Improved macOS DMG release (#7)

* fix: move the process of creating a dmg in ci from makefile * refactor: sign and notarize manually * feat: use create-dmg to provide pretty dmg * fix: wildcard dmg file handling in release
xxxbrian · Jul 14, 2024 · 4290c0b · 4290c0b
1 parent 3291cbe
commit 4290c0b
Show file tree

Hide file tree

Showing 2 changed files with 26 additions and 16 deletions.
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
@@ -56,23 +56,34 @@ jobs:
         run: |
           security find-identity -v -p codesigning
           make app-universal
-      - name: Notarize Release Build
-        uses: lando/notarize-action@v2
-        with:
-          product-path: "./target/release/osx/Alacritty.app"
-          appstore-connect-username: ${{ secrets.NOTARIZATION_USERNAME }}
-          appstore-connect-password: ${{ secrets.NOTARIZATION_PASSWORD }}
-          appstore-connect-team-id: 7N7Y43VZ4J
-          verbose: true
-      - name: Staple Release Build
-        uses: BoundfoxStudios/action-xcode-staple@v1
-        with:
-          product-path: "./target/release/osx/Alacritty.app"
+      - name: Sign Release Build
+        run: |
+          codesign --force --deep --entitlements "extra/osx/macos-entitlement.plist" --options runtime --timestamp --sign "Developer ID Application: Bojin Li (7N7Y43VZ4J)" -v "target/release/osx/Alacritty.app"
+      - name: "Notarize app bundle"
+        env:
+          PROD_MACOS_NOTARIZATION_APPLE_ID: ${{ secrets.NOTARIZATION_USERNAME }}
+          PROD_MACOS_NOTARIZATION_TEAM_ID: 7N7Y43VZ4J
+          PROD_MACOS_NOTARIZATION_PWD: ${{ secrets.NOTARIZATION_PASSWORD }}
+        run: |
+          echo "Create keychain profile"
+          xcrun notarytool store-credentials "notarytool-profile" --apple-id "$PROD_MACOS_NOTARIZATION_APPLE_ID" --team-id "$PROD_MACOS_NOTARIZATION_TEAM_ID" --password "$PROD_MACOS_NOTARIZATION_PWD"
+
+          echo "Creating temp notarization archive"
+          ditto -c -k --keepParent "target/release/osx/Alacritty.app" "notarization.zip"
+
+          echo "Notarize app"
+          xcrun notarytool submit "notarization.zip" --keychain-profile "notarytool-profile" --wait
+
+          echo "Attach staple"
+          xcrun stapler staple "target/release/osx/Alacritty.app"
       - name: Make DMG
-        run: make dmg-universal
+        run: |
+            npm install --global create-dmg
+            brew install graphicsmagick imagemagick
+            create-dmg 'target/release/osx/Alacritty.app' 'target/release/osx'
       - name: Upload Application
         run: |
-          mv ./target/release/osx/Alacritty.dmg ./Alacritty-${GITHUB_REF##*/}.dmg
+          mv ./target/release/osx/Alacritty*.dmg ./Alacritty-${GITHUB_REF##*/}.dmg
           ./.github/workflows/upload_asset.sh ./Alacritty-${GITHUB_REF##*/}.dmg $GITHUB_TOKEN
       - name: Clean up keychain
         if: ${{ always() }}

diff --git a/Makefile b/Makefile
@@ -14,7 +14,6 @@ COMPLETIONS = $(COMPLETIONS_DIR)/_alacritty \
 
 APP_NAME = Alacritty.app
 APP_TEMPLATE = $(ASSETS_DIR)/osx/$(APP_NAME)
-APP_ENTITLEMENTS = $(ASSETS_DIR)/osx/macos-entitlement.plist
 APP_DIR = $(RELEASE_DIR)/osx
 APP_BINARY = $(RELEASE_DIR)/$(TARGET)
 APP_BINARY_DIR = $(APP_DIR)/$(APP_NAME)/Contents/MacOS
@@ -58,7 +57,7 @@ $(APP_NAME)-%: $(TARGET)-%
 	@cp -fp $(COMPLETIONS) $(APP_COMPLETIONS_DIR)
 	@touch -r "$(APP_BINARY)" "$(APP_DIR)/$(APP_NAME)"
 	@codesign --remove-signature "$(APP_DIR)/$(APP_NAME)"
-	@codesign --force --deep --entitlements $(APP_ENTITLEMENTS) --options runtime --timestamp --sign "Developer ID Application: Bojin Li (7N7Y43VZ4J)" -v "$(APP_DIR)/$(APP_NAME)"
+	@codesign --force --deep --sign - "$(APP_DIR)/$(APP_NAME)"
 	@echo "Created '$(APP_NAME)' in '$(APP_DIR)'"
 
 dmg: $(DMG_NAME)-native ## Create an Alacritty.dmg