ci(release): sign + notarize macOS binaries with quill #2
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Release | |
| on: | |
| push: | |
| tags: | |
| - "v*" | |
| permissions: | |
| contents: write | |
| jobs: | |
| goreleaser: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| with: | |
| fetch-depth: 0 | |
| - uses: actions/setup-go@v5 | |
| with: | |
| go-version: "1.26" | |
| cache: true | |
| # The S-101 Portrayal + Feature Catalogues are IHO material kept out of this | |
| # repo. Clone them (public, no auth) into a temp dir and sync into the | |
| # gitignored embed dir so GoReleaser builds self-contained (-tags embed_s101) | |
| # binaries. The IHO repos declare no license; see THIRD-PARTY-NOTICES.md. | |
| - name: Fetch IHO S-101 catalogues | |
| run: | | |
| git clone --depth 1 https://github.com/iho-ohi/S-101_Portrayal-Catalogue.git "$RUNNER_TEMP/s101-pc" | |
| git clone --depth 1 https://github.com/iho-ohi/S-101-Documentation-and-FC.git "$RUNNER_TEMP/s101-fc" | |
| make sync-s101 \ | |
| S101_PC="$RUNNER_TEMP/s101-pc/PortrayalCatalog" \ | |
| S101_FC="$RUNNER_TEMP/s101-fc/S-101FC/FeatureCatalogue.xml" | |
| # quill signs + notarizes the macOS binaries from this Linux runner (no Mac | |
| # needed). The GoReleaser build hook (scripts/quill-sign.sh) invokes it. | |
| - name: Install quill | |
| run: | | |
| go install github.com/anchore/quill/cmd/quill@latest | |
| echo "$(go env GOPATH)/bin" >> "$GITHUB_PATH" | |
| - name: Run GoReleaser | |
| uses: goreleaser/goreleaser-action@v6 | |
| with: | |
| distribution: goreleaser | |
| version: "~> v2" | |
| args: release --clean | |
| env: | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| # macOS signing/notarization (quill). Set these as repo secrets; if they | |
| # are absent the hook skips signing and the release still builds. | |
| QUILL_SIGN_P12: ${{ secrets.MACOS_SIGN_P12 }} | |
| QUILL_SIGN_PASSWORD: ${{ secrets.MACOS_SIGN_PASSWORD }} | |
| QUILL_NOTARY_KEY: ${{ secrets.MACOS_NOTARY_KEY }} | |
| QUILL_NOTARY_KEY_ID: ${{ secrets.MACOS_NOTARY_KEY_ID }} | |
| QUILL_NOTARY_ISSUER: ${{ secrets.MACOS_NOTARY_ISSUER }} |