Skip to content
This repository was archived by the owner on Feb 24, 2025. It is now read-only.

Commit bb0f394

Browse files
ayoyayoy
authored
Use fastlane match for code signing DMG builds (#3246)
Task/Issue URL: https://app.asana.com/0/1203301625297703/1208273969808386/f Description: This change adds support for using fastlane match to manage code signing with Developer ID Application certificate. New lanes are added for syncing code signing for local and CI use. Build settings are updated to use provisioning profiles generated by fastlane. archive.sh script and all CI workflows are updated to use fastlane for signing DMG builds and other CI binaries that use Developer ID Application certificate (e.g. unit tests).
1 parent 86d440a commit bb0f394

32 files changed

+325
-828
lines changed

‎.github/actions/install-certs-and-profiles/action.yml

-187
This file was deleted.

‎.github/workflows/build_appstore.yml

+2-3
Original file line numberDiff line numberDiff line change
@@ -76,11 +76,10 @@ jobs:
7676
*) echo "👎 Not a release or hotfix branch"; exit 1 ;;
7777
esac
7878
79-
- name: Register SSH keys for submodules access
79+
- name: Register SSH key for certificates repository access
8080
uses: webfactory/ssh-agent@v0.7.0
8181
with:
82-
ssh-private-key: |
83-
${{ secrets.SSH_PRIVATE_KEY_FASTLANE_MATCH }}
82+
ssh-private-key: ${{ secrets.SSH_PRIVATE_KEY_FASTLANE_MATCH }}
8483

8584
- name: Check out the code
8685
uses: actions/checkout@v4

‎.github/workflows/build_hotfix_release.yml

+4-26
Original file line numberDiff line numberDiff line change
@@ -41,33 +41,11 @@ jobs:
4141
needs: assert_release_branch
4242
uses: ./.github/workflows/pr.yml
4343
secrets:
44+
APPLE_API_KEY_BASE64: ${{ secrets.APPLE_API_KEY_BASE64 }}
45+
APPLE_API_KEY_ID: ${{ secrets.APPLE_API_KEY_ID }}
46+
APPLE_API_KEY_ISSUER: ${{ secrets.APPLE_API_KEY_ISSUER }}
4447
ASANA_ACCESS_TOKEN: ${{ secrets.ASANA_ACCESS_TOKEN }}
45-
BUILD_CERTIFICATE_BASE64: ${{ secrets.BUILD_CERTIFICATE_BASE64 }}
46-
P12_PASSWORD: ${{ secrets.P12_PASSWORD }}
47-
KEYCHAIN_PASSWORD: ${{ secrets.KEYCHAIN_PASSWORD }}
48-
APPSTORE_CI_PROVISION_PROFILE_BASE64: ${{ secrets.APPSTORE_CI_PROVISION_PROFILE_BASE64 }}
49-
CI_PROVISION_PROFILE_BASE64: ${{ secrets.CI_PROVISION_PROFILE_BASE64 }}
50-
