@@ -86,10 +86,30 @@ jobs:
8686 with :
8787 submodules : recursive
8888
89+ - name : Get Cer for code signing
90+ if : runner.os == 'macOS'
91+ run : base64 -d <<< "$NOTARIZE_P8_BASE64" > /tmp/notary-key.p8
92+ shell : bash
93+ env :
94+ NOTARIZE_P8_BASE64 : ${{ secrets.NOTARIZE_P8_BASE64 }}
95+
96+ - uses : apple-actions/import-codesign-certs@v2
97+ continue-on-error : true
98+ if : runner.os == 'macOS'
99+ with :
100+ p12-file-base64 : ${{ secrets.CODE_SIGN_P12_BASE64 }}
101+ p12-password : ${{ secrets.CODE_SIGN_P12_PASSWORD }}
102+
103+ - uses : actions/setup-dotnet@v3
104+ if : runner.os == 'Windows'
105+ with :
106+ dotnet-version : " 8.0.x"
107+
89108 - name : Install choco on Windows
90109 if : runner.os == 'Windows'
91110 run : |
92111 choco install make pkgconfiglite ccache awscli 7zip ninja -y
112+ dotnet tool install --global AzureSignTool
93113
94114 - name : Download ccache from s3
95115 if : runner.os == 'Windows'
@@ -117,7 +137,54 @@ jobs:
117137 run : |
118138 cd engine
119139 make pre-package
140+
141+ - name : Code Signing binaries
142+ run : |
143+ cd engine
144+ make codesign-binary CODE_SIGN=true DEVELOPER_ID="${{ secrets.DEVELOPER_ID }}" AZURE_KEY_VAULT_URI="${{ secrets.AZURE_KEY_VAULT_URI }}" AZURE_CLIENT_ID="${{ secrets.AZURE_CLIENT_ID }}" AZURE_TENANT_ID="${{ secrets.AZURE_TENANT_ID }}" AZURE_CLIENT_SECRET="${{ secrets.AZURE_CLIENT_SECRET }}" AZURE_CERT_NAME="${{ secrets.AZURE_CERT_NAME }}"
145+
146+ - name : Notary macOS Binary
147+ if : runner.os == 'macOS'
148+ run : |
149+ curl -sSfL https://raw.githubusercontent.com/anchore/quill/main/install.sh | sh -s -- -b /usr/local/bin
150+ cd engine/cortex
151+ # Notarize the binary
152+ quill notarize ./cortex
153+ env :
154+ QUILL_NOTARY_KEY_ID : ${{ secrets.NOTARY_KEY_ID }}
155+ QUILL_NOTARY_ISSUER : ${{ secrets.NOTARY_ISSUER }}
156+ QUILL_NOTARY_KEY : " /tmp/notary-key.p8"
157+
158+ - name : Build Installers
159+ shell : bash
160+ run : |
161+ cd engine
162+ make build-installer PACKAGE_NAME=cortexcpp-nightly VERSION=${{ needs.get-update-version.outputs.new_version }} SOURCE_BINARY_PATH="../../cortex/cortex" DESTINATION_BINARY_NAME="cortex-nightly" DATA_FOLDER_NAME=".cortex-nightly" CONFIGURATION_FILE_NAME=".cortexrc-nightly" UNINSTALLER_FILE_NAME="cortex-nightly-uninstall.sh"
163+
164+ - name : Codesign and notary for macos installer
165+ if : runner.os == 'macOS'
166+ run : |
167+ cd engine
168+ productsign --sign "Developer ID Installer: ${{ secrets.DEVELOPER_ID }}" cortexcpp-nightly-${{ needs.get-update-version.outputs.new_version }}.pkg cortexcpp-nightly-${{ needs.get-update-version.outputs.new_version }}-signed.pkg
169+ rm cortexcpp-nightly-${{ needs.get-update-version.outputs.new_version }}.pkg
170+ mv cortexcpp-nightly-${{ needs.get-update-version.outputs.new_version }}-signed.pkg cortexcpp-nightly-${{ needs.get-update-version.outputs.new_version }}.pkg
171+ xcrun notarytool submit cortexcpp-nightly-${{ needs.get-update-version.outputs.new_version }}.pkg --apple-id ${{ secrets.APPLE_ID }} --password ${{ secrets.APPLE_APP_SPECIFIC_PASSWORD }} --team-id ${{ secrets.APPLE_TEAM_ID }} --wait
172+
173+ - name : Compile .ISS to .EXE Installer
174+ uses : Minionguyjpro/Inno-Setup-Action@v1.2.2
175+ if : runner.os == 'Windows'
176+ with :
177+ path : engine/templates/windows/installer-nightly.iss
178+ options : /O+
179+
180+ - name : Codesign for windows installer
181+ if : runner.os == 'Windows'
182+ run : |
183+ cd engine
120184
185+ set PATH=%PATH%;%USERPROFILE%\.dotnet\tools
186+ azuresigntool.exe sign -kvu ${{ secrets.AZURE_KEY_VAULT_URI }} -kvi ${{ secrets.AZURE_CLIENT_ID }} -kvt ${{ secrets.AZURE_TENANT_ID }} -kvs ${{ secrets.AZURE_CLIENT_SECRET }} -kvc ${{ secrets.AZURE_CERT_NAME }} -tr http://timestamp.globalsign.com/tsa/r6advanced1 -v ".\templates\windows\setup.exe";'
187+
121188 - name : Package
122189 run : |
123190 cd engine
@@ -129,6 +196,27 @@ jobs:
129196 name : cortex-${{ matrix.os }}-${{ matrix.name }}
130197 path : ./engine/cortex
131198
199+ - name : Upload windwos installer
200+ if : runner.os == 'Windows'
201+ uses : actions/upload-artifact@v2
202+ with :
203+ name : cortex-${{ matrix.os }}-installer-${{ matrix.name }}
204+ path : ./engine/templates/windows/setup.exe
205+
206+ - name : Upload macos installer
207+ if : runner.os == 'macOS'
208+ uses : actions/upload-artifact@v2
209+ with :
210+ name : cortex-${{ matrix.os }}-installer-${{ matrix.name }}
211+ path : ./engine/cortexcpp-nightly.pkg
212+
213+ - name : Upload linux installer
214+ if : runner.os == 'Linux'
215+ uses : actions/upload-artifact@v2
216+ with :
217+ name : cortex-${{ matrix.os }}-installer-${{ matrix.name }}
218+ path : ./engine/cortexcpp-nightly.deb
219+
132220 - name : Upload ccache to s3
133221 continue-on-error : true
134222 if : always() && runner.os == 'Windows'
0 commit comments