diff --git a/.github/workflows/_build-macos.yml b/.github/workflows/_build-macos.yml index 5ee98763..cbbb44ca 100644 --- a/.github/workflows/_build-macos.yml +++ b/.github/workflows/_build-macos.yml @@ -235,27 +235,34 @@ jobs: security find-identity -v -p codesigning "$KEYCHAIN_PATH" + SIGN_IDENTITY=$(security find-identity -v -p codesigning "$KEYCHAIN_PATH" \ + | sed -n 's/^[[:space:]]*1)[[:space:]]*[0-9A-F]*[[:space:]]*"\(.*\)"$/\1/p') + if [ -z "$SIGN_IDENTITY" ]; then + echo "ERROR: no codesigning identity found in the imported keychain" + exit 1 + fi + echo "Signing identity: $SIGN_IDENTITY" + echo "SIGN_IDENTITY=$SIGN_IDENTITY" >> $GITHUB_ENV + - name: Sign Application - env: - APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }} run: | APP_BUNDLE="build/QK4.app" echo "=== Signing frameworks and libraries ===" find "$APP_BUNDLE/Contents/Frameworks" -name "*.dylib" -exec \ - codesign --force --options runtime --sign "Developer ID Application: Michael Richard Garcia ($APPLE_TEAM_ID)" {} \; + codesign --force --options runtime --sign "$SIGN_IDENTITY" {} \; find "$APP_BUNDLE/Contents/Frameworks" -name "*.framework" -exec \ - codesign --force --options runtime --sign "Developer ID Application: Michael Richard Garcia ($APPLE_TEAM_ID)" {} \; + codesign --force --options runtime --sign "$SIGN_IDENTITY" {} \; echo "=== Signing PlugIns ===" find "$APP_BUNDLE/Contents/PlugIns" -name "*.dylib" -exec \ - codesign --force --options runtime --sign "Developer ID Application: Michael Richard Garcia ($APPLE_TEAM_ID)" {} \; + codesign --force --options runtime --sign "$SIGN_IDENTITY" {} \; echo "=== Signing main application with entitlements ===" codesign --force --options runtime \ --entitlements "resources/QK4.entitlements" \ - --sign "Developer ID Application: Michael Richard Garcia ($APPLE_TEAM_ID)" \ + --sign "$SIGN_IDENTITY" \ "$APP_BUNDLE" codesign --verify --verbose=2 "$APP_BUNDLE" @@ -263,7 +270,6 @@ jobs: - name: Create and Notarize DMG env: - APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }} APPLE_API_KEY_ID: ${{ secrets.APPLE_API_KEY_ID }} APPLE_API_ISSUER_ID: ${{ secrets.APPLE_API_ISSUER_ID }} APPLE_API_KEY_BASE64: ${{ secrets.APPLE_API_KEY_BASE64 }} @@ -295,7 +301,7 @@ jobs: test -f "QK4-unsigned.dmg" || { echo "DMG creation failed after 3 attempts"; exit 1; } echo "=== Signing DMG ===" - codesign --force --sign "Developer ID Application: Michael Richard Garcia ($APPLE_TEAM_ID)" \ + codesign --force --sign "$SIGN_IDENTITY" \ "QK4-unsigned.dmg" mv "QK4-unsigned.dmg" "$DMG_NAME"