DBP_AGENT_APPSTORE_CI_PROVISION_PROFILE_BASE64: ${{ secrets.DBP_AGENT_APPSTORE_CI_PROVISION_PROFILE_BASE64 }}
51-
DBP_AGENT_CI_PROVISION_PROFILE_BASE64: ${{ secrets.DBP_AGENT_CI_PROVISION_PROFILE_BASE64 }}
52-
DBP_AGENT_RELEASE_PROVISION_PROFILE_BASE64: ${{ secrets.DBP_AGENT_RELEASE_PROVISION_PROFILE_BASE64 }}
53-
DBP_AGENT_REVIEW_PROVISION_PROFILE_BASE64: ${{ secrets.DBP_AGENT_REVIEW_PROVISION_PROFILE_BASE64 }}
54-
INTEGRATION_TESTS_APPSTORE_CI_PROVISION_PROFILE_BASE64: ${{ secrets.INTEGRATION_TESTS_APPSTORE_CI_PROVISION_PROFILE_BASE64 }}
55-
INTEGRATION_TESTS_CI_PROVISION_PROFILE_BASE64: ${{ secrets.INTEGRATION_TESTS_CI_PROVISION_PROFILE_BASE64 }}
56-
NETP_AGENT_RELEASE_PROVISION_PROFILE_BASE64: ${{ secrets.NETP_AGENT_RELEASE_PROVISION_PROFILE_BASE64 }}
57-
NETP_AGENT_REVIEW_PROVISION_PROFILE_BASE64: ${{ secrets.NETP_AGENT_REVIEW_PROVISION_PROFILE_BASE64 }}
58-
NETP_NOTIFICATIONS_CI_PROVISION_PROFILE_BASE64: ${{ secrets.NETP_NOTIFICATIONS_CI_PROVISION_PROFILE_BASE64 }}
59-
NETP_NOTIFICATIONS_RELEASE_PROVISION_PROFILE_BASE64: ${{ secrets.NETP_NOTIFICATIONS_RELEASE_PROVISION_PROFILE_BASE64 }}
60-
NETP_NOTIFICATIONS_REVIEW_PROVISION_PROFILE_BASE64: ${{ secrets.NETP_NOTIFICATIONS_REVIEW_PROVISION_PROFILE_BASE64 }}
61-
NETP_SYSEX_RELEASE_PROVISION_PROFILE_BASE64: ${{ secrets.NETP_SYSEX_RELEASE_PROVISION_PROFILE_BASE64 }}
62-
NETP_SYSEX_REVIEW_PROVISION_PROFILE_BASE64: ${{ secrets.NETP_SYSEX_REVIEW_PROVISION_PROFILE_BASE64 }}
63-
RELEASE_PROVISION_PROFILE_BASE64: ${{ secrets.RELEASE_PROVISION_PROFILE_BASE64 }}
64-
REVIEW_PROVISION_PROFILE_BASE64: ${{ secrets.REVIEW_PROVISION_PROFILE_BASE64 }}
65-
UNIT_TESTS_APPSTORE_CI_PROVISION_PROFILE_BASE64: ${{ secrets.UNIT_TESTS_APPSTORE_CI_PROVISION_PROFILE_BASE64 }}
66-
UNIT_TESTS_CI_PROVISION_PROFILE_BASE64: ${{ secrets.UNIT_TESTS_CI_PROVISION_PROFILE_BASE64 }}
67-
VPN_APPEX_APPSTORE_CI_PROVISION_PROFILE_BASE64: ${{ secrets.VPN_APPEX_APPSTORE_CI_PROVISION_PROFILE_BASE64 }}
68-
VPN_APP_APPSTORE_CI_PROVISION_PROFILE_BASE64: ${{ secrets.VPN_APP_APPSTORE_CI_PROVISION_PROFILE_BASE64 }}
69-
VPN_APP_CI_PROVISION_PROFILE_BASE64: ${{ secrets.VPN_APP_CI_PROVISION_PROFILE_BASE64 }}
70-
VPN_PROXY_EXTENSION_CI_PROVISION_PROFILE_BASE64: ${{ secrets.VPN_PROXY_EXTENSION_CI_PROVISION_PROFILE_BASE64 }}
48+
MATCH_PASSWORD: ${{ secrets.MATCH_PASSWORD }}
7149

