apple-actions/import-codesign-certs

tonkeeper · Jan 24, 2024 · 3002168 · 3002168
1 parent 402d829
commit 3002168
Showing 1 changed file with 10 additions and 39 deletions.
diff --git a/.github/workflows/pull-request.yaml b/.github/workflows/pull-request.yaml
@@ -13,6 +13,12 @@ jobs:
 
         runs-on: ${{ matrix.os }}
         timeout-minutes: 30
+        env:
+            APPLE_API_KEY: ${{ github.workspace }}/AuthKey.p8
+            APPLE_API_KEY_ID: ${{ secrets.APPLE_API_KEY_ID }}
+            APPLE_API_ISSUER: ${{ secrets.APPLE_API_ISSUER }}
+            REACT_APP_AMPLITUDE: ${{ secrets.REACT_APP_AMPLITUDE }}
+            DEBUG: electron*
 
         steps:
             - name: Checkout to git repository
@@ -36,17 +42,10 @@ jobs:
 
             - name: Configure keychain
               if: runner.os == 'macOS'
-              env:
-                  IDENTITY_PASSPHRASE: ${{ secrets.IDENTITY_PASSPHRASE }}
-                  IDENTITY_P12_B64: ${{ secrets.IDENTITY_P12_B64 }}
-              run: |
-                  echo $IDENTITY_P12_B64 | base64 -d > DS_ID_App.p12
-                  security create-keychain -p $IDENTITY_PASSPHRASE build.keychain
-                  security unlock-keychain -p $IDENTITY_PASSPHRASE build.keychain
-                  security list-keychains -d user -s build.keychain
-                  security default-keychain -s build.keychain
-                  security import DS_ID_App.p12 -k build.keychain -P $IDENTITY_PASSPHRASE -A -T /usr/bin/codesign
-                  security set-key-partition-list -S apple-tool:,apple: -s -k $IDENTITY_PASSPHRASE build.keychain
+              uses: apple-actions/import-codesign-certs@v2
+              with:
+                  p12-file-base64: ${{ secrets.IDENTITY_P12_B64 }}
+                  p12-password: ${{ secrets.IDENTITY_PASSPHRASE }}
 
             - name: Run install
               uses: borales/actions-yarn@v4
@@ -60,37 +59,19 @@ jobs:
 
             - name: Run build intel distributive
               uses: borales/actions-yarn@v4
-              env:
-                  APPLE_API_KEY: ${{ github.workspace }}/AuthKey.p8
-                  APPLE_API_KEY_ID: ${{ secrets.APPLE_API_KEY_ID }}
-                  APPLE_API_ISSUER: ${{ secrets.APPLE_API_ISSUER }}
-                  REACT_APP_AMPLITUDE: ${{ secrets.REACT_APP_AMPLITUDE }}
-                  DEBUG: electron*
               with:
                   cmd: make:intel
                   dir: 'apps/desktop'
 
             - name: Run build arm distributive
               uses: borales/actions-yarn@v4
-              env:
-                  APPLE_API_KEY: ${{ github.workspace }}/AuthKey.p8
-                  APPLE_API_KEY_ID: ${{ secrets.APPLE_API_KEY_ID }}
-                  APPLE_API_ISSUER: ${{ secrets.APPLE_API_ISSUER }}
-                  REACT_APP_AMPLITUDE: ${{ secrets.REACT_APP_AMPLITUDE }}
-                  DEBUG: electron*
               with:
                   cmd: make:arm
                   dir: 'apps/desktop'
 
             - name: Run build universal distributive
               if: runner.os == 'macOS'
               uses: borales/actions-yarn@v4
-              env:
-                  APPLE_API_KEY: ${{ github.workspace }}/AuthKey.p8
-                  APPLE_API_KEY_ID: ${{ secrets.APPLE_API_KEY_ID }}
-                  APPLE_API_ISSUER: ${{ secrets.APPLE_API_ISSUER }}
-                  REACT_APP_AMPLITUDE: ${{ secrets.REACT_APP_AMPLITUDE }}
-                  DEBUG: electron*
               with:
                   cmd: make:universal
                   dir: 'apps/desktop'
@@ -104,15 +85,6 @@ jobs:
                   path: |
                       ${{ github.workspace }}/apps/desktop/out/make
 
-            - name: Upload distributives to artifacts
-              uses: actions/upload-artifact@v4
-              if: runner.os == 'Windows'
-              with:
-                  name: Tonkeeper Desktop ${{ runner.os }} arm64
-                  retention-days: 10
-                  path: |
-                      ${{ github.workspace }}/apps/desktop/out/make/squirrel.windows/arm64
-
             - name: Upload distributives to artifacts
               uses: actions/upload-artifact@v4
               if: runner.os == 'Windows'
@@ -143,7 +115,6 @@ jobs:
             - name: Clean-up credentials
               if: always() && runner.os == 'macOS'
               run: |
-                  security delete-keychain build.keychain
                   rm ${{ github.workspace }}/AuthKey.p8
 
     web-build: