feat: Sign and notarize MacOS binaries

- Build .pacman binaries for Arch based systems
- Upgrade electron-builder

.erb/scripts/download-swap-binaries.ts

@@ -62,7 +62,7 @@ Promise.all(
       fileName: binary.filename,
     });
 
-    console.log(`Downloaded and extracted ${binary.url} to ${binary.dest} as ${binary.fileName}`);
+    console.log(`Downloaded and extracted ${binary.url} to ${binary.dest} as ${binary.filename}`);
   }),
 )
   .then(() => {

.erb/scripts/notarize.js

@@ -1,4 +1,4 @@
-const { notarize } = require('electron-notarize');
+const { notarize } = require('@electron/notarize');
 const { build } = require('../../package.json');
 
 exports.default = async function notarizeMacos(context) {
@@ -12,9 +12,11 @@ exports.default = async function notarizeMacos(context) {
     return;
   }
 
-  if (!('APPLE_ID' in process.env && 'APPLE_ID_PASS' in process.env)) {
+  if (
+    !('APPLE_ID' in process.env && 'APPLE_APP_SPECIFIC_PASSWORD' in process.env)
+  ) {
     console.warn(
-      'Skipping notarizing step. APPLE_ID and APPLE_ID_PASS env variables must be set',
+      'Skipping notarizing step. APPLE_ID and APPLE_APP_SPECIFIC_PASSWORD env variables must be set',
     );
     return;
   }
@@ -25,6 +27,6 @@ exports.default = async function notarizeMacos(context) {
     appBundleId: build.appId,
     appPath: `${appOutDir}/${appName}.app`,
     appleId: process.env.APPLE_ID,
-    appleIdPassword: process.env.APPLE_ID_PASS,
+    appleIdPassword: process.env.APPLE_APP_SPECIFIC_PASSWORD,
   });
-};
+};

.github/workflows/publish.yml

@@ -8,10 +8,10 @@ on:
 jobs:
   publish:
     runs-on: ${{ matrix.os }}
-
+    environment: production-notarize-environment
     strategy:
       matrix:
-        os: [macos-11]
+        os: [macos-12]
 
     steps:
       - name: Checkout git repo
@@ -38,10 +38,11 @@ jobs:
       - name: Publish releases
         env:
           # These values are used for auto updates signing
-          # APPLE_ID: ${{ secrets.APPLE_ID }}
-          # APPLE_ID_PASS: ${{ secrets.APPLE_ID_PASS }}
-          # CSC_LINK: ${{ secrets.CSC_LINK }}
-          # CSC_KEY_PASSWORD: ${{ secrets.CSC_KEY_PASSWORD }}
+          APPLE_ID: ${{ secrets.APPLE_ID }}
+          APPLE_ID_PASS: ${{ secrets.APPLE_ID_PASS }}
+          APPLE_APP_SPECIFIC_PASSWORD: ${{ secrets.APPLE_APP_SPECIFIC_PASSWORD }}
+          CSC_LINK: ${{ secrets.CSC_LINK }}
+          CSC_KEY_PASSWORD: ${{ secrets.CSC_KEY_PASSWORD }}
 
           # This is used for uploading release assets to github
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}