7250
update_asana:
7351

‎.github/workflows/build_notarized.yml

+26-86
Original file line numberDiff line numberDiff line change
@@ -41,58 +41,6 @@ on:
4141
required: false
4242
type: string
4343
secrets:
44-
BUILD_CERTIFICATE_BASE64:
45-
required: true
46-
P12_PASSWORD:
47-
required: true
48-
KEYCHAIN_PASSWORD:
49-
required: true
50-
APPSTORE_CI_PROVISION_PROFILE_BASE64:
51-
required: true
52-
CI_PROVISION_PROFILE_BASE64:
53-
required: true
54-
DBP_AGENT_APPSTORE_CI_PROVISION_PROFILE_BASE64:
55-
required: true
56-
DBP_AGENT_CI_PROVISION_PROFILE_BASE64:
57-
required: true
58-
DBP_AGENT_RELEASE_PROVISION_PROFILE_BASE64:
59-
required: true
60-
DBP_AGENT_REVIEW_PROVISION_PROFILE_BASE64:
61-
required: true
62-
INTEGRATION_TESTS_APPSTORE_CI_PROVISION_PROFILE_BASE64:
63-
required: true
64-
INTEGRATION_TESTS_CI_PROVISION_PROFILE_BASE64:
65-
required: true
66-
NETP_AGENT_RELEASE_PROVISION_PROFILE_BASE64:
67-
required: true
68-
NETP_AGENT_REVIEW_PROVISION_PROFILE_BASE64:
69-
required: true
70-
NETP_NOTIFICATIONS_CI_PROVISION_PROFILE_BASE64:
71-
required: true
72-
NETP_NOTIFICATIONS_RELEASE_PROVISION_PROFILE_BASE64:
73-
required: true
74-
NETP_NOTIFICATIONS_REVIEW_PROVISION_PROFILE_BASE64:
75-
required: true
76-
NETP_SYSEX_RELEASE_PROVISION_PROFILE_BASE64:
77-
required: true
78-
NETP_SYSEX_REVIEW_PROVISION_PROFILE_BASE64:
79-
required: true
80-
RELEASE_PROVISION_PROFILE_BASE64:
81-
required: true
82-
REVIEW_PROVISION_PROFILE_BASE64:
83-
required: true
84-
UNIT_TESTS_APPSTORE_CI_PROVISION_PROFILE_BASE64:
85-
required: true
86-
UNIT_TESTS_CI_PROVISION_PROFILE_BASE64:
87-
required: true
88-
VPN_APPEX_APPSTORE_CI_PROVISION_PROFILE_BASE64:
89-
required: true
90-
VPN_APP_APPSTORE_CI_PROVISION_PROFILE_BASE64:
91-
required: true
92-
VPN_APP_CI_PROVISION_PROFILE_BASE64:
93-
required: true
94-
VPN_PROXY_EXTENSION_CI_PROVISION_PROFILE_BASE64:
95-
required: true
9644
APPLE_API_KEY_BASE64:
9745
required: true
9846
APPLE_API_KEY_ID:
@@ -101,10 +49,6 @@ on:
10149
required: true
10250
ASANA_ACCESS_TOKEN:
10351
required: true
104-
MM_HANDLES_BASE64:
105-
required: true
106-
MM_WEBHOOK_URL:
107-
required: true
10852
AWS_ACCESS_KEY_ID:
10953
required: true
11054
AWS_ACCESS_KEY_ID_RELEASE_S3:
@@ -113,6 +57,14 @@ on:
11357
required: true
11458
AWS_SECRET_ACCESS_KEY_RELEASE_S3:
11559
required: true
60+
MATCH_PASSWORD:
61+
required: true
62+
MM_HANDLES_BASE64:
63+
required: true
64+
MM_WEBHOOK_URL:
65+
required: true
66+
SSH_PRIVATE_KEY_FASTLANE_MATCH:
67+
required: true
11668

11769
jobs:
11870
export-notarized-app:
@@ -132,6 +84,10 @@ jobs:
13284
branch: ${{ inputs.branch || github.ref_name }}
13385

13486
steps:
87+
- name: Register SSH key for certificates repository access
88+
uses: webfactory/ssh-agent@v0.7.0
89+
with:
90+
ssh-private-key: ${{ secrets.SSH_PRIVATE_KEY_FASTLANE_MATCH }}
13591

13692
- name: Check out the code
13793
uses: actions/checkout@v4
@@ -142,6 +98,20 @@ jobs:
14298
- name: Set up fastlane
14399
run: bundle install
144100

