@@ -86,10 +86,34 @@ jobs:
8686 with :
8787 submodules : recursive
8888
89+ - name : Get Cer for code signing
90+ if : runner.os == 'macOS'
91+ run : base64 -d <<< "$NOTARIZE_P8_BASE64" > /tmp/notary-key.p8
92+ shell : bash
93+ env :
94+ NOTARIZE_P8_BASE64 : ${{ secrets.NOTARIZE_P8_BASE64 }}
95+
96+ - name : Install gettext-bast linux
97+ if : runner.os == 'Linux'
98+ run : apt update && apt install gettext-base -y
99+
100+ - uses : apple-actions/import-codesign-certs@v2
101+ continue-on-error : true
102+ if : runner.os == 'macOS'
103+ with :
104+ p12-file-base64 : ${{ secrets.CODE_SIGN_P12_BASE64 }}
105+ p12-password : ${{ secrets.CODE_SIGN_P12_PASSWORD }}
106+
107+ - uses : actions/setup-dotnet@v3
108+ if : runner.os == 'Windows'
109+ with :
110+ dotnet-version : " 8.0.x"
111+
89112 - name : Install choco on Windows
90113 if : runner.os == 'Windows'
91114 run : |
92115 choco install make pkgconfiglite ccache awscli 7zip ninja -y
116+ dotnet tool install --global AzureSignTool
93117
94118 - name : Download ccache from s3
95119 if : runner.os == 'Windows'
@@ -117,7 +141,54 @@ jobs:
117141 run : |
118142 cd engine
119143 make pre-package
144+
145+ - name : Code Signing binaries
146+ run : |
147+ cd engine
148+ make codesign-binary CODE_SIGN=true DEVELOPER_ID="${{ secrets.DEVELOPER_ID }}" AZURE_KEY_VAULT_URI="${{ secrets.AZURE_KEY_VAULT_URI }}" AZURE_CLIENT_ID="${{ secrets.AZURE_CLIENT_ID }}" AZURE_TENANT_ID="${{ secrets.AZURE_TENANT_ID }}" AZURE_CLIENT_SECRET="${{ secrets.AZURE_CLIENT_SECRET }}" AZURE_CERT_NAME="${{ secrets.AZURE_CERT_NAME }}"
149+
150+ - name : Notary macOS Binary
151+ if : runner.os == 'macOS'
152+ run : |
153+ curl -sSfL https://raw.githubusercontent.com/anchore/quill/main/install.sh | sh -s -- -b /usr/local/bin
154+ cd engine/cortex
155+ # Notarize the binary
156+ quill notarize ./cortex
157+ env :
158+ QUILL_NOTARY_KEY_ID : ${{ secrets.NOTARY_KEY_ID }}
159+ QUILL_NOTARY_ISSUER : ${{ secrets.NOTARY_ISSUER }}
160+ QUILL_NOTARY_KEY : " /tmp/notary-key.p8"
161+
162+ - name : Build Installers
163+ shell : bash
164+ run : |
165+ cd engine
166+ make build-installer PACKAGE_NAME=cortexcpp-nightly VERSION=${{ needs.get-update-version.outputs.new_version }} SOURCE_BINARY_PATH="../../cortex/cortex" DESTINATION_BINARY_NAME="cortex-nightly" DATA_FOLDER_NAME=".cortex-nightly" CONFIGURATION_FILE_NAME=".cortexrc-nightly" UNINSTALLER_FILE_NAME="cortex-nightly-uninstall.sh"
167+
168+ - name : Codesign and notary for macos installer
169+ if : runner.os == 'macOS'
170+ run : |
171+ cd engine
172+ productsign --sign "Developer ID Installer: ${{ secrets.DEVELOPER_ID }}" cortexcpp-nightly-${{ needs.get-update-version.outputs.new_version }}.pkg cortexcpp-nightly-${{ needs.get-update-version.outputs.new_version }}-signed.pkg
173+ rm cortexcpp-nightly-${{ needs.get-update-version.outputs.new_version }}.pkg
174+ mv cortexcpp-nightly-${{ needs.get-update-version.outputs.new_version }}-signed.pkg cortexcpp-nightly-${{ needs.get-update-version.outputs.new_version }}.pkg
175+ xcrun notarytool submit cortexcpp-nightly-${{ needs.get-update-version.outputs.new_version }}.pkg --apple-id ${{ secrets.APPLE_ID }} --password ${{ secrets.APPLE_APP_SPECIFIC_PASSWORD }} --team-id ${{ secrets.APPLE_TEAM_ID }} --wait
176+
177+ - name : Compile .ISS to .EXE Installer
178+ uses : Minionguyjpro/Inno-Setup-Action@v1.2.2
179+ if : runner.os == 'Windows'
180+ with :
181+ path : engine/templates/windows/installer-nightly.iss
182+ options : /O+
183+
184+ - name : Codesign for windows installer
185+ if : runner.os == 'Windows'
186+ run : |
187+ cd engine
120188
189+ set PATH=%PATH%;%USERPROFILE%\.dotnet\tools
190+ azuresigntool.exe sign -kvu ${{ secrets.AZURE_KEY_VAULT_URI }} -kvi ${{ secrets.AZURE_CLIENT_ID }} -kvt ${{ secrets.AZURE_TENANT_ID }} -kvs ${{ secrets.AZURE_CLIENT_SECRET }} -kvc ${{ secrets.AZURE_CERT_NAME }} -tr http://timestamp.globalsign.com/tsa/r6advanced1 -v ".\templates\windows\setup.exe";'
191+
121192 - name : Package
122193 run : |
123194 cd engine
@@ -129,6 +200,27 @@ jobs:
129200 name : cortex-${{ matrix.os }}-${{ matrix.name }}
130201 path : ./engine/cortex
131202
203+ - name : Upload windwos installer
204+ if : runner.os == 'Windows'
205+ uses : actions/upload-artifact@v2
206+ with :
207+ name : cortex-${{ matrix.os }}-installer-${{ matrix.name }}
208+ path : ./engine/templates/windows/setup.exe
209+
210+ - name : Upload macos installer
211+ if : runner.os == 'macOS'
212+ uses : actions/upload-artifact@v2
213+ with :
214+ name : cortex-${{ matrix.os }}-installer-${{ matrix.name }}
215+ path : ./engine/cortexcpp-nightly.pkg
216+
217+ - name : Upload linux installer
218+ if : runner.os == 'Linux'
219+ uses : actions/upload-artifact@v2
220+ with :
221+ name : cortex-${{ matrix.os }}-installer-${{ matrix.name }}
222+ path : ./engine/cortexcpp-nightly.deb
223+
132224 - name : Upload ccache to s3
133225 continue-on-error : true
134226 if : always() && runner.os == 'Windows'
0 commit comments