forked from cycodehq/cycode-cli
-
Notifications
You must be signed in to change notification settings - Fork 0
107 lines (86 loc) · 3.53 KB
/
Copy pathbuild_executable.yml
File metadata and controls
107 lines (86 loc) · 3.53 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
name: Build executable version of CLI
on:
push:
branches:
- main
jobs:
build:
strategy:
fail-fast: false
matrix:
os: [ ubuntu-20.04, macos-11, windows-2019 ]
runs-on: ${{ matrix.os }}
defaults:
run:
shell: bash
steps:
- name: Run Cimon
if: matrix.os == 'ubuntu-20.04'
uses: cycodelabs/cimon-action@v0
with:
client-id: ${{ secrets.CIMON_CLIENT_ID }}
secret: ${{ secrets.CIMON_SECRET }}
prevent: true
allowed-hosts: >
files.pythonhosted.org
install.python-poetry.org
pypi.org
- name: Checkout repository
uses: actions/checkout@v3
with:
fetch-depth: 0
- name: Set up Python 3.7
uses: actions/setup-python@v4
with:
python-version: '3.7'
- name: Setup Poetry
uses: snok/install-poetry@v1
- name: Install dependencies
run: poetry install
- name: Build executable
run: poetry run pyinstaller pyinstaller.spec
- name: Test executable
run: ./dist/cycode --version
- name: Sign macOS executable
if: ${{ startsWith(matrix.os, 'macos') }}
env:
APPLE_CERT: ${{ secrets.APPLE_CERT }}
APPLE_CERT_PWD: ${{ secrets.APPLE_CERT_PWD }}
APPLE_CERT_NAME: ${{ secrets.APPLE_CERT_NAME }}
APPLE_KEYCHAIN_PASSWORD: ${{ secrets.APPLE_KEYCHAIN_PASSWORD }}
run: |
# import certificate
CERTIFICATE_PATH=$RUNNER_TEMP/build_certificate.p12
echo -n "$APPLE_CERT" | base64 --decode -o $CERTIFICATE_PATH
# create temporary keychain
KEYCHAIN_PATH=$RUNNER_TEMP/app-signing.keychain-db
security create-keychain -p "$APPLE_KEYCHAIN_PASSWORD" $KEYCHAIN_PATH
security set-keychain-settings -lut 21600 $KEYCHAIN_PATH
security unlock-keychain -p "$APPLE_KEYCHAIN_PASSWORD" $KEYCHAIN_PATH
# import certificate to keychain
security import $CERTIFICATE_PATH -P "$APPLE_CERT_PWD" -A -t cert -f pkcs12 -k $KEYCHAIN_PATH
security list-keychain -d user -s $KEYCHAIN_PATH
# sign executable
codesign --deep --force --options=runtime --entitlements entitlements.plist --sign "$APPLE_CERT_NAME" --timestamp dist/cycode
- name: Notarize macOS executable
if: ${{ startsWith(matrix.os, 'macos') }}
env:
APPLE_NOTARIZATION_EMAIL: ${{ secrets.APPLE_NOTARIZATION_EMAIL }}
APPLE_NOTARIZATION_PWD: ${{ secrets.APPLE_NOTARIZATION_PWD }}
APPLE_NOTARIZATION_TEAM_ID: ${{ secrets.APPLE_NOTARIZATION_TEAM_ID }}
run: |
# create keychain profile
xcrun notarytool store-credentials "notarytool-profile" --apple-id "$APPLE_NOTARIZATION_EMAIL" --team-id "$APPLE_NOTARIZATION_TEAM_ID" --password "$APPLE_NOTARIZATION_PWD"
# create zip file (notarization does not support binaries)
ditto -c -k --keepParent dist/cycode notarization.zip
# notarize app (this will take a while)
xcrun notarytool submit notarization.zip --keychain-profile "notarytool-profile" --wait
# we can't staple the app because it's executable. we should only staple app bundles like .dmg
# xcrun stapler staple dist/cycode
- name: Test signed executable
if: ${{ startsWith(matrix.os, 'macos') }}
run: ./dist/cycode --version
- uses: actions/upload-artifact@v3
with:
name: cycode-cli-${{ matrix.os }}
path: dist