Prepare signed release workflow

Author: driade

.github/workflows/build.yml

@@ -15,6 +15,10 @@ permissions:
 jobs:
   build:
     runs-on: macos-latest
+    env:
+      APP_NAME: ContextEditor.app
+      APP_PATH: build-universal/output/ContextEditor.app
+      ZIP_PATH: ContextEditor-macOS.zip
 
     steps:
       - name: Checkout
@@ -26,20 +30,78 @@ jobs:
       - name: Generate Xcode project
         run: xcodegen generate
 
+      - name: Import signing certificate
+        if: startsWith(github.ref, 'refs/tags/v')
+        env:
+          BUILD_CERTIFICATE_BASE64: ${{ secrets.BUILD_CERTIFICATE_BASE64 }}
+          P12_PASSWORD: ${{ secrets.P12_PASSWORD }}
+          KEYCHAIN_PASSWORD: ${{ secrets.KEYCHAIN_PASSWORD }}
+        run: |
+          CERT_PATH="$RUNNER_TEMP/build_certificate.p12"
+          KEYCHAIN_PATH="$RUNNER_TEMP/contexteditor-build.keychain-db"
+
+          echo "$BUILD_CERTIFICATE_BASE64" | base64 -D > "$CERT_PATH"
+
+          security create-keychain -p "$KEYCHAIN_PASSWORD" "$KEYCHAIN_PATH"
+          security set-keychain-settings -lut 21600 "$KEYCHAIN_PATH"
+          security unlock-keychain -p "$KEYCHAIN_PASSWORD" "$KEYCHAIN_PATH"
+          security import "$CERT_PATH" -P "$P12_PASSWORD" -A -t cert -f pkcs12 -k "$KEYCHAIN_PATH"
+          security list-keychains -d user -s "$KEYCHAIN_PATH" login.keychain-db
+          security set-key-partition-list -S apple-tool:,apple: -s -k "$KEYCHAIN_PASSWORD" "$KEYCHAIN_PATH"
+
       - name: Build app
+        env:
+          SIGNING_IDENTITY: ${{ startsWith(github.ref, 'refs/tags/v') && 'Developer ID Application' || '' }}
         run: ./scripts/build_universal.sh
 
+      - name: Verify signature
+        if: startsWith(github.ref, 'refs/tags/v')
+        run: codesign -dv --verbose=4 "${APP_PATH}"
+
+      - name: Store notarization credentials
+        if: startsWith(github.ref, 'refs/tags/v')
+        env:
+          APPLE_ID: ${{ secrets.APPLE_ID }}
+          APPLE_APP_SPECIFIC_PASSWORD: ${{ secrets.APPLE_APP_SPECIFIC_PASSWORD }}
+          APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
+          KEYCHAIN_PATH: ${{ runner.temp }}/contexteditor-build.keychain-db
+        run: |
+          xcrun notarytool store-credentials "ContextEditorNotary" \
+            --apple-id "$APPLE_ID" \
+            --password "$APPLE_APP_SPECIFIC_PASSWORD" \
+            --team-id "$APPLE_TEAM_ID" \
+            --keychain "$KEYCHAIN_PATH"
+
+      - name: Notarize app
+        if: startsWith(github.ref, 'refs/tags/v')
+        env:
+          KEYCHAIN_PATH: ${{ runner.temp }}/contexteditor-build.keychain-db
+        run: |
+          ditto -c -k --sequesterRsrc --keepParent "${APP_PATH}" "${ZIP_PATH}"
+          xcrun notarytool submit "${ZIP_PATH}" \
+            --keychain-profile "ContextEditorNotary" \
+            --keychain "$KEYCHAIN_PATH" \
+            --wait
+          xcrun stapler staple "${APP_PATH}"
+          xcrun stapler validate "${APP_PATH}"
+          spctl -a -vv "${APP_PATH}"
+
       - name: Package app
-        run: ditto -c -k --sequesterRsrc --keepParent build-universal/output/ContextEditor.app ContextEditor-macOS.zip
+        if: ${{ !startsWith(github.ref, 'refs/tags/v') }}
+        run: ditto -c -k --sequesterRsrc --keepParent "${APP_PATH}" "${ZIP_PATH}"
+
+      - name: Package notarized app
+        if: startsWith(github.ref, 'refs/tags/v')
+        run: ditto -c -k --sequesterRsrc --keepParent "${APP_PATH}" "${ZIP_PATH}"
 
