Merge pull request #869 from processing/sign-macos-prebuilds

Sign macos prebuilds

Author: Stefterv

.github/workflows/build.yml

@@ -66,8 +66,16 @@ jobs:
           architecture: ${{ matrix.arch }}
       - name: Setup Ant
         uses: cedx/setup-ant@v3
+      - name: Install Certificates for Code Signing
+        if: ${{ matrix.os_prefix == 'macos' }}
+        uses: apple-actions/import-codesign-certs@v3
+        with:
+          p12-file-base64: ${{ secrets.CERTIFICATES_P12 }}
+          p12-password: ${{ secrets.CERTIFICATES_P12_PASSWORD }}
       - name: Build Release
         run: ant -noinput -buildfile build/build.xml ${{ matrix.os_prefix }}-dist -Dversion="${{ github.sha }}"
+        env:
+          PROCESSING_APP_SIGNING: true
       - name: Add artifact
         uses: actions/upload-artifact@v4
         with:

.github/workflows/pull_request.yml

@@ -51,8 +51,16 @@ jobs:
           architecture: ${{ matrix.arch }}
       - name: Setup Ant
         uses: cedx/setup-ant@v3
+      - name: Install Certificates for Code Signing
+        if: ${{ matrix.os_prefix == 'macos' }}
+        uses: apple-actions/import-codesign-certs@v3
+        with:
+          p12-file-base64: ${{ secrets.CERTIFICATES_P12 }}
+          p12-password: ${{ secrets.CERTIFICATES_P12_PASSWORD }}
       - name: Build Release
         run: ant -noinput -buildfile build/build.xml ${{ matrix.os_prefix }}-dist -Dversion="${{ github.sha }}"
+        env:
+          PROCESSING_APP_SIGNING: true
       - name: Add artifact
         uses: actions/upload-artifact@v3
         id: upload

.github/workflows/release.yml

@@ -105,6 +105,7 @@ jobs:
       - name: Build Release
         run: ant -noinput -buildfile build/build.xml ${{ matrix.os_prefix }}-dist -Dversion="${{ needs.version.outputs.version }}" -Dplatform=${{ matrix.os_prefix }}
         env:
+          PROCESSING_APP_SIGNING: true
           PROCESSING_APP_PASSWORD: ${{ secrets.PROCESSING_APP_PASSWORD }}
           PROCESSING_APPLE_ID: ${{ secrets.PROCESSING_APPLE_ID }}
           PROCESSING_TEAM_ID: ${{ secrets.PROCESSING_TEAM_ID }}

build/build.xml

@@ -787,7 +787,7 @@
     </exec>
   </target>
 
-  <target name="macos-dist-sign" if="env.PROCESSING_APP_PASSWORD">
+  <target name="macos-dist-sign" if="env.PROCESSING_APP_SIGNING">
     <echo>
       Code signing will only work if you have a $99/yr Apple developer ID.
     </echo>