Have OpenCOR digitally signed

.github/workflows/cd.yml

@@ -1,8 +1,6 @@
 name: CD
 
 on:
-  push:
-    branches: [main]
   release:
     types: [created]
   workflow_dispatch:
@@ -23,9 +21,38 @@ jobs:
             os: macos-13
           - name: macOS (ARM)
             os: macos-latest
+    env:
+      APPLE_ID: ${{ secrets.APPLE_ID }}
+      APPLE_APP_SPECIFIC_PASSWORD: ${{ secrets.APPLE_APP_SPECIFIC_PASSWORD }}
+      APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
+      WINDOWS_CSC_LINK: EVCertificate.pfx
+      WINDOWS_CSC_KEY_PASSWORD: ${{ secrets.EV_CERTIFICATE_PASSWORD }}
+      EV_CERTIFICATE_BASE64: ${{ secrets.EV_CERTIFICATE_BASE64 }}
+      MACOS_CSC_LINK: DeveloperIDApplication.p12
+      MACOS_CSC_KEY_PASSWORD: ${{ secrets.DEVELOPER_ID_APPLICATION_CERTIFICATE_PASSWORD }}
+      DEVELOPER_ID_APPLICATION_CERTIFICATE_BASE64: ${{ secrets.DEVELOPER_ID_APPLICATION_CERTIFICATE_BASE64 }}
     steps:
+      - name: Set the timezone to New Zealand
+        uses: szenius/set-timezone@v2.0
+        with:
+          timezoneWindows: 'New Zealand Standard Time'
+          timezoneLinux: 'Pacific/Auckland'
+          timezoneMacos: 'Pacific/Auckland'
       - name: Check out OpenCOR
         uses: actions/checkout@v4
+      - name: Retrieve the EV certificate (Windows only)
+        if: matrix.name == 'Windows'
+        shell: bash
+        run: |
+          echo "CSC_LINK=$(echo $WINDOWS_CSC_LINK)" >> $GITHUB_ENV
+          echo "CSC_KEY_PASSWORD=$(echo $WINDOWS_CSC_KEY_PASSWORD)" >> $GITHUB_ENV
+          echo -n $EV_CERTIFICATE_BASE64 | base64 -d > $WINDOWS_CSC_LINK
+      - name: Import the ABI Developer ID Application certificates (macOS only)
+        if: matrix.name == 'macOS (Intel)' || matrix.name == 'macOS (ARM)'
+        run: |
+          echo "CSC_LINK=$(echo $MACOS_CSC_LINK)" >> $GITHUB_ENV
+          echo "CSC_KEY_PASSWORD=$(echo $MACOS_CSC_KEY_PASSWORD)" >> $GITHUB_ENV
+          echo -n $DEVELOPER_ID_APPLICATION_CERTIFICATE_BASE64 | base64 -d > $MACOS_CSC_LINK
       - name: Install Node.js
         uses: actions/setup-node@v4
         with:

electron-builder.yml

@@ -16,6 +16,15 @@ linux:
     - deb
     - tar.gz
 mac:
+  # - Code signing:
+  #    - Generate a “Developer ID Application” certificate (this can only be done by the team’s account holder; see https://developer.apple.com/help/account/create-certificates/create-developer-id-certificates).
+  #    - For the certificate to be usable by other team members, the account holder must generate (and then share) a `.p12` file and its corresponding password:
+  #       - Double click on the `.cer` file (this will add the certificate to the `My Certificates` section of the `login` keychain).
+  #       - Export the certificate (by right clicking on it) and give it a password.
+  # - Notarisation:
+  #    - APPLE_ID: the team member’s email address used to login to https://account.apple.com/.
+  #    - APPLE_APP_SPECIFIC_PASSWORD: a password the team member generated using the App-Specific Passwords tool at https://account.apple.com/account/manage.
+  #    - APPLE_TEAM_ID: an id that can be found in the top right corner of https://developer.apple.com/account/resources/certificates/list.
   artifactName: ${productName}-${version}-macOS-${arch}.${ext}
   target:
     - dmg