Merge pull request wakatime#86 from wakatime/misc/verify-codesign

Verify codesign in github action
ezyostudio · Jun 8, 2023 · 2a6ca92 · 2a6ca92
2 parents a12076a + dbb7c66
commit 2a6ca92
Showing 1 changed file with 12 additions and 29 deletions.
diff --git a/.github/workflows/on_push.yml b/.github/workflows/on_push.yml
@@ -105,40 +105,23 @@ jobs:
           # The password used to import the PKCS12 file.
           p12-password: ${{ secrets.APPLE_DEVELOPER_CERTIFICATE_PASSWORD }}
       -
-        name: Codesign app bundle
-        run: /usr/bin/codesign --force -s "WakaTime" --options runtime build/Release/WakaTime.app -v
+        name: Codesign
+        run: |
+          /usr/bin/codesign --force -s "WakaTime" --options runtime build/Release/WakaTime.app -v
+          /usr/bin/codesign --verify --deep --strict --verbose=2 build/Release/WakaTime.app
       -
-        name: Notarize app bundle
+        name: Store Credentials
         env:
-          NOTARIZATION_APPLE_ID: ${{ secrets.AC_USERNAME }}
           NOTARIZATION_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
+          NOTARIZATION_APPLE_ID: ${{ secrets.AC_USERNAME }}
           NOTARIZATION_PWD: ${{ secrets.AC_PASSWORD }}
+        run: xcrun notarytool store-credentials "notarytool-profile" --apple-id "$NOTARIZATION_APPLE_ID" --team-id "$NOTARIZATION_TEAM_ID" --password "$NOTARIZATION_PWD"
+      -
+        name: Notarize
         run: |
-          # Store the notarization credentials so that we can prevent a UI password dialog
-          # from blocking the CI
-
-          echo "Create keychain profile"
-          xcrun notarytool store-credentials "notarytool-profile" --apple-id "$NOTARIZATION_APPLE_ID" --team-id "$NOTARIZATION_TEAM_ID" --password "$NOTARIZATION_PWD"
-
-          # We can't notarize an app bundle directly, but we need to compress it as an archive.
-          # Therefore, we create a zip file containing our app bundle, so that we can send it to the
-          # notarization service
-
-          echo "Creating temp notarization archive"
-          ditto -c -k --keepParent "build/Release/WakaTime.app" "notarization.zip"
-
-          # Here we send the notarization request to the Apple's Notarization service, waiting for the result.
-          # This typically takes a few seconds inside a CI environment, but it might take more depending on the App
-          # characteristics. Visit the Notarization docs for more information and strategies on how to optimize it if
-          # you're curious
-
-          echo "Notarize app"
-          xcrun notarytool submit "notarization.zip" --keychain-profile "notarytool-profile" --wait
-
-          # Finally, we need to "attach the staple" to our executable, which will allow our app to be
-          # validated by macOS even when an internet connection is not available.
-          echo "Attach staple"
-          xcrun stapler staple "build/Release/WakaTime.app"
+          ditto -c -k --keepParent build/Release/WakaTime.app main.zip
+          xcrun notarytool submit main.zip --keychain-profile "notarytool-profile" --wait
+          xcrun stapler staple build/Release/WakaTime.app
       -
         name: Zip
         run: ditto -c -k --sequesterRsrc --keepParent build/Release/WakaTime.app WakaTime.zip