| 1 | name: Diagnose Apple notarization |
| 2 | run-name: Diagnose Apple notarization ${{ inputs.submission_id }} |
| 3 | |
| 4 | on: |
| 5 | workflow_dispatch: |
| 6 | inputs: |
| 7 | submission_id: |
| 8 | description: "Existing Apple notarization submission UUID (read only)" |
| 9 | required: true |
| 10 | type: string |
| 11 | |
| 12 | permissions: |
| 13 | contents: read |
| 14 | |
| 15 | jobs: |
| 16 | fetch-log: |
| 17 | if: github.repository == 'esengine/DeepSeek-Reasonix' && github.ref == 'refs/heads/main-v2' && github.ref_protected |
| 18 | runs-on: macos-latest |
| 19 | environment: release |
| 20 | timeout-minutes: 10 |
| 21 | steps: |
| 22 | - name: Retrieve existing submission information and log |
| 23 | env: |
| 24 | SUBMISSION_ID: ${{ inputs.submission_id }} |
| 25 | APPLE_API_KEY_P8: ${{ secrets.APPLE_API_KEY_P8 }} |
| 26 | APPLE_API_KEY_ID: ${{ secrets.APPLE_API_KEY_ID }} |
| 27 | APPLE_API_ISSUER_ID: ${{ secrets.APPLE_API_ISSUER_ID }} |
| 28 | shell: bash |
| 29 | run: | |
| 30 | set -euo pipefail |
| 31 | [[ "$SUBMISSION_ID" =~ ^[0-9a-fA-F]{8}(-[0-9a-fA-F]{4}){3}-[0-9a-fA-F]{12}$ ]] || { |
| 32 | echo "::error::submission_id must be a UUID" |
| 33 | exit 1 |
| 34 | } |
| 35 | : "${APPLE_API_KEY_P8:?Apple API key is not configured}" |
| 36 | : "${APPLE_API_KEY_ID:?Apple API key ID is not configured}" |
| 37 | : "${APPLE_API_ISSUER_ID:?Apple API issuer is not configured}" |
| 38 | umask 077 |
| 39 | key_path="$(mktemp "$RUNNER_TEMP/apple-notary-key.XXXXXX")" |
| 40 | trap 'rm -f "$key_path"' EXIT |
| 41 | printf '%s' "$APPLE_API_KEY_P8" | base64 --decode > "$key_path" |
| 42 | diagnostics="$RUNNER_TEMP/apple-notarization" |
| 43 | mkdir -p "$diagnostics" |
| 44 | auth=(--key "$key_path" --key-id "$APPLE_API_KEY_ID" --issuer "$APPLE_API_ISSUER_ID") |
| 45 | xcrun notarytool info "$SUBMISSION_ID" "${auth[@]}" --output-format json > "$diagnostics/submission.json" || { |
| 46 | echo "::warning::Could not retrieve submission information; attempting the log directly" |
| 47 | } |
| 48 | xcrun notarytool log "$SUBMISSION_ID" "${auth[@]}" "$diagnostics/notary-log.json" |
| 49 | |
| 50 | - name: Upload Apple notarization diagnostics |
| 51 | if: always() |
| 52 | uses: actions/upload-artifact@v7 |
| 53 | with: |
| 54 | name: apple-notary-log-${{ github.run_id }}-${{ github.run_attempt }} |
| 55 | path: ${{ runner.temp }}/apple-notarization/*.json |
| 56 | if-no-files-found: ignore |
| 57 | retention-days: 7 |
| 58 |