fix codesign for windows and macos

[DaMandal0rian]

This PR:

• upgrades the skymatic/code-sign-action to v2.0.1 to support x64 arch and newer windows sdk build versions.
• checks if macOS keychain exists already on the host OS and if not will create it.
• Use new macOS signing / notarization since altool is deprecated and will be removed in later 2023.

[nazar-pc]

Updating action for Windows signing makes sense, no concerns there.

[nazar-pc]

This must not be necessary or else we might leak some keys from one workflow to another. There must be some state sharing here that causes an issue that is not present in GitHub's runners and thus needs to be fixed.

[DaMandal0rian]

I checked the runner and the keychain already exists on the machine, hence why the error "the keychain exists already". What do you propose to do to solve this? What about Apple-Actions/import-codesign-certs#8 (comment) ?

[nazar-pc]

I'm fairly certain it exists because of the command that was ran earlier. I don't know how runners work, but it is expected that every time we have a clean environment with no key chains and nothing in them. Maybe previous workflow run created it, but then something must ensure it doesn't exists anymore after it is over or else, as mentioned above, we're leaking keys.

And we need to check the same for Windows. It may not complain, but keys might still be left in there.

[DaMandal0rian]

The cleanup script should wipe this now after each run for macOS; for windows, it stores it in the path where jobs are ran and cleaned up, so should be fine.

[nazar-pc]

Just triggered here: https://github.com/subspace/subspace-cli/actions/runs/5672898609
Let's see how it goes.

[nazar-pc]

Nope, release CI failed

[nazar-pc]

Makes sense overall. Can you also replace github.github.repository_owner with github.repository_owner in workflows now (it was a typo and the reason why CI was passing before even if signing was failing).

[nazar-pc]

This is great, thanks!
Was CI not triggered here because only workflow file has changed?

[DaMandal0rian]

This is great, thanks! Was CI not triggered here because only workflow file has changed?

it was triggered but I just cancelled the running, will work on converting it to using homebrew for installation.

[nazar-pc]

it was triggered but I just cancelled the running, will work on converting it to using homebrew for installation.

I mean I don't see testing/lining in this PR in list of checks. If they were cancelled, it'd show something that failed/was cancelled, but it shows one expected and nothing else.