Test logic changes for signing

2026-02-07 12:13:45 +00:00 · 2025-06-12 10:12:25 -04:00
parent 51ca4869a6
commit 57bc1de729
1 changed files with 29 additions and 48 deletions
--- a/.github/workflows/build-cli.yml
+++ b/.github/workflows/build-cli.yml
@@ -47,7 +47,7 @@ defaults:
 jobs:
  setup:
    name: Setup
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-24.04
    outputs:
      package_version: ${{ steps.retrieve-package-version.outputs.package_version }}
      node_version: ${{ steps.retrieve-node-version.outputs.node_version }}
@@ -56,7 +56,7 @@ jobs:
      - name: Check out repo
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
-          ref: ${{  github.event.pull_request.head.sha }}
+          ref: ${{ github.event.pull_request.head.sha }}

      - name: Get Package Version
        id: retrieve-package-version
@@ -80,25 +80,25 @@ jobs:
          has_secrets=${{ secrets.AZURE_KV_CI_SERVICE_PRINCIPAL != '' }}
          echo "has_secrets=$has_secrets" >> $GITHUB_OUTPUT

+
  cli:
    name: CLI ${{ matrix.os.base }}${{ matrix.os.target_suffix }} - ${{ matrix.license_type.readable }}
    strategy:
      matrix:
        os:
-         [
-          { base: "linux", distro: "ubuntu-22.04", target_suffix: "" },
-          { base: "linux", distro: "ubuntu-22.04-arm", target_suffix: "-arm64" },
-          { base: "mac", distro: "macos-13", target_suffix: "" },
-          { base: "mac", distro: "macos-14", target_suffix: "-arm64" }
-         ]
+          [
+            { base: "linux", distro: "ubuntu-22.04", target_suffix: "" },
+            { base: "linux", distro: "ubuntu-22.04-arm", target_suffix: "-arm64" },
+            { base: "mac", distro: "macos-13", target_suffix: "" },
+            { base: "mac", distro: "macos-14", target_suffix: "-arm64" }
+          ]
        license_type:
          [
            { build_prefix: "oss", artifact_prefix: "-oss", readable: "open source license" },
            { build_prefix: "bit", artifact_prefix: "", readable: "commercial license" }
          ]
    runs-on: ${{ matrix.os.distro }}
-    needs:
-      - setup
+    needs: setup
    env:
      _PACKAGE_VERSION: ${{ needs.setup.outputs.package_version }}
      _NODE_VERSION: ${{ needs.setup.outputs.node_version }}
@@ -108,7 +108,7 @@ jobs:
      - name: Check out repo
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
-          ref: ${{  github.event.pull_request.head.sha }}
+          ref: ${{ github.event.pull_request.head.sha }}

      - name: Setup Unix Vars
        run: |
@@ -156,19 +156,8 @@ jobs:
        with:
          creds: ${{ secrets.AZURE_KV_CI_SERVICE_PRINCIPAL }}

-      - name: Retrieve secrets
-        if: ${{ matrix.os.base == 'mac' && needs.setup.outputs.has_secrets == 'true' }}
-        id: retrieve-secrets-macos
-        uses: bitwarden/gh-actions/get-keyvault-secrets@main
-        with:
-          keyvault: "bitwarden-ci"
-          secrets: "macos-bws-notarization-apple-id,
-            macos-bws-notarization-team-id,
-            macos-bws-notarization-password,
-            macos-bws-certificate-name,
-            macos-bws-installer-certificate-name"
-
      - name: Get certificates
+        if: ${{ matrix.os.base == 'mac' && needs.setup.outputs.has_secrets == 'true' }}
        run: |
          mkdir -p $HOME/certificates

@@ -179,7 +168,6 @@ jobs:
        if: ${{ matrix.os.base == 'mac' && needs.setup.outputs.has_secrets == 'true' }}
        env:
          KEYCHAIN_PASSWORD: ${{ secrets.KEYCHAIN_PASSWORD }}
-          DEVID_CERT_PASSWORD: ${{ secrets.DEVID_CERT_PASSWORD }}
        run: |
          security create-keychain -p $KEYCHAIN_PASSWORD build.keychain
          security default-keychain -s build.keychain
@@ -194,7 +182,7 @@ jobs:
      - name: Sign binary
        if: ${{ matrix.os.base == 'mac' && needs.setup.outputs.has_secrets == 'true' }}
        env:
-          MACOS_CERTIFICATE_NAME: ${{ steps.retrieve-secrets-macos.outputs.macos-bws-certificate-name }}
+          MACOS_CERTIFICATE_NAME: "Developer ID Application: 8bit Solutions LLC"
        run: codesign --sign "$MACOS_CERTIFICATE_NAME" --verbose=3 --force --options=runtime --timestamp ./dist/${{ matrix.license_type.build_prefix }}/${{ env.LOWER_RUNNER_OS }}${{ matrix.os.target_suffix }}/bw

      - name: Zip Unix
@@ -202,19 +190,26 @@ jobs:
          cd ./dist/${{ matrix.license_type.build_prefix }}/${{ env.LOWER_RUNNER_OS }}${{ matrix.os.target_suffix }}
          zip ../../bw${{ matrix.license_type.artifact_prefix }}-${{ env.LOWER_RUNNER_OS }}${{ matrix.os.target_suffix }}-${{ env._PACKAGE_VERSION }}.zip ./bw

+      - name: Set up private auth key
+        if: ${{ matrix.os.base == 'mac' && needs.setup.outputs.has_secrets == 'true' }}
+        run: |
+          mkdir ~/private_keys
+          cat << EOF > ~/private_keys/AuthKey_6TV9MKN3GP.p8
+          ${{ secrets.APP_STORE_CONNECT_AUTH_KEY }}
+          EOF
+
      - name: Notarize app
        if: ${{ matrix.os.base == 'mac' && needs.setup.outputs.has_secrets == 'true' }}
        env:
-          MACOS_NOTARIZATION_APPLE_ID: ${{ steps.retrieve-secrets-macos.outputs.macos-bws-notarization-apple-id }}
-          MACOS_NOTARIZATION_TEAM_ID: ${{ steps.retrieve-secrets-macos.outputs.macos-bws-notarization-team-id }}
-          MACOS_NOTARIZATION_PWD: ${{ steps.retrieve-secrets-macos.outputs.macos-bws-notarization-password }}
-          MACOS_CERTIFICATE_NAME: ${{ steps.retrieve-secrets-macos.outputs.macos-bws-certificate-name }}
+          APP_STORE_CONNECT_TEAM_ID: LTZ2PFU5D6
+          APP_STORE_CONNECT_TEAM_ISSUER: ${{ secrets.APP_STORE_CONNECT_TEAM_ISSUER }}
+          APP_STORE_CONNECT_AUTH_KEY: 6TV9MKN3GP
+          APP_STORE_CONNECT_AUTH_KEY_PATH: ~/private_keys/AuthKey_6TV9MKN3GP.p8
        run: |
-
          echo "Create keychain profile"
-          xcrun notarytool store-credentials "notarytool-profile" --apple-id "$MACOS_NOTARIZATION_APPLE_ID" --team-id "$MACOS_NOTARIZATION_TEAM_ID" --password "$MACOS_NOTARIZATION_PWD"
+          xcrun notarytool store-credentials "notarytool-profile" --key-id "$APP_STORE_CONNECT_AUTH_KEY" --key "$APP_STORE_CONNECT_AUTH_KEY_PATH" --issuer "$APP_STORE_CONNECT_TEAM_ISSUER" --team-id "$APP_STORE_CONNECT_TEAM_ID"

-          codesign --sign "$MACOS_CERTIFICATE_NAME" --verbose=3 --force --options=runtime --timestamp ./dist/bw${{ matrix.license_type.artifact_prefix }}-${{ env.LOWER_RUNNER_OS }}${{ matrix.os.target_suffix }}-${{ env._PACKAGE_VERSION }}.zip
+          codesign --sign "Developer ID Application: 8bit Solutions LLC" --verbose=3 --force --options=runtime --timestamp ./dist/bw${{ matrix.license_type.artifact_prefix }}-${{ env.LOWER_RUNNER_OS }}${{ matrix.os.target_suffix }}-${{ env._PACKAGE_VERSION }}.zip

          echo "Notarize app"
          xcrun notarytool submit ./dist/bw${{ matrix.license_type.artifact_prefix }}-${{ env.LOWER_RUNNER_OS }}${{ matrix.os.target_suffix }}-${{ env._PACKAGE_VERSION }}.zip --keychain-profile "notarytool-profile" --wait
@@ -230,13 +225,6 @@ jobs:
            exit 1
          fi

-      - name: Create checksums Unix
-        run: |
-          cd ./dist
-          shasum -a 256 bw${{ matrix.license_type.artifact_prefix }}-${{ env.LOWER_RUNNER_OS }}${{ matrix.os.target_suffix }}-${{ env._PACKAGE_VERSION }}.zip \
-            | awk '{split($0, a); print a[1]}' > bw${{
-          matrix.license_type.artifact_prefix }}-${{ env.LOWER_RUNNER_OS }}${{ matrix.os.target_suffix }}-sha256-${{ env._PACKAGE_VERSION }}.txt
-
      - name: Upload unix zip asset
        uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08 # v4.6.0
        with:
@@ -244,12 +232,6 @@ jobs:
          path: apps/cli/dist/bw${{ matrix.license_type.artifact_prefix }}-${{ env.LOWER_RUNNER_OS }}${{ matrix.os.target_suffix }}-${{ env._PACKAGE_VERSION }}.zip
          if-no-files-found: error

-      - name: Upload unix checksum asset
-        uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08 # v4.6.0
-        with:
-          name: bw${{ matrix.license_type.artifact_prefix }}-${{ env.LOWER_RUNNER_OS }}${{ matrix.os.target_suffix }}-sha256-${{ env._PACKAGE_VERSION }}.txt
-          path: apps/cli/dist/bw${{ matrix.license_type.artifact_prefix }}-${{ env.LOWER_RUNNER_OS }}${{ matrix.os.target_suffix }}-sha256-${{ env._PACKAGE_VERSION }}.txt
-          if-no-files-found: error

  cli-windows:
    name: Windows - ${{ matrix.license_type.readable }}
@@ -261,8 +243,7 @@ jobs:
            { build_prefix: "bit", artifact_prefix: "", readable: "commercial license" }
          ]
    runs-on: windows-2022
-    needs:
-      - setup
+    needs: setup
    env:
      _PACKAGE_VERSION: ${{ needs.setup.outputs.package_version }}
      _NODE_VERSION: ${{ needs.setup.outputs.node_version }}
@@ -546,7 +527,7 @@ jobs:
  check-failures:
    name: Check for failures
    if: always()
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-24.04
    needs:
      - setup
      - cli