coder/meetingnotes
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 34 Wiki Activity

ci: make notarization polling reliable

Browse Source
This commit is contained in:
james
2026-07-15 16:09:43 +02:00
parent 37e21bf398
commit f43320aa0e
2 changed files with 49 additions and 25 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.github/workflows/release.yml
+9 -24
View File
@@ -25,7 +25,7 @@ jobs:
APPLE_APP_PASSWORD: ${{ secrets.APPLE_APP_PASSWORD }}
SPARKLE_PRIVATE_KEY: ${{ secrets.SPARKLE_PRIVATE_KEY }}
steps:
- uses: actions/checkout@v4
- uses: actions/checkout@v7
with:
fetch-depth: 0
@@ -42,30 +42,22 @@ jobs:
done
- name: Import Developer ID certificate
env:
APPLE_CERTIFICATE_P12: ${{ secrets.APPLE_CERTIFICATE_P12 }}
APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
KEYCHAIN_PASSWORD: ${{ github.run_id }}-${{ github.run_attempt }}
uses: apple-actions/import-codesign-certs@v7
with:
p12-file-base64: ${{ secrets.APPLE_CERTIFICATE_P12 }}
p12-password: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
- name: Locate Developer ID identity
run: |
certificate_path="$RUNNER_TEMP/developer-id.p12"
keychain_path="$RUNNER_TEMP/release-signing.keychain-db"
echo -n "$APPLE_CERTIFICATE_P12" | base64 --decode > "$certificate_path"
security create-keychain -p "$KEYCHAIN_PASSWORD" "$keychain_path"
security set-keychain-settings -lut 21600 "$keychain_path"
security unlock-keychain -p "$KEYCHAIN_PASSWORD" "$keychain_path"
security import "$certificate_path" -P "$APPLE_CERTIFICATE_PASSWORD" -A -t cert -f pkcs12 -k "$keychain_path"
security list-keychain -d user -s "$keychain_path"
security default-keychain -d user -s "$keychain_path"
security set-key-partition-list -S apple-tool:,apple: -s -k "$KEYCHAIN_PASSWORD" "$keychain_path"
signing_identity=$(security find-identity -v -p codesigning "$keychain_path" | awk -F '"' '/Developer ID Application/{print $2; exit}')
signing_identity=$(security find-identity -v -p codesigning | awk -F '"' '/Developer ID Application/{print $2; exit}')
if [[ -z "$signing_identity" ]]; then
echo "The .p12 does not contain a Developer ID Application identity" >&2
exit 1
fi
echo "SIGNING_IDENTITY=$signing_identity" >> "$GITHUB_ENV"
echo "RELEASE_KEYCHAIN=$keychain_path" >> "$GITHUB_ENV"
- name: Build, sign, notarize, and create appcast
timeout-minutes: 110
run: scripts/package_release.sh
- name: Create GitHub release
@@ -83,10 +75,3 @@ jobs:
--target "$GITHUB_SHA" \
--title "Meetingnotes $VERSION" \
--generate-notes
- name: Remove signing keychain
if: always()
run: |
if [[ -n "${RELEASE_KEYCHAIN:-}" ]]; then
security delete-keychain "$RELEASE_KEYCHAIN" || true
fi
scripts/package_release.sh
+40 -1
View File
@@ -86,7 +86,46 @@ xcrun notarytool submit "$PRE_NOTARY_ZIP" \
--apple-id "$APPLE_ID" \
--team-id "$APPLE_TEAM_ID" \
--password "$APPLE_APP_PASSWORD" \
--wait
--output-format json > "$BUILD_ROOT/notary-submission.json"
SUBMISSION_ID=$(plutil -extract id raw -o - "$BUILD_ROOT/notary-submission.json")
echo "Notarization submitted: $SUBMISSION_ID"
NOTARY_STATUS="In Progress"
for attempt in {1..180}; do
xcrun notarytool info "$SUBMISSION_ID" \
--apple-id "$APPLE_ID" \
--team-id "$APPLE_TEAM_ID" \
--password "$APPLE_APP_PASSWORD" \
--output-format json > "$BUILD_ROOT/notary-status.json"
NOTARY_STATUS=$(plutil -extract status raw -o - "$BUILD_ROOT/notary-status.json")
echo "Notarization status ($attempt/180): $NOTARY_STATUS"
case "$NOTARY_STATUS" in
Accepted)
break
;;
Invalid|Rejected)
xcrun notarytool log "$SUBMISSION_ID" \
--apple-id "$APPLE_ID" \
--team-id "$APPLE_TEAM_ID" \
--password "$APPLE_APP_PASSWORD" || true
exit 1
;;
"In Progress")
sleep 30
;;
*)
echo "Unexpected notarization status: $NOTARY_STATUS" >&2
exit 1
;;
esac
done
if [[ "$NOTARY_STATUS" != "Accepted" ]]; then
echo "Notarization did not finish within 90 minutes: $SUBMISSION_ID" >&2
exit 1
fi
xcrun stapler staple "$APP_PATH"
xcrun stapler validate "$APP_PATH"