Add notarization of MacOS binary to CI

kylecarbs · kylecarbs · commit a900f7c3cc29 · 2020-11-03T13:06:39.000-06:00
diff --git a/.github/workflows/build.yaml b/.github/workflows/build.yaml
@@ -7,6 +7,15 @@ jobs:
     steps:
       - name: Checkout
         uses: actions/checkout@v1
+      - name: Install Gon
+        run: |
+          brew tap mitchellh/gon
+          brew install mitchellh/gon/gon
+      - name: Import Signing Certificates
+        uses: Apple-Actions/import-codesign-certs@v1
+        with:
+          p12-file-base64: ${{ secrets.APPLE_DEVELOPER_CERTIFICATE_P12_BASE64 }}
+          p12-password: ${{ secrets.APPLE_DEVELOPER_CERTIFICATE_PASSWORD }}
       - name: Build
         run: ./ci/steps/build.sh
       - name: Upload
diff --git a/ci/gon.json b/ci/gon.json
@@ -0,0 +1,10 @@
+{
+    "source": ["./coder"],
+    "bundle_id": "com.coder.cli",
+    "sign": {
+        "application_identity": "3C4F31D15F9D57461A8D7D0BD970D23CE1F7C2BE"
+    },
+    "zip": {
+        "output_path": "coder.zip"
+    }
+}
diff --git a/ci/steps/build.sh b/ci/steps/build.sh
@@ -14,16 +14,26 @@ build() {
 
 	tmpdir=$(mktemp -d)
 	go build -ldflags "-X cdr.dev/coder-cli/internal/version.Version=${tag}" -o "$tmpdir/coder" ../../cmd/coder
+	# For MacOS builds to be notarized.
+	cp ../gon.json $tmpdir/gon.json
 
 	pushd "$tmpdir"
-	if [[ "$GOOS" == "windows" ]]; then
-		artifact="coder-cli-$GOOS-$GOARCH.zip"
-		mv coder coder.exe
-		zip "$artifact" coder.exe
-	else
-		artifact="coder-cli-$GOOS-$GOARCH.tar.gz"
-		tar -czf "$artifact" coder
-	fi
+	case "$GOOS" in
+		"windows")
+			artifact="coder-cli-$GOOS-$GOARCH.zip"
+			mv coder coder.exe
+			zip "$artifact" coder.exe
+			;;
+		"linux")
+			artifact="coder-cli-$GOOS-$GOARCH.tar.gz"
+			tar -czf "$artifact" coder	
+			;;
+		"darwin")
+			artifact="coder-cli-$GOOS-$GOARCH.zip"
+			gon -log-level debug ./gon.json
+			mv coder.zip $artifact
+			;;
+	esac
 	popd
 
 	mkdir -p ../bin
