feat: run codesign on macOS

.github/.cspell/project-dictionary.txt

@@ -3,3 +3,4 @@ gtar
 lipo
 mktemp
 zigbuild
+codesign

.github/workflows/ci.yml

@@ -82,3 +82,4 @@ jobs:
           tar: all
           zip: all
           manifest-path: test-crate/Cargo.toml
+          codesign: '-'

README.md

@@ -51,6 +51,7 @@ Currently, this action is basically intended to be used in combination with an a
 | manifest-path       | false        | Path to Cargo.toml                                                                           | String  | `Cargo.toml`   |
 | profile             | false        | The cargo profile to build. This defaults to the release profile.                            | String  | `release`      |
 | dry-run             | false        | Build and compress binaries, but do not upload them (see [action.yml](action.yml) for more)  | Boolean | `false`        |
+| codesign            | false        | Sign build products using `codesign` on macOS                                                | String  |                |
 
 \[1] Required one of `token` input option or `GITHUB_TOKEN` environment variable. Not required when `dry-run` input option is set to `true`.
 

action.yml

@@ -90,6 +90,9 @@ inputs:
     description: Alias for 'dry-run'
     required: false
     default: 'false'
+  codesign:
+    description: Sign build products using `codesign` on macOS
+    required: false
 
 # Note:
 # - inputs.* should be manually mapped to INPUT_* due to https://github.com/actions/runner/issues/665
@@ -117,3 +120,4 @@ runs:
         INPUT_REF: ${{ inputs.ref }}
         INPUT_PROFILE: ${{ inputs.profile }}
         INPUT_DRY_RUN: ${{ inputs.dry-run || inputs.dry_run }}
+        INPUT_CODESIGN: ${{ inputs.codesign }}

main.sh

@@ -303,6 +303,14 @@ do_strip() {
         done
     fi
 }
+do_codesign() {
+    target_dir="$1"
+    if [[ -n "${INPUT_CODESIGN:-}" ]]; then
+        for bin_exe in "${bins[@]}"; do
+            x codesign --sign "${INPUT_CODESIGN}" "${target_dir}/${bin_exe}"
+        done
+    fi
+}
 
 case "${INPUT_TARGET:-}" in
     '')
@@ -336,6 +344,10 @@ case "${INPUT_TARGET:-}" in
         ;;
 esac
 
+if command -v codesign &>/dev/null; then
+    do_codesign "${target_dir}"
+fi
+
 if [[ "${INPUT_TAR/all/${platform}}" == "${platform}" ]] || [[ "${INPUT_ZIP/all/${platform}}" == "${platform}" ]]; then
     cwd=$(pwd)
     tmpdir=$(mktemp -d)