       - name: Upload artifact
         uses: actions/upload-artifact@v4
         with:
           name: ContextEditor-macOS
-          path: ContextEditor-macOS.zip
+          path: ${{ env.ZIP_PATH }}
 
       - name: Publish release asset
         if: startsWith(github.ref, 'refs/tags/v')
         uses: softprops/action-gh-release@v2
         with:
-          files: ContextEditor-macOS.zip
+          files: ${{ env.ZIP_PATH }}

.gitignore

@@ -10,3 +10,4 @@ DerivedData/
 *.xcodeproj/xcuserdata/
 *.xcscmblueprint
 .contexteditor
+build-signed

ContextEditor.xcodeproj/project.pbxproj

@@ -119,9 +119,6 @@
 				BuildIndependentTargetsInParallel = YES;
 				LastUpgradeCheck = 1430;
 				TargetAttributes = {
-					2AC92662DE49FD4E1E56E454 = {
-						ProvisioningStyle = Automatic;
-					};
 				};
 			};
 			buildConfigurationList = 4FB13F630C155A66BF2DD8B8 /* Build configuration list for PBXProject "ContextEditor" */;
@@ -292,15 +289,15 @@
 				ASSETCATALOG_COMPILER_APPICON_NAME = AppIcon;
 				CODE_SIGN_STYLE = Automatic;
 				COMBINE_HIDPI_IMAGES = YES;
-				CURRENT_PROJECT_VERSION = 1;
+				CURRENT_PROJECT_VERSION = 2;
 				ENABLE_HARDENED_RUNTIME = YES;
 				INFOPLIST_FILE = ContextEditor/Info.plist;
 				INFOPLIST_KEY_LSApplicationCategoryType = "public.app-category.developer-tools";
 				LD_RUNPATH_SEARCH_PATHS = (
 					"$(inherited)",
 					"@executable_path/../Frameworks",
 				);
-				MARKETING_VERSION = 1.0;
+				MARKETING_VERSION = 0.1.1;
 				PRODUCT_BUNDLE_IDENTIFIER = com.driade.contexteditor;
 				SDKROOT = macosx;
 				SUPPORTS_MACCATALYST = NO;
@@ -311,17 +308,20 @@
 			isa = XCBuildConfiguration;
 			buildSettings = {
 				ASSETCATALOG_COMPILER_APPICON_NAME = AppIcon;
-				CODE_SIGN_STYLE = Automatic;
+				CODE_SIGN_IDENTITY = "Developer ID Application";
+				CODE_SIGN_INJECT_BASE_ENTITLEMENTS = NO;
+				CODE_SIGN_STYLE = Manual;
 				COMBINE_HIDPI_IMAGES = YES;
-				CURRENT_PROJECT_VERSION = 1;
+				CURRENT_PROJECT_VERSION = 2;
+				DEVELOPMENT_TEAM = KYNN4JTWJN;
 				ENABLE_HARDENED_RUNTIME = YES;
 				INFOPLIST_FILE = ContextEditor/Info.plist;
 				INFOPLIST_KEY_LSApplicationCategoryType = "public.app-category.developer-tools";
 				LD_RUNPATH_SEARCH_PATHS = (
 					"$(inherited)",
 					"@executable_path/../Frameworks",
 				);
-				MARKETING_VERSION = 1.0;
+				MARKETING_VERSION = 0.1.1;
 				PRODUCT_BUNDLE_IDENTIFIER = com.driade.contexteditor;
 				SDKROOT = macosx;
 				SUPPORTS_MACCATALYST = NO;

