITHUB_REPOSITORY
+)
+
+for variable in "${required_variables[@]}"; do
+  if [[ -z "${!variable:-}" ]]; then
+    echo "Missing required environment variable: $variable" >&2
+    exit 1
+  fi
+done
+
+for path in "$VERSION_PATH" "$COMMIT_SHA_PATH" "$SUBMISSION_PATH" "$PRE_NOTARY_ZIP" "$PENDING_DIR/generate_appcast"; do
+  if [[ ! -e "$path" ]]; then
+    echo "Missing release submission artifact: $path" >&2
+    exit 1
+  fi
+done
+
+VERSION=$(<"$VERSION_PATH")
+COMMIT_SHA=$(<"$COMMIT_SHA_PATH")
+SUBMISSION_ID=$(plutil -extract id raw -o - "$SUBMISSION_PATH")
+TAG="v$VERSION"
+
+if gh release view "$TAG" --repo "$GITHUB_REPOSITORY" >/dev/null 2>&1; then
+  echo "Release already exists: $TAG"
+  exit 0
+fi
+
+STATUS_PATH="$WORK_ROOT/notary-status.json"
+rm -rf "$WORK_ROOT"
+mkdir -p "$RELEASE_DIR"
+
+notary_info_succeeded=false
+for attempt in 1 2 3; do
+  if xcrun notarytool info "$SUBMISSION_ID" \
+    --apple-id "$APPLE_ID" \
+    --team-id "$APPLE_TEAM_ID" \
+    --password "$APPLE_APP_PASSWORD" \
+    --output-format json > "$STATUS_PATH"; then
+    notary_info_succeeded=true
+    break
+  fi
+  echo "Notary status check failed ($attempt/3); retrying"
+  sleep 15
+done
+
+if [[ "$notary_info_succeeded" != true ]]; then
+  echo "Unable to query Apple notarization status after three attempts" >&2
+  exit 1
+fi
+
+NOTARY_STATUS=$(plutil -extract status raw -o - "$STATUS_PATH")
+echo "Notarization status for $SUBMISSION_ID: $NOTARY_STATUS"
+
+case "$NOTARY_STATUS" in
+  "In Progress")
+    if [[ -n "${GITHUB_STEP_SUMMARY:-}" ]]; then
+      printf 'Apple is still processing Meetingnotes %s. Submission: `%s`. The scheduled workflow will check again.\n' \
+        "$VERSION" "$SUBMISSION_ID" >> "$GITHUB_STEP_SUMMARY"
+    fi
+    exit 0
+    ;;
+  Accepted)
+    ;;
+  Invalid|Rejected)
+    xcrun notarytool log "$SUBMISSION_ID" \
+      --apple-id "$APPLE_ID" \
+      --team-id "$APPLE_TEAM_ID" \
+      --password "$APPLE_APP_PASSWORD" || true
+    exit 1
+    ;;
+  *)
+    echo "Unexpected notarization status: $NOTARY_STATUS" >&2
+    exit 1
+    ;;
+esac
+
+ditto -x -k "$PRE_NOTARY_ZIP" "$WORK_ROOT"
+if [[ ! -d "$APP_PATH" ]]; then
+  echo "Signed app was not found after extracting $PRE_NOTARY_ZIP" >&2
+  exit 1
+fi
+
+APP_VERSION=$(plutil -extract CFBundleShortVersionString raw -o - "$APP_PATH/Contents/Info.plist")
+if [[ "$APP_VERSION" != "$VERSION" ]]; then
+  echo "Signed app version $APP_VERSION does not match release version $VERSION" >&2
+  exit 1
+fi
+
+xcrun stapler staple "$APP_PATH"
+xcrun stapler validate "$APP_PATH"
+spctl --assess --type execute --verbose=2 "$APP_PATH"
+
+ARCHIVE_NAME="$APP_NAME-$VERSION.zip"
+ARCHIVE_PATH="$RELEASE_DIR/$ARCHIVE_NAME"
+ditto -c -k --sequesterRsrc --keepParent "$APP_PATH" "$ARCHIVE_PATH"
+
+GENERATE_APPCAST="$PENDING_DIR/generate_appcast"
+chmod +x "$GENERATE_APPCAST"
+DOWNLOAD_URL="https://github.com/$GITHUB_REPOSITORY/releases/download/$TAG/"
+printf '%s' "$SPARKLE_PRIVATE_KEY" | "$GENERATE_APPCAST" "$RELEASE_DIR" \
+  --ed-key-file - \
+  --download-url-prefix "$DOWNLOAD_URL" \
+  --maximum-deltas 0 \
+  -o "$RELEASE_DIR/appcast.xml"
+
+grep -q "$DOWNLOAD_URL$ARCHIVE_NAME" "$RELEASE_DIR/appcast.xml"
+grep -q 'sparkle:edSignature=' "$RELEASE_DIR/appcast.xml"
+
+gh release \
+  create "$TAG" \
+  "$ARCHIVE_PATH" \
+  "$RELEASE_DIR/appcast.xml" \
+  --repo "$GITHUB_REPOSITORY" \
+  --target "$COMMIT_SHA" \
+  --title "Meetingnotes $VERSION" \
+  --generate-notes
+
+echo "Published Meetingnotes $VERSION"