[CI] Sign and Notarize macOS Builds (#2553)

* [CI] Sign and Notarize macOS Builds * fix: variables and test with build * chore: skip sign during PR builds * fix: set Notarize to false on PRS
Heroic-Games-Launcher · Mar 25, 2023 · 89ba3b8 · 89ba3b8
1 parent 73e6e97
commit 89ba3b8
Show file tree

Hide file tree

Showing 10 changed files with 72 additions and 10 deletions.
diff --git a/.eslintignore b/.eslintignore
@@ -0,0 +1 @@
+sign/**
diff --git a/.github/workflows/build-prs-mac.yml b/.github/workflows/build-prs-mac.yml
@@ -26,6 +26,7 @@ jobs:
         env:
           GITHUB_TOKEN: ${{ secrets.WORKFLOW_TOKEN }}
           GH_TOKEN: ${{ secrets.WORKFLOW_TOKEN }}
+          NOTARIZE: false
       - name: Upload x64.
         uses: actions/upload-artifact@v3
         with:

diff --git a/.github/workflows/draft-release-mac.yml b/.github/workflows/draft-release-mac.yml
@@ -6,6 +6,17 @@ on:
       - 'v*'
   workflow_dispatch:
 
+env:
+  GITHUB_TOKEN: ${{ secrets.WORKFLOW_TOKEN }}
+  GH_TOKEN: ${{ secrets.WORKFLOW_TOKEN }}
+  CSC_IDENTITY_AUTO_DISCOVERY: true
+  CSC_LINK: ${{ secrets.CSC_LINK }}
+  CSC_KEY_PASSWORD: ${{ secrets.CSC_KEY_PASSWORD }}
+  APPLE_ID: ${{ secrets.APPLE_ID }}
+  APPLE_APP_SPECIFIC_PASSWORD: ${{ secrets.APPLE_APP_SPECIFIC_PASSWORD }}
+  TEAMID: ${{ secrets.TEAMID }}
+  NOTARIZE: true
+
 jobs:
   draft-releases:
     runs-on: macos-latest
@@ -14,8 +25,6 @@ jobs:
       - uses: actions/setup-node@v3
         with:
           node-version: '18'
-      - run: npm install --legacy-peer-deps
-      - run: npm run release:mac
-        env:
-          GITHUB_TOKEN: ${{ secrets.WORKFLOW_TOKEN }}
-          GH_TOKEN: ${{ secrets.WORKFLOW_TOKEN }}
+      - run: npm install -g yarn
+      - run: yarn
+      - run: yarn release:mac
diff --git a/.gitignore b/.gitignore
@@ -33,3 +33,4 @@ vite-plugin-electron.log
 
 #flatpak
 flatpak-build
+.env
diff --git a/.prettierignore b/.prettierignore
@@ -4,4 +4,5 @@ build
 coverage
 public/locales/
 flatpak
-flatpak-build
+flatpak-build
+sign/
diff --git a/package.json b/package.json
@@ -15,8 +15,9 @@
     "email": "heroicgameslauncher@protonmail.com"
   },
   "build": {
-    "appId": "com.electron.heroic",
+    "appId": "com.heroicgameslauncher.hgl",
     "productName": "Heroic",
+    "afterSign": "sign/notarize.js",
     "files": [
       "build/**/*",
       "node_modules/**/*",
@@ -55,9 +56,13 @@
     },
     "mac": {
       "artifactName": "${productName}-${version}-macOS-${arch}.${ext}",
-      "target": "dmg",
       "category": "public.app-category.games",
       "icon": "build/icon.icns",
+      "entitlements": "build/entitlements.mac.plist",
+      "entitlementsInherit": "build/entitlements.mac.plist",
+      "extendInfo": {
+        "com.apple.security.cs.allow-jit": true
+      },
       "asarUnpack": [
         "build/bin/darwin/legendary",
         "build/bin/darwin/gogdl"
@@ -192,7 +197,7 @@
     "release:win": "vite build && electron-builder -p always --win portable --x64 --arm64",
     "sign:win": "vite build && electron-builder -p never --win nsis --x64 --arm64",
     "dist:linux": "vite build && electron-builder --linux",
-    "dist:mac": "vite build && electron-builder --mac",
+    "dist:mac": "export CSC_IDENTITY_AUTO_DISCOVERY=false && vite build && electron-builder --mac",
     "dist:win": "vite build && electron-builder --win",
     "dist:flatpak": "yarn dist:linux appimage && yarn flatpak:prepare && yarn flatpak:build",
     "lint": "eslint --cache -c .eslintrc --ext .tsx,ts .",
@@ -212,6 +217,7 @@
     ]
   },
   "devDependencies": {
+    "@electron/notarize": "^1.2.3",
     "@testing-library/dom": "^9.0.1",
     "@testing-library/jest-dom": "^5.16.4",
     "@testing-library/react": "^14.0.0",