101+
- name: Sync code signing assets
102+
env:
103+
APPLE_API_KEY_BASE64: ${{ secrets.APPLE_API_KEY_BASE64 }}
104+
APPLE_API_KEY_ID: ${{ secrets.APPLE_API_KEY_ID }}
105+
APPLE_API_KEY_ISSUER: ${{ secrets.APPLE_API_KEY_ISSUER }}
106+
MATCH_PASSWORD: ${{ secrets.MATCH_PASSWORD }}
107+
SSH_PRIVATE_KEY_FASTLANE_MATCH: ${{ secrets.SSH_PRIVATE_KEY_FASTLANE_MATCH }}
108+
run: |
109+
if [[ "${{ env.release-type }}" == "release" ]]; then
110+
bundle exec fastlane sync_signing_dmg_release
111+
else
112+
bundle exec fastlane sync_signing_dmg_review
113+
fi
114+
145115
- name: Check if this is an official release build
146116
id: is-official-release
147117
env:
@@ -155,36 +125,6 @@ jobs:
155125
echo "upload-to=asana" >> $GITHUB_ENV
156126
fi
157127
158-
- name: Install Apple Developer ID Application certificate
159-
uses: ./.github/actions/install-certs-and-profiles
160-
with:
161-
BUILD_CERTIFICATE_BASE64: ${{ secrets.BUILD_CERTIFICATE_BASE64 }}
162-
P12_PASSWORD: ${{ secrets.P12_PASSWORD }}
163-
KEYCHAIN_PASSWORD: ${{ secrets.KEYCHAIN_PASSWORD }}
164-
APPSTORE_CI_PROVISION_PROFILE_BASE64: ${{ secrets.APPSTORE_CI_PROVISION_PROFILE_BASE64 }}
165-
CI_PROVISION_PROFILE_BASE64: ${{ secrets.CI_PROVISION_PROFILE_BASE64 }}
166-
DBP_AGENT_APPSTORE_CI_PROVISION_PROFILE_BASE64: ${{ secrets.DBP_AGENT_APPSTORE_CI_PROVISION_PROFILE_BASE64 }}
167-
DBP_AGENT_CI_PROVISION_PROFILE_BASE64: ${{ secrets.DBP_AGENT_CI_PROVISION_PROFILE_BASE64 }}
168-
DBP_AGENT_RELEASE_PROVISION_PROFILE_BASE64: ${{ secrets.DBP_AGENT_RELEASE_PROVISION_PROFILE_BASE64 }}
169-
DBP_AGENT_REVIEW_PROVISION_PROFILE_BASE64: ${{ secrets.DBP_AGENT_REVIEW_PROVISION_PROFILE_BASE64 }}
170-
INTEGRATION_TESTS_APPSTORE_CI_PROVISION_PROFILE_BASE64: ${{ secrets.INTEGRATION_TESTS_APPSTORE_CI_PROVISION_PROFILE_BASE64 }}
171-
INTEGRATION_TESTS_CI_PROVISION_PROFILE_BASE64: ${{ secrets.INTEGRATION_TESTS_CI_PROVISION_PROFILE_BASE64 }}
172-
NETP_AGENT_RELEASE_PROVISION_PROFILE_BASE64: ${{ secrets.NETP_AGENT_RELEASE_PROVISION_PROFILE_BASE64 }}
173-
NETP_AGENT_REVIEW_PROVISION_PROFILE_BASE64: ${{ secrets.NETP_AGENT_REVIEW_PROVISION_PROFILE_BASE64 }}
174-
NETP_NOTIFICATIONS_CI_PROVISION_PROFILE_BASE64: ${{ secrets.NETP_NOTIFICATIONS_CI_PROVISION_PROFILE_BASE64 }}
175-
NETP_NOTIFICATIONS_RELEASE_PROVISION_PROFILE_BASE64: ${{ secrets.NETP_NOTIFICATIONS_RELEASE_PROVISION_PROFILE_BASE64 }}
176-
NETP_NOTIFICATIONS_REVIEW_PROVISION_PROFILE_BASE64: ${{ secrets.NETP_NOTIFICATIONS_REVIEW_PROVISION_PROFILE_BASE64 }}
177-
NETP_SYSEX_RELEASE_PROVISION_PROFILE_BASE64: ${{ secrets.NETP_SYSEX_RELEASE_PROVISION_PROFILE_BASE64 }}
178-
NETP_SYSEX_REVIEW_PROVISION_PROFILE_BASE64: ${{ secrets.NETP_SYSEX_REVIEW_PROVISION_PROFILE_BASE64 }}
179-
RELEASE_PROVISION_PROFILE_BASE64: ${{ secrets.RELEASE_PROVISION_PROFILE_BASE64 }}
180-
REVIEW_PROVISION_PROFILE_BASE64: ${{ secrets.REVIEW_PROVISION_PROFILE_BASE64 }}
181-
UNIT_TESTS_APPSTORE_CI_PROVISION_PROFILE_BASE64: ${{ secrets.UNIT_TESTS_APPSTORE_CI_PROVISION_PROFILE_BASE64 }}
182-
UNIT_TESTS_CI_PROVISION_PROFILE_BASE64: ${{ secrets.UNIT_TESTS_CI_PROVISION_PROFILE_BASE64 }}
183-
VPN_APPEX_APPSTORE_CI_PROVISION_PROFILE_BASE64: ${{ secrets.VPN_APPEX_APPSTORE_CI_PROVISION_PROFILE_BASE64 }}
184-
VPN_APP_APPSTORE_CI_PROVISION_PROFILE_BASE64: ${{ secrets.VPN_APP_APPSTORE_CI_PROVISION_PROFILE_BASE64 }}
185-
VPN_APP_CI_PROVISION_PROFILE_BASE64: ${{ secrets.VPN_APP_CI_PROVISION_PROFILE_BASE64 }}
186-
VPN_PROXY_EXTENSION_CI_PROVISION_PROFILE_BASE64: ${{ secrets.VPN_PROXY_EXTENSION_CI_PROVISION_PROFILE_BASE64 }}
187-
188128
- name: Select Xcode
189129
run: sudo xcode-select -s /Applications/Xcode_$(<.xcode-version).app/Contents/Developer
190130

0 commit comments

Comments
 (0)