ci: macOS code signing and notarization (#4)

Author: bosiakov

.github/workflows/build_macos.yml

@@ -10,6 +10,7 @@ permissions:
 jobs:
   build:
     runs-on: macos-latest
+    environment: Sign Executables
 
     steps:
       - name: Checkout repo
@@ -23,18 +24,42 @@ jobs:
       - name: Install gogio tool
         run: make install_deps
 
-      - name: Install create-dmg tool
-        run: brew install create-dmg
+      - name: Install create-dmg and librsvg tools
+        run: brew install create-dmg librsvg
 
       - name: Generate macOS icon
         run: |
-          chmod +x ./assets/png_to_icns.sh
-          ./assets/png_to_icns.sh
+          chmod +x ./assets/svg_to_icns.sh
+          ./assets/svg_to_icns.sh
 
-      - name: Build macos disk images
+      - name: Import signing certificate
+        env:
+          CERTIFICATE_P12_BASE64: ${{ secrets.CERTIFICATE_P12_BASE64 }}
+          CERTIFICATE_PASSWORD: ${{ secrets.CERTIFICATE_PASSWORD }}
+        run: |
+          CERTIFICATE_PATH=$RUNNER_TEMP/certificate.p12
+          KEYCHAIN_PATH=$RUNNER_TEMP/app-signing.keychain-db
+          KEYCHAIN_PASSWORD=$(openssl rand -base64 32)
+
+          echo -n "$CERTIFICATE_P12_BASE64" | base64 --decode -o $CERTIFICATE_PATH
+
+          security create-keychain -p "$KEYCHAIN_PASSWORD" $KEYCHAIN_PATH
+          security set-keychain-settings -lut 21600 $KEYCHAIN_PATH
+          security unlock-keychain -p "$KEYCHAIN_PASSWORD" $KEYCHAIN_PATH
+          security import $CERTIFICATE_PATH -P "$CERTIFICATE_PASSWORD" -A -t cert -f pkcs12 -k $KEYCHAIN_PATH
+          security set-key-partition-list -S apple-tool:,apple: -k "$KEYCHAIN_PASSWORD" $KEYCHAIN_PATH
+          security list-keychains -d user -s $KEYCHAIN_PATH login.keychain-db
+
+      - name: Build and sign macOS app
         run: |
-          make build_macos_app
+          make build_macos_signed
+          make notarize_macos
           make build_macos_dmg
+        env:
+          APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
+          IDENTITY: ${{ secrets.IDENTITY }}
+          APPLE_ID: ${{ secrets.APPLE_ID }}
+          APPLE_APP_SPECIFIC_PASSWORD: ${{ secrets.APPLE_APP_SPECIFIC_PASSWORD }}
 
       - name: Upload Release Asset
         run: |

assets/appicon.icns

@@ -0,0 +1,47 @@
+#!/bin/bash
+# png_to_icns.sh - Generate macOS .icns icon from an SVG source
+#
+# Usage: ./png_to_icns.sh [input.svg] [output.icns]
+#   Defaults: input = ./assets/appicon.svg, output = ./assets/appicon.icns
+#
+# Requires: rsvg-convert (brew install librsvg), iconutil
+
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
+INPUT="${1:-$SCRIPT_DIR/appicon.svg}"
+OUTPUT="${2:-$SCRIPT_DIR/appicon.icns}"
+
+if [ ! -f "$INPUT" ]; then
+  echo "ERROR: Source SVG not found at $INPUT"
+  exit 1
+fi
+
+for cmd in rsvg-convert iconutil; do
+  if ! command -v "$cmd" &>/dev/null; then
+    echo "ERROR: Required tool '$cmd' is not installed"
+    echo "  brew install librsvg"
+    exit 1
+  fi
+done
+
+ICONSET=$(mktemp -d)/appicon.iconset
+mkdir -p "$ICONSET"
+
+cleanup() {
+  rm -rf "$(dirname "$ICONSET")"
+}
+trap cleanup EXIT
+
+# Standard sizes: 16, 32, 128, 256, 512 at 1x and 2x
+SIZES=(16 32 128 256 512)
+
+for size in "${SIZES[@]}"; do
+  double=$((size * 2))
+  rsvg-convert -w "$size" -h "$size" "$INPUT" -o "$ICONSET/icon_${size}x${size}.png"
+  rsvg-convert -w "$double" -h "$double" "$INPUT" -o "$ICONSET/icon_${size}x${size}@2x.png"
+done
+
+iconutil -c icns "$ICONSET" -o "$OUTPUT"
+
+echo "Created $OUTPUT"