Build releases on macos

.github/workflows/release.yml

@@ -11,7 +11,7 @@ permissions:
 
 jobs:
   goreleaser:
-    runs-on: ubuntu-latest
+    runs-on: macos-12
     steps:
       - uses: actions/checkout@v3
         with:
@@ -21,10 +21,30 @@ jobs:
         with:
           go-version: 1.19.1
           cache: true
+      - name: Import signing keys
+        env:
+          MACOS_CERTIFICATE: ${{ secrets.MACOS_CERTIFICATE }}
+          MACOS_CERTIFICATE_PWD: ${{ secrets.MACOS_CERTIFICATE_PWD }}
+          AC_USERNAME: ${{ secrets.AC_USERNAME }}
+          AC_PASSWORD: ${{ secrets.AC_PASSWORD }}
+          KEYCHAIN_PASSWORD: ${{ secrets.KEYCHAIN_PASSWORD }}
+        run: |
+          echo "$MACOS_CERTIFICATE" | base64 --decode > certificate.p12
+          security create-keychain -p $KEYCHAIN_PASSWORD build.keychain
+          security default-keychain -s build.keychain
+          security unlock-keychain -p $KEYCHAIN_PASSWORD build.keychain
+          security import certificate.p12 -k build.keychain -P $MACOS_CERTIFICATE_PWD -T /usr/bin/codesign
+          security set-key-partition-list -S apple-tool:,apple:,codesign: -s -k $KEYCHAIN_PASSWORD build.keychain
+          security find-identity -vv
+          rm certificate.p12
+      - name: "install gon"
+        run: go install github.com/mitchellh/gon/...@v0.2.5
       - uses: goreleaser/goreleaser-action@v2
         with:
           distribution: goreleaser
           version: latest
           args: release --rm-dist
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          AC_USERNAME: ${{ secrets.AC_USERNAME }}
+          AC_PASSWORD: ${{ secrets.AC_PASSWORD }}

.goreleaser.yaml

@@ -1,6 +1,17 @@
+# Setup verifiable Go builds
+gomod:
+  proxy: true
+  env:
+    - GOPROXY=https://proxy.golang.org,direct
+    - GOSUMDB=sum.golang.org
+  mod: mod
+
+# Download dependencies
 before:
   hooks:
     - go mod tidy
+
+# Build for linux, windows and macos
 builds:
   - id: cueimports
     main: ./cmd/cueimports
@@ -9,14 +20,40 @@ builds:
     goos:
       - linux
       - windows
+  - id: cueimports-macos
+    main: ./cmd/cueimports
+    env:
+      - CGO_ENABLED=0
+    goos:
       - darwin
+
+# Merge arm64 and amd64 macos binaries into one
+universal_binaries:
+  - ids:
+      - cueimports-macos
+    replace: true
+
+  # Sign and notarize macos universal binary
+signs:
+  - signature: "cueimports_macos_universal.zip"
+    ids:
+      - cueimports
+    cmd: gon
+    args:
+      - gon.hcl
+    artifacts: all
+    output: true
+
+# Misc
 archives:
   - replacements:
       darwin: Darwin
       linux: Linux
       windows: Windows
       386: i386
       amd64: x86_64
+
+# Checksum
 checksum:
   name_template: "checksums.txt"
 snapshot:

gon.hcl

@@ -0,0 +1,12 @@
+# The path follows a pattern
+# ./dist/BUILD-ID_TARGET/BINARY-NAME
+source = ["./dist/cueimports_darwin_all/cueimports"]
+bundle_id = "com.asdine.cueimports"
+
+sign {
+  application_identity = "Developer ID Application: Azeddine El Hrychy"
+}
+
+zip {
+    output_path = "dist/cueimports_macos_universal.zip"
+}