WIP

Signed-off-by: Joaquim Rocha <joaquim.rocha@microsoft.com>
headlamp-k8s · Feb 22, 2024 · ed89685 · ed89685
1 parent 3040555
commit ed89685
Show file tree

Hide file tree

Showing 2 changed files with 41 additions and 26 deletions.
diff --git a/.github/workflows/app-artifacts-mac.yml b/.github/workflows/app-artifacts-mac.yml
@@ -56,19 +56,19 @@ jobs:
     - name: CodeSign
       run: |
         cd ./app/dist/mac && codesign -s ${{ secrets.TEST_APPLE_TEAM_ID }} --deep --force --options runtime --entitlements ../../mac/entitlements.mac.plist ./Headlamp.app
-    - name: Zip Artifact
-      run: |
-        cd ./app/dist/mac/ && ditto -c -k --sequesterRsrc --keepParent Headlamp.app ./Headlamp.zip
+    # - name: Zip Artifact
+    #   run: |
+    #     cd ./app/dist/mac/ && ditto -c -k --sequesterRsrc --keepParent Headlamp.app ./Headlamp.zip
     - name: Upload artifact
       uses: actions/upload-artifact@v4
       with:
-        name: zipbuild
-        path: ./app/dist/mac/Headlamp.zip
+        name: dmg
+        path: ./app/dist/mac/Headlamp*.dmg
         if-no-files-found: error
         retention-days: 1
   notarize:
     runs-on: windows-latest
-    # needs: build-mac
+    needs: build-mac
     if: ${{ inputs.signBinaries }}
     steps:
     - uses: actions/checkout@v4
@@ -82,20 +82,20 @@ jobs:
         cache-dependency-path: |
           app/package-lock.json
           frontend/package-lock.json
-    - name: Download artifact
-      id: download-artifact
-      uses: dawidd6/action-download-artifact@v3
-      with:
-        # Optional, GitHub token, a Personal Access Token with `public_repo` scope if needed
-        # Required, if the artifact is from a different repo
-        # Required, if the repo is private a Personal Access Token with `repo` scope is needed or GitHub token in a job where the permissions `action` scope set to `read`
-        github_token: ${{secrets.GITHUB_TOKEN}}
-        run_id: 8008311826
-
     # - name: Download artifact
-    #   uses: actions/download-artifact@v2
+    #   id: download-artifact
+    #   uses: dawidd6/action-download-artifact@v3
     #   with:
-    #     name: zipbuild
+    #     # Optional, GitHub token, a Personal Access Token with `public_repo` scope if needed
+    #     # Required, if the artifact is from a different repo
+    #     # Required, if the repo is private a Personal Access Token with `repo` scope is needed or GitHub token in a job where the permissions `action` scope set to `read`
+    #     github_token: ${{secrets.GITHUB_TOKEN}}
+    #     run_id: 8008311826
+
+    - name: Download artifact
+      uses: actions/download-artifact@v2
+      with:
+        name: dmg
     - name: Fetch certificates
       if: ${{ inputs.signBinaries }}
       shell: pwsh
@@ -130,8 +130,8 @@ jobs:
           echo "Not signing binaries"
         }
         cd ./app/mac/scripts
-        ls ../../../zipbuild
-        node ./esrp-notarize.js SIGN ../../../zipbuild/Headlamp.zip
+        ls ../../../dmg
+        node ./esrp-notarize.js SIGN ../../../dmg/Headlamp*.dmg
     - name: Notarize App
       shell: pwsh
       run: |
@@ -145,12 +145,12 @@ jobs:
           echo "Not signing binaries"
         }
         cd ./app/mac/scripts
-        ls ../../../zipbuild
-        node ./esrp-notarize.js NOTARIZE ../../../zipbuild/Headlamp.zip
+        ls ../../../dmg
+        node ./esrp-notarize.js NOTARIZE ../../../dmg/Headlamp*.dmg
     - name: Upload Notarized
       uses: actions/upload-artifact@v4
       with:
         name: Win exes
-        path: ./zipbuild/Headlamp.zip
+        path: ./dmg/Headlamp*.dmg
         if-no-files-found: error
         retention-days: 2
diff --git a/app/mac/scripts/codeSign.js b/app/mac/scripts/codeSign.js
@@ -1,6 +1,21 @@
-// const { execSync } = require('child_process');
 require('dotenv').config();
+const { execSync } = require('child_process');
+const path = require('path');
 
-exports.default = async function notarizing(context) {
-  console.log('>>>>>>>>>>>>', context);
+exports.default = async function codeSign(config) {
+  const entitlementsPath = path.resolve(path.join(__dirname, '..', 'entitlements.mac.plist'));
+  execSync(
+    `codesign -s ${process.env.TEST_APPLE_TEAM_ID}} --deep --force --options runtime --entitlements ${entitlementsPath} ${config.app}`,
+    (error, stdout, stderr) => {
+      if (error) {
+        console.log(`Mac codesign error: ${error.message}`);
+        return;
+      }
+      if (stderr) {
+        console.log(`Mac codesign stderr: ${stderr}`);
+        return;
+      }
+      console.log(`Mac codesign stdout: ${stdout}`);
+    }
+  );
 };