New mac sign tool (#219)

* Update checkout * Fix signing tool * Fix build * Enable PR and tags build, disable any branch * Disable PR trigger
flipperdevices · Jun 10, 2024 · 528eef4 · 528eef4
1 parent 51196a2
commit 528eef4
Show file tree

Hide file tree

Showing 2 changed files with 19 additions and 24 deletions.
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
@@ -1,6 +1,7 @@
 name: 'CI'
 
-on: push
+on:
+  push:
 
 jobs:
   build_linux:
@@ -10,9 +11,8 @@ jobs:
         run: find ./ -mount -maxdepth 1 -exec rm -rf {} \;
 
       - name: Checkout code
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
         with:
-          fetch-depth: 0
           submodules: true
 
       - name: Set up Docker Buildx
@@ -32,7 +32,7 @@ jobs:
         run: docker run --rm --privileged -v $(pwd):/project qflipper-build:latest /project/build_linux.sh
 
       - name: Publish application
-        uses: actions/upload-artifact@v3
+        uses: actions/upload-artifact@v4
         with:
           name: qFlipper-x86_64.AppImage
           path: |
@@ -46,22 +46,20 @@ jobs:
       MAC_OS_KEYCHAIN_NAME: ${{ secrets.MAC_OS_KEYCHAIN_NAME }}
       MAC_OS_KEYCHAIN_PASSWORD: ${{ secrets.MAC_OS_KEYCHAIN_PASSWORD }}
       MAC_OS_SIGNING_KEY_ID: ${{ secrets.MAC_OS_SIGNING_KEY_ID }}
-      MAC_OS_SIGNING_BUNDLE_ID: ${{ secrets.MAC_OS_SIGNING_BUNDLE_ID }}
-      MAC_OS_SIGNING_ASC_PROVIDER: ${{ secrets.MAC_OS_SIGNING_ASC_PROVIDER }}
+      MAC_OS_SIGNING_TEAM_ID: ${{ secrets.MAC_OS_SIGNING_TEAM_ID }}
       MAC_OS_SIGNING_USERNAME: ${{ secrets.MAC_OS_SIGNING_USERNAME }}
       MAC_OS_SIGNING_PASSWORD: ${{ secrets.MAC_OS_SIGNING_PASSWORD }}
     steps:
       - name: Checkout code
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
         with:
-          fetch-depth: 0
           submodules: true
 
       - name: Build application
         run: ./build_mac.sh
 
       - name: Publish application
-        uses: actions/upload-artifact@v3
+        uses: actions/upload-artifact@v4
         with:
           name: qflipper.dmg
           path: |
@@ -75,16 +73,15 @@ jobs:
         SIGNING_TOOL: ${{ secrets.WIN_SIGNING_TOOL }}
     steps:
       - name: Checkout code
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
         with:
-          fetch-depth: 0
           submodules: true
 
       - name: Build application
         run: .\build_windows.bat
 
       - name: Publish application
-        uses: actions/upload-artifact@v3
+        uses: actions/upload-artifact@v4
         with:
           name: qFlipperSetup-64bit.exe
           path: |
@@ -100,9 +97,7 @@ jobs:
     steps:
 
       - name: Checkout code
-        uses: actions/checkout@v2
-        with:
-          fetch-depth: 0
+        uses: actions/checkout@v4
 
       - name: 'Make artifacts directory'
         run: |
@@ -121,13 +116,13 @@ jobs:
           echo "REF=$(git rev-parse --abbrev-ref HEAD)" >> $GITHUB_ENV
           echo "SUFFIX=$(git rev-parse --abbrev-ref HEAD | sed 's/\//_/g')-$(date +'%d%m%Y')-$(git rev-parse --short HEAD)" >> $GITHUB_ENV
 
-      - uses: actions/download-artifact@v2
+      - uses: actions/download-artifact@v4
         with:
           name: qFlipper-x86_64.AppImage
-      - uses: actions/download-artifact@v2
+      - uses: actions/download-artifact@v4
         with:
           name: qFlipperSetup-64bit.exe
-      - uses: actions/download-artifact@v2
+      - uses: actions/download-artifact@v4
         with:
           name: qflipper.dmg
 

diff --git a/build_mac.sh b/build_mac.sh
@@ -94,13 +94,13 @@ if [ -n "${MAC_OS_SIGNING_KEY_ID:-""}" ]; then
     xattr -cr "$PROJECT.app";
     codesign --force --options=runtime -s "$MAC_OS_SIGNING_KEY_ID" --deep -v "$PROJECT.app";
     /usr/bin/ditto -c -k --keepParent "$PROJECT.app" "$PROJECT.zip";
-    xcrun altool \
-        --notarize-app \
-        --primary-bundle-id "$MAC_OS_SIGNING_BUNDLE_ID" \
-        --username "$MAC_OS_SIGNING_USERNAME" \
+    xcrun notarytool \
+        submit \
+        --apple-id "$MAC_OS_SIGNING_USERNAME" \
+        --team-id "$MAC_OS_SIGNING_TEAM_ID" \
         --password "$MAC_OS_SIGNING_PASSWORD" \
-        --asc-provider "$MAC_OS_SIGNING_ASC_PROVIDER" \
-        --file "$PROJECT.zip";
+        --wait \
+        "$PROJECT.zip";
 fi
 
 # build DMG