codeburn/.github/workflows/build-desktop-mac.yml

name: Build macOS desktop

# Builds, signs and notarizes the desktop app for arm64 and x64 in one electron-builder run,
# so a single latest-mac.yml lists both zips. Read-only like the Windows installer workflow:
# the release owner uploads the artifact to the desktop-v* release by hand.
on:
  push:
    tags:
      - 'desktop-v*'
  workflow_dispatch:

permissions:
  contents: read

jobs:
  mac:
    runs-on: macos-latest
    timeout-minutes: 60
    steps:
      - uses: actions/checkout@v6

      - uses: actions/setup-node@v6
        with:
          node-version: 22.13.0
          cache: npm
          cache-dependency-path: |
            package-lock.json
            app/package-lock.json

      - name: Check tag matches the app version
        if: github.ref_type == 'tag'
        run: test "desktop-v$(node -p "require('./app/package.json').version")" = "$GITHUB_REF_NAME"

      - name: Install dependencies
        run: |
          npm ci
          npm ci --prefix app

      - name: Check secrets and write notary key
        env:
          MACOS_CERT_P12_BASE64: ${{ secrets.MACOS_CERT_P12_BASE64 }}
          MACOS_CERT_PASSWORD: ${{ secrets.MACOS_CERT_PASSWORD }}
          APPSTORE_API_KEY_P8_BASE64: ${{ secrets.APPSTORE_API_KEY_P8_BASE64 }}
          APPSTORE_API_KEY_ID: ${{ secrets.APPSTORE_API_KEY_ID }}
          APPSTORE_API_ISSUER_ID: ${{ secrets.APPSTORE_API_ISSUER_ID }}
        run: |
          for name in MACOS_CERT_P12_BASE64 MACOS_CERT_PASSWORD APPSTORE_API_KEY_P8_BASE64 APPSTORE_API_KEY_ID APPSTORE_API_ISSUER_ID; do
            if [ -z "${!name}" ]; then echo "::error::secret $name is not set"; exit 1; fi
          done
          echo "$APPSTORE_API_KEY_P8_BASE64" | base64 --decode > "$RUNNER_TEMP/notary.p8"
          # Keychain Access exports a legacy p12 (RC2-40, sha1 MAC, 1 iteration) that the
          # runner's `security import` rejects as a wrong password; rewrap it in a form it reads.
          # electron-builder's own temporary keychain fails to unlock on this runner, so import
          # into our keychain (as release-menubar.yml does) and let it find the identity there.
          umask 077
          openssl3="$(brew --prefix openssl@3)/bin/openssl"
          cert="$RUNNER_TEMP/signing.p12"
          keychain="$RUNNER_TEMP/codeburn-signing.keychain-db"
          base64 --decode <<< "$MACOS_CERT_P12_BASE64" > "$cert.in"
          "$openssl3" pkcs12 -legacy -in "$cert.in" -passin env:MACOS_CERT_PASSWORD -nodes -out "$cert.pem"
          export cert_password="$(openssl rand -hex 24)"
          echo "::add-mask::$cert_password"
          "$openssl3" pkcs12 -export -legacy -in "$cert.pem" -out "$cert" -passout env:cert_password \
            -keypbe PBE-SHA1-3DES -certpbe PBE-SHA1-3DES -macalg sha1 -iter 2048
          rm -f "$cert.in" "$cert.pem"
          keychain_password="$(openssl rand -hex 24)"
          echo "::add-mask::$keychain_password"
          security create-keychain -p "$keychain_password" "$keychain"
          security set-keychain-settings -lut 21600 "$keychain"
          security unlock-keychain -p "$keychain_password" "$keychain"
          security import "$cert" -k "$keychain" -P "$cert_password" -f pkcs12 -T /usr/bin/codesign -T /usr/bin/security
          rm -f "$cert"
          security set-key-partition-list -S apple-tool:,apple:,codesign: -s -k "$keychain_password" "$keychain" > /dev/null
          # shellcheck disable=SC2046
          security list-keychains -d user -s "$keychain" $(security list-keychains -d user | tr -d '"')
          security find-identity -v -p codesigning "$keychain" | grep -q 'Developer ID Application: .*(XRVP7P7F9M)' \
            || { echo "::error::No Developer ID Application identity for team XRVP7P7F9M in MACOS_CERT_P12_BASE64."; exit 1; }

      - name: Build, sign and notarize
        working-directory: app
        env:
          APPLE_API_KEY: ${{ runner.temp }}/notary.p8
          APPLE_API_KEY_ID: ${{ secrets.APPSTORE_API_KEY_ID }}
          APPLE_API_ISSUER: ${{ secrets.APPSTORE_API_ISSUER_ID }}
        run: |
          npm run stage-cli
          npm run build
          CSC_IDENTITY_AUTO_DISCOVERY=true npx electron-builder --mac --publish never \
            -c.mac.identity="Resham Joshi (XRVP7P7F9M)" \
            -c.mac.hardenedRuntime=true \
            -c.dmg.sign=true

      - name: Notarize and staple the dmgs
        working-directory: app/release
        env:
          APPLE_API_KEY_ID: ${{ secrets.APPSTORE_API_KEY_ID }}
          APPLE_API_ISSUER: ${{ secrets.APPSTORE_API_ISSUER_ID }}
        run: |
          for dmg in CodeBurn-*.dmg; do
            xcrun notarytool submit "$dmg" --key "$RUNNER_TEMP/notary.p8" --key-id "$APPLE_API_KEY_ID" --issuer "$APPLE_API_ISSUER" --wait
            xcrun stapler staple "$dmg"
          done

      - name: Verify signatures
        working-directory: app/release
        run: |
          for app in mac-arm64/CodeBurn.app mac/CodeBurn.app; do
            codesign --verify --deep --strict "$app"
            spctl --assess --type execute --verbose "$app"
          done
          for dmg in CodeBurn-*.dmg; do xcrun stapler validate "$dmg"; done
          grep -Eq 'url: CodeBurn-[0-9.]+-arm64-mac\.zip' latest-mac.yml
          grep -Eq 'url: CodeBurn-[0-9.]+-mac\.zip' latest-mac.yml

      - name: Remove notary key
        if: always()
        run: |
          rm -f "$RUNNER_TEMP/notary.p8"
          security delete-keychain "$RUNNER_TEMP/codeburn-signing.keychain-db" 2>/dev/null || true

      - name: Upload artifact
        uses: actions/upload-artifact@v6
        with:
          name: CodeBurn-macOS
          path: |
            app/release/CodeBurn-*.dmg
            app/release/CodeBurn-*.dmg.blockmap
            app/release/CodeBurn-*-mac.zip
            app/release/CodeBurn-*-mac.zip.blockmap
            app/release/latest-mac.yml
          if-no-files-found: error
          retention-days: 30