ci: explicit code signing without default tauri action?

Author: 0xbrayo

.github/workflows/release.yml

@@ -3,11 +3,11 @@ name: Release
 on:
   push:
     tags:
-      - 'v*'
+      - "v*"
   workflow_dispatch:
     inputs:
       sign:
-        description: 'Enable code signing'
+        description: "Enable code signing"
         required: false
         default: false
         type: boolean
@@ -20,15 +20,15 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - platform: 'macos-latest'
-            args: '--target aarch64-apple-darwin'
-            arch: 'aarch64'
+          - platform: "macos-latest"
+            args: "--target aarch64-apple-darwin"
+            arch: "aarch64"
           # - platform: 'macos-latest'
           #   args: '--target x86_64-apple-darwin'
           #   arch: 'x86_64'
-          - platform: 'ubuntu-24.04'
-            args: ''
-            arch: 'x86_64'
+          - platform: "ubuntu-24.04"
+            args: ""
+            arch: "x86_64"
 
     runs-on: ${{ matrix.platform }}
 
@@ -53,18 +53,18 @@ jobs:
       - name: Rust cache
         uses: swatinem/rust-cache@v2
         with:
-          workspaces: './src-tauri -> target'
+          workspaces: "./src-tauri -> target"
 
       - name: Setup Node.js
         uses: actions/setup-node@v4
         with:
-          node-version: 'lts/*'
-          cache: 'npm'
+          node-version: "lts/*"
+          cache: "npm"
 
       - name: Setup Python
         uses: actions/setup-python@v5
         with:
-          python-version: '3.11'
+          python-version: "3.11"
 
       - name: Setup Python cache
         uses: actions/cache@v4
@@ -138,18 +138,101 @@ jobs:
           codesign --force -s "$APPLE_SIGNING_IDENTITY" --keychain build.keychain --deep "$SIDECAR_PATH"
           echo "Sidecar binary signed successfully"
 
-      - name: Build the app
-        uses: tauri-apps/tauri-action@v0
+      - name: Build the app (macOS)
+        if: matrix.platform == 'macos-latest'
+        env:
+          APPLE_SIGNING_IDENTITY: ${{ env.APPLE_SIGNING_IDENTITY }}
+        run: |
+          echo "Building macOS app with make build..."
+          make build
+
+      - name: Sign macOS app and create DMG
+        if: matrix.platform == 'macos-latest' && (startsWith(github.ref, 'refs/tags/') || github.event.inputs.sign == 'true')
         env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          # macOS signing
-          APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }}
-          APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
           APPLE_SIGNING_IDENTITY: ${{ env.APPLE_SIGNING_IDENTITY }}
-          # macOS notarization (optional)
+          APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
+        run: |
+          if [ -z "$APPLE_SIGNING_IDENTITY" ]; then
+            echo "Warning: Apple signing identity not available. Skipping app signing."
+            exit 0
+          fi
+
+          APP_PATH="src-tauri/target/release/bundle/macos/gptme-tauri.app"
+          DMG_PATH="src-tauri/target/release/bundle/dmg/gptme-tauri_${{ matrix.arch }}.dmg"
+
+          echo "Signing app bundle at $APP_PATH"
+          # Sign app bundle with deep signing
+          codesign --force -s "$APPLE_SIGNING_IDENTITY" --keychain build.keychain --deep --options runtime "$APP_PATH"
+
+          # Verify signature
+          codesign --verify --verbose "$APP_PATH"
+
+          echo "Creating DMG file"
+          # Create DMG using create-dmg tool
+          npm install -g create-dmg
+          create-dmg \
+            --volname "gptme-tauri" \
+            --volicon "src-tauri/icons/icon.icns" \
+            --window-pos 200 120 \
+            --window-size 600 300 \
+            --icon "gptme-tauri.app" 125 150 \
+            --app-drop-link 425 150 \
+            --codesign "$APPLE_SIGNING_IDENTITY" \
+            "$DMG_PATH" \
+            "$APP_PATH"
+
+          echo "Signing DMG file"
+          codesign --force -s "$APPLE_SIGNING_IDENTITY" --keychain build.keychain "$DMG_PATH"
+
+          echo "App and DMG signed successfully"
+
+      - name: Notarize macOS app (optional)
+        if: matrix.platform == 'macos-latest' && (startsWith(github.ref, 'refs/tags/') || github.event.inputs.sign == 'true')
+        env:
           APPLE_ID: ${{ secrets.APPLE_ID }}
           APPLE_ID_PASSWORD: ${{ secrets.APPLE_ID_PASSWORD }}
           APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
+        run: |
+          if [ -z "$APPLE_ID" ] || [ -z "$APPLE_ID_PASSWORD" ] || [ -z "$APPLE_TEAM_ID" ]; then
+            echo "Warning: Apple notarization credentials not available. Skipping notarization."
+            exit 0
+          fi
+
+          DMG_PATH="src-tauri/target/release/bundle/dmg/gptme-tauri_${{ matrix.arch }}.dmg"
+
+          echo "Uploading DMG for notarization"
+          xcrun notarytool submit "$DMG_PATH" \
+            --apple-id "$APPLE_ID" \
+            --password "$APPLE_ID_PASSWORD" \
+            --team-id "$APPLE_TEAM_ID" \
+            --wait
+
+          echo "Stapling notarization ticket to DMG"
+          xcrun stapler staple "$DMG_PATH"
+
+          echo "Notarization complete"
+
+      - name: Upload macOS binaries to release
+        if: matrix.platform == 'macos-latest' && startsWith(github.ref, 'refs/tags/')
+        uses: softprops/action-gh-release@v1
+        with:
+          files: |
+            src-tauri/target/release/bundle/macos/gptme-tauri.app
+            src-tauri/target/release/bundle/dmg/gptme-tauri_${{ matrix.arch }}.dmg
+          tag_name: ${{ github.ref_name }}
+          name: gptme-tauri ${{ github.ref_name }}
+          body: See the assets to download and install this version.
+          draft: true
+          prerelease: false
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+      # Use the normal Tauri action for non-macOS platforms
+      - name: Build and release for non-macOS platforms
+        if: matrix.platform != 'macos-latest'
+        uses: tauri-apps/tauri-action@v0
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         with:
           tagName: ${{ startsWith(github.ref, 'refs/tags/') && github.ref_name || '' }}
           releaseName: ${{ startsWith(github.ref, 'refs/tags/') && 'gptme-tauri v__VERSION__' || '' }}