ci: make notarization polling reliable

.github/workflows/release.yml

@@ -25,7 +25,7 @@ jobs:
       APPLE_APP_PASSWORD: ${{ secrets.APPLE_APP_PASSWORD }}
       SPARKLE_PRIVATE_KEY: ${{ secrets.SPARKLE_PRIVATE_KEY }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0
 
@@ -42,30 +42,22 @@ jobs:
           done
 
       - name: Import Developer ID certificate
-        env:
-          APPLE_CERTIFICATE_P12: ${{ secrets.APPLE_CERTIFICATE_P12 }}
-          APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
-          KEYCHAIN_PASSWORD: ${{ github.run_id }}-${{ github.run_attempt }}
+        uses: apple-actions/import-codesign-certs@v7
+        with:
+          p12-file-base64: ${{ secrets.APPLE_CERTIFICATE_P12 }}
+          p12-password: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
+
+      - name: Locate Developer ID identity
         run: |
-          certificate_path="$RUNNER_TEMP/developer-id.p12"
-          keychain_path="$RUNNER_TEMP/release-signing.keychain-db"
-          echo -n "$APPLE_CERTIFICATE_P12" | base64 --decode > "$certificate_path"
-          security create-keychain -p "$KEYCHAIN_PASSWORD" "$keychain_path"
-          security set-keychain-settings -lut 21600 "$keychain_path"
-          security unlock-keychain -p "$KEYCHAIN_PASSWORD" "$keychain_path"
-          security import "$certificate_path" -P "$APPLE_CERTIFICATE_PASSWORD" -A -t cert -f pkcs12 -k "$keychain_path"
-          security list-keychain -d user -s "$keychain_path"
-          security default-keychain -d user -s "$keychain_path"
-          security set-key-partition-list -S apple-tool:,apple: -s -k "$KEYCHAIN_PASSWORD" "$keychain_path"
-          signing_identity=$(security find-identity -v -p codesigning "$keychain_path" | awk -F '"' '/Developer ID Application/{print $2; exit}')
+          signing_identity=$(security find-identity -v -p codesigning | awk -F '"' '/Developer ID Application/{print $2; exit}')
           if [[ -z "$signing_identity" ]]; then
             echo "The .p12 does not contain a Developer ID Application identity" >&2
             exit 1
           fi
           echo "SIGNING_IDENTITY=$signing_identity" >> "$GITHUB_ENV"
-          echo "RELEASE_KEYCHAIN=$keychain_path" >> "$GITHUB_ENV"
 
       - name: Build, sign, notarize, and create appcast
+        timeout-minutes: 110
         run: scripts/package_release.sh
 
       - name: Create GitHub release
@@ -83,10 +75,3 @@ jobs:
             --target "$GITHUB_SHA" \
             --title "Meetingnotes $VERSION" \
             --generate-notes
-
-      - name: Remove signing keychain
-        if: always()
-        run: |
-          if [[ -n "${RELEASE_KEYCHAIN:-}" ]]; then
-            security delete-keychain "$RELEASE_KEYCHAIN" || true
-          fi