ci: make notarization polling reliable

.github/workflows/release.yml

@@ -25,7 +25,7 @@ jobs:
       APPLE_APP_PASSWORD: ${{ secrets.APPLE_APP_PASSWORD }}
       SPARKLE_PRIVATE_KEY: ${{ secrets.SPARKLE_PRIVATE_KEY }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0
 
@@ -42,30 +42,22 @@ jobs:
           done
 
       - name: Import Developer ID certificate
-        env:
+        uses: apple-actions/import-codesign-certs@v7
-          APPLE_CERTIFICATE_P12: ${{ secrets.APPLE_CERTIFICATE_P12 }}
+        with:
-          APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
+          p12-file-base64: ${{ secrets.APPLE_CERTIFICATE_P12 }}
-          KEYCHAIN_PASSWORD: ${{ github.run_id }}-${{ github.run_attempt }}
+          p12-password: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
+
+      - name: Locate Developer ID identity
         run: |
-          certificate_path="$RUNNER_TEMP/developer-id.p12"
+          signing_identity=$(security find-identity -v -p codesigning | awk -F '"' '/Developer ID Application/{print $2; exit}')
-          keychain_path="$RUNNER_TEMP/release-signing.keychain-db"
-          echo -n "$APPLE_CERTIFICATE_P12" | base64 --decode > "$certificate_path"
-          security create-keychain -p "$KEYCHAIN_PASSWORD" "$keychain_path"
-          security set-keychain-settings -lut 21600 "$keychain_path"
-          security unlock-keychain -p "$KEYCHAIN_PASSWORD" "$keychain_path"
-          security import "$certificate_path" -P "$APPLE_CERTIFICATE_PASSWORD" -A -t cert -f pkcs12 -k "$keychain_path"
-          security list-keychain -d user -s "$keychain_path"
-          security default-keychain -d user -s "$keychain_path"
-          security set-key-partition-list -S apple-tool:,apple: -s -k "$KEYCHAIN_PASSWORD" "$keychain_path"
-          signing_identity=$(security find-identity -v -p codesigning "$keychain_path" | awk -F '"' '/Developer ID Application/{print $2; exit}')
           if [[ -z "$signing_identity" ]]; then
             echo "The .p12 does not contain a Developer ID Application identity" >&2
             exit 1
           fi
           echo "SIGNING_IDENTITY=$signing_identity" >> "$GITHUB_ENV"
-          echo "RELEASE_KEYCHAIN=$keychain_path" >> "$GITHUB_ENV"
 
       - name: Build, sign, notarize, and create appcast
+        timeout-minutes: 110
         run: scripts/package_release.sh
 
       - name: Create GitHub release
@@ -83,10 +75,3 @@ jobs:
             --target "$GITHUB_SHA" \
             --title "Meetingnotes $VERSION" \
             --generate-notes
-
-      - name: Remove signing keychain
-        if: always()
-        run: |
-          if [[ -n "${RELEASE_KEYCHAIN:-}" ]]; then
-            security delete-keychain "$RELEASE_KEYCHAIN" || true
-          fi

scripts/package_release.sh

@@ -86,7 +86,46 @@ xcrun notarytool submit "$PRE_NOTARY_ZIP" \
   --apple-id "$APPLE_ID" \
   --team-id "$APPLE_TEAM_ID" \
   --password "$APPLE_APP_PASSWORD" \
-  --wait
+  --output-format json > "$BUILD_ROOT/notary-submission.json"
+
+SUBMISSION_ID=$(plutil -extract id raw -o - "$BUILD_ROOT/notary-submission.json")
+echo "Notarization submitted: $SUBMISSION_ID"
+
+NOTARY_STATUS="In Progress"
+for attempt in {1..180}; do
+  xcrun notarytool info "$SUBMISSION_ID" \
+    --apple-id "$APPLE_ID" \
+    --team-id "$APPLE_TEAM_ID" \
+    --password "$APPLE_APP_PASSWORD" \
+    --output-format json > "$BUILD_ROOT/notary-status.json"
+  NOTARY_STATUS=$(plutil -extract status raw -o - "$BUILD_ROOT/notary-status.json")
+  echo "Notarization status ($attempt/180): $NOTARY_STATUS"
+
+  case "$NOTARY_STATUS" in
+    Accepted)
+      break
+      ;;
+    Invalid|Rejected)
+      xcrun notarytool log "$SUBMISSION_ID" \
+        --apple-id "$APPLE_ID" \
+        --team-id "$APPLE_TEAM_ID" \
+        --password "$APPLE_APP_PASSWORD" || true
+      exit 1
+      ;;
+    "In Progress")
+      sleep 30
+      ;;
+    *)
+      echo "Unexpected notarization status: $NOTARY_STATUS" >&2
+      exit 1
+      ;;
+  esac
+done
+
+if [[ "$NOTARY_STATUS" != "Accepted" ]]; then
+  echo "Notarization did not finish within 90 minutes: $SUBMISSION_ID" >&2
+  exit 1
+fi
 
 xcrun stapler staple "$APP_PATH"
 xcrun stapler validate "$APP_PATH"