| 1 | name: Verify macOS signing |
| 2 | |
| 3 | # Validate the current protected commit before creating a release tag. This |
| 4 | # workflow only builds, notarizes, and retains diagnostics; it cannot publish. |
| 5 | on: workflow_dispatch |
| 6 | |
| 7 | permissions: |
| 8 | contents: read |
| 9 | |
| 10 | jobs: |
| 11 | verify: |
| 12 | if: github.repository == 'esengine/DeepSeek-Reasonix' && github.ref == 'refs/heads/main-v2' && github.ref_protected |
| 13 | runs-on: macos-14 |
| 14 | environment: release |
| 15 | timeout-minutes: 35 |
| 16 | steps: |
| 17 | - uses: actions/checkout@v7 |
| 18 | with: |
| 19 | ref: ${{ github.sha }} |
| 20 | persist-credentials: false |
| 21 | - uses: actions/setup-go@v7 |
| 22 | with: |
| 23 | go-version-file: desktop/go.mod |
| 24 | cache: true |
| 25 | cache-dependency-path: desktop/go.sum |
| 26 | - uses: pnpm/action-setup@v6.1.0 |
| 27 | with: |
| 28 | version: 10 |
| 29 | run_install: false |
| 30 | - uses: actions/setup-node@v7 |
| 31 | with: |
| 32 | node-version: "24" |
| 33 | cache: pnpm |
| 34 | cache-dependency-path: desktop/pnpm-lock.yaml |
| 35 | - name: Install create-dmg |
| 36 | run: brew install create-dmg |
| 37 | - name: Build and notarize the universal app and DMG |
| 38 | env: |
| 39 | APPLE_CERT_P12: ${{ secrets.APPLE_CERT_P12 }} |
| 40 | APPLE_CERT_PASSWORD: ${{ secrets.APPLE_CERT_PASSWORD }} |
| 41 | APPLE_API_KEY_P8: ${{ secrets.APPLE_API_KEY_P8 }} |
| 42 | APPLE_API_KEY_PATH: ${{ runner.temp }}/notary.p8 |
| 43 | APPLE_API_KEY_ID: ${{ secrets.APPLE_API_KEY_ID }} |
| 44 | APPLE_API_ISSUER_ID: ${{ secrets.APPLE_API_ISSUER_ID }} |
| 45 | APPLE_NOTARIZATION_LOG_DIR: ${{ runner.temp }}/apple-notarization |
| 46 | HAS_APPLE_CERT: "true" |
| 47 | shell: bash |
| 48 | run: | |
| 49 | set -euo pipefail |
| 50 | : "${APPLE_CERT_P12:?Apple certificate is required}" |
| 51 | : "${APPLE_CERT_PASSWORD:?Apple certificate password is required}" |
| 52 | : "${APPLE_API_KEY_P8:?Apple notarization key is required}" |
| 53 | : "${APPLE_API_KEY_ID:?Apple key ID is required}" |
| 54 | : "${APPLE_API_ISSUER_ID:?Apple issuer is required}" |
| 55 | umask 077 |
| 56 | KEYCHAIN="$RUNNER_TEMP/signing-check.keychain-db" |
| 57 | KEYCHAIN_PASS="$(uuidgen)" |
| 58 | trap 'security delete-keychain "$KEYCHAIN" >/dev/null 2>&1 || true; rm -f "$RUNNER_TEMP/cert.p12" "$APPLE_API_KEY_PATH"' EXIT |
| 59 | security create-keychain -p "$KEYCHAIN_PASS" "$KEYCHAIN" |
| 60 | security set-keychain-settings -lut 21600 "$KEYCHAIN" |
| 61 | security unlock-keychain -p "$KEYCHAIN_PASS" "$KEYCHAIN" |
| 62 | printf '%s' "$APPLE_CERT_P12" | base64 --decode > "$RUNNER_TEMP/cert.p12" |
| 63 | security import "$RUNNER_TEMP/cert.p12" -k "$KEYCHAIN" -P "$APPLE_CERT_PASSWORD" -T /usr/bin/codesign |
| 64 | security set-key-partition-list -S apple-tool:,apple:,codesign: -s -k "$KEYCHAIN_PASS" "$KEYCHAIN" >/dev/null |
| 65 | existing_keychains=() |
| 66 | while IFS= read -r keychain; do |
| 67 | [ -n "$keychain" ] && existing_keychains+=("$keychain") |
| 68 | done < <(security list-keychains -d user | sed -E 's/^[[:space:]]*"//; s/"[[:space:]]*$//') |
| 69 | security list-keychains -d user -s "$KEYCHAIN" "${existing_keychains[@]}" |
| 70 | printf '%s' "$APPLE_API_KEY_P8" | base64 --decode > "$APPLE_API_KEY_PATH" |
| 71 | scripts/desktop-build.sh darwin/universal v0.0.0-signing-check stable |
| 72 | node desktop/packaging/verify.mjs desktop/build/candidate/darwin-universal/Reasonix.app --kind darwin-app-dir |
| 73 | codesign --verify --deep --strict desktop/build/candidate/darwin-universal/Reasonix.app |
| 74 | test -s dist/Reasonix-darwin-universal.dmg |
| 75 | - name: Upload Apple notarization diagnostics |
| 76 | if: always() |
| 77 | uses: actions/upload-artifact@v7 |
| 78 | with: |
| 79 | name: apple-signing-check-${{ github.run_id }}-${{ github.run_attempt }} |
| 80 | path: ${{ runner.temp }}/apple-notarization/*.json |
| 81 | if-no-files-found: ignore |
| 82 | retention-days: 7 |
| 83 |