diff --git a/public/entitlements.mac.plist b/public/entitlements.mac.plist
@@ -0,0 +1,12 @@
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" 
+    "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+  <dict>
+    <key>com.apple.security.cs.allow-jit</key>
+    <true/>
+    <key>com.apple.security.cs.allow-unsigned-executable-memory</key>
+    <true/>
+    <key>com.apple.security.cs.disable-library-validation</key>
+    <true/>
+  </dict>
+</plist>
diff --git a/sign/notarize.js b/sign/notarize.js
@@ -0,0 +1,23 @@
+require('dotenv').config()
+const { notarize } = require('@electron/notarize')
+
+exports.default = async function notarizing(context) {
+  const { electronPlatformName, appOutDir } = context
+  if (electronPlatformName !== 'darwin' || process.env.NOTARIZE === 'false') {
+    console.log('Notarizing skipped')
+    return
+  }
+
+  console.log('Notarizing Application...')
+
+  const appName = context.packager.appInfo.productFilename
+
+  return await notarize({
+    tool: 'notarytool',
+    appBundleId: 'com.heroicgameslauncher.hgl',
+    appPath: `${appOutDir}/${appName}.app`,
+    teamId: process.env.TEAMID,
+    appleId: process.env.APPLE_ID,
+    appleIdPassword: process.env.APPLE_APP_SPECIFIC_PASSWORD
+  })
+}
diff --git a/tsconfig.json b/tsconfig.json
@@ -27,5 +27,5 @@
     "typeRoots": ["./node-modules/@types", "src/common/typedefs"]
   },
   "include": ["src"],
-  "exclude": ["vite.config.ts", "**/__tests__/**", "**/__mocks__/**"]
+  "exclude": ["vite.config.ts", "**/__tests__/**", "**/__mocks__/**", "sign"]
 }
diff --git a/yarn.lock b/yarn.lock
@@ -468,6 +468,14 @@
   optionalDependencies:
     global-agent "^3.0.0"
 
+"@electron/notarize@^1.2.3":
+  version "1.2.3"
+  resolved "https://registry.yarnpkg.com/@electron/notarize/-/notarize-1.2.3.tgz#38056a629e5a0b5fd56c975c4828c0f74285b644"
+  integrity sha512-9oRzT56rKh5bspk3KpAVF8lPKHYQrBnRwcgiOeR0hdilVEQmszDaAu0IPCPrwwzJN0ugNs0rRboTreHMt/6mBQ==
+  dependencies:
+    debug "^4.1.1"
+    fs-extra "^9.0.1"
+
 "@electron/universal@1.2.1":
   version "1.2.1"
   resolved "https://registry.yarnpkg.com/@electron/universal/-/universal-1.2.1.tgz#3c2c4ff37063a4e9ab1e6ff57db0bc619bc82339"
Original file line number	Diff line number	Diff line change
Expand Up		@@ -33,3 +33,4 @@ vite-plugin-electron.log

		#flatpak
		flatpak-build
		.env