project.yml

@@ -19,12 +19,19 @@ targets:
         PRODUCT_BUNDLE_IDENTIFIER: com.driade.contexteditor
         INFOPLIST_FILE: ContextEditor/Info.plist
         ASSETCATALOG_COMPILER_APPICON_NAME: AppIcon
-        CODE_SIGN_STYLE: Automatic
         CURRENT_PROJECT_VERSION: 2
         MARKETING_VERSION: 0.1.1
         ENABLE_HARDENED_RUNTIME: YES
         INFOPLIST_KEY_LSApplicationCategoryType: public.app-category.developer-tools
         SUPPORTS_MACCATALYST: NO
+      configs:
+        Debug:
+          CODE_SIGN_STYLE: Automatic
+        Release:
+          CODE_SIGN_STYLE: Manual
+          CODE_SIGN_IDENTITY: Developer ID Application
+          CODE_SIGN_INJECT_BASE_ENTITLEMENTS: NO
+          DEVELOPMENT_TEAM: KYNN4JTWJN
   ContextEditorTests:
     type: bundle.unit-test
     platform: macOS

scripts/build_universal.sh

@@ -13,6 +13,12 @@ X86_PRODUCTS="$BUILD_DIR/products-x86_64"
 ARM64_APP="$ARM64_PRODUCTS/$APP_NAME"
 X86_APP="$X86_PRODUCTS/$APP_NAME"
 UNIVERSAL_APP="$OUTPUT_DIR/$APP_NAME"
+SIGNING_IDENTITY="${SIGNING_IDENTITY:-}"
+XCODEBUILD_SIGNING_ARGS=()
+
+if [[ -z "$SIGNING_IDENTITY" ]]; then
+  XCODEBUILD_SIGNING_ARGS=(CODE_SIGNING_ALLOWED=NO)
+fi
 
 rm -rf "$OUTPUT_DIR"
 mkdir -p "$OUTPUT_DIR"
@@ -24,6 +30,7 @@ xcodebuild \
   -derivedDataPath "$ARM64_DERIVED" \
   -destination "platform=macOS,arch=arm64" \
   CONFIGURATION_BUILD_DIR="$ARM64_PRODUCTS" \
+  "${XCODEBUILD_SIGNING_ARGS[@]}" \
   build
 
 xcodebuild \
@@ -33,6 +40,7 @@ xcodebuild \
   -derivedDataPath "$X86_DERIVED" \
   -destination "platform=macOS,arch=x86_64" \
   CONFIGURATION_BUILD_DIR="$X86_PRODUCTS" \
+  "${XCODEBUILD_SIGNING_ARGS[@]}" \
   build
 
 ditto "$ARM64_APP" "$UNIVERSAL_APP"
@@ -42,6 +50,10 @@ lipo -create \
   "$X86_APP/Contents/MacOS/ContextEditor" \
   -output "$UNIVERSAL_APP/Contents/MacOS/ContextEditor"
 
-codesign --force --sign - --deep --timestamp=none "$UNIVERSAL_APP"
+if [[ -n "$SIGNING_IDENTITY" ]]; then
+  codesign --force --deep --options runtime --timestamp --sign "$SIGNING_IDENTITY" "$UNIVERSAL_APP"
+else
+  codesign --force --sign - --deep --timestamp=none "$UNIVERSAL_APP"
+fi
 
 echo "Universal app created at: $UNIVERSAL_APP"

scripts/notarize_local.sh

@@ -0,0 +1,38 @@
+#!/bin/zsh
+
+set -euo pipefail
+
+if [[ $# -lt 2 ]]; then
+  echo "Usage: $0 <app-path> <keychain-profile> [output-zip-path]" >&2
+  exit 1
+fi
+
+APP_PATH="$1"
+PROFILE_NAME="$2"
+ZIP_PATH="${3:-${APP_PATH:r}.zip}"
+
+if [[ ! -d "$APP_PATH" ]]; then
+  echo "App not found: $APP_PATH" >&2
+  exit 1
+fi
+
+rm -f "$ZIP_PATH"
+
+echo "Packaging app for notarization..."
+ditto -c -k --sequesterRsrc --keepParent "$APP_PATH" "$ZIP_PATH"
+
+echo "Submitting archive to Apple notarization service..."
+xcrun notarytool submit "$ZIP_PATH" \
+  --keychain-profile "$PROFILE_NAME" \
+  --wait
+
+echo "Stapling notarization ticket..."
+xcrun stapler staple "$APP_PATH"
+
+echo "Validating stapled ticket..."
+xcrun stapler validate "$APP_PATH"
+
+echo "Gatekeeper assessment..."
+spctl -a -vv "$APP_PATH"
+
+echo "Notarization complete for: $APP_PATH"