fix: disable auto-notarization and manually sign all binaries #45
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Build and Release Tauri App | |
| on: | |
| push: | |
| branches: | |
| - main | |
| workflow_dispatch: | |
| inputs: | |
| tag: | |
| description: 'Version tag (e.g., v0.3.0)' | |
| required: false | |
| type: string | |
| env: | |
| NODE_VERSION: '20' | |
| RUST_VERSION: 'stable' | |
| LUMIS_REPO: 'melandlabs/lumis' | |
| jobs: | |
| get-version: | |
| runs-on: ubuntu-latest | |
| outputs: | |
| version: ${{ steps.version.outputs.version }} | |
| checkout_ref: ${{ steps.version.outputs.checkout_ref }} | |
| steps: | |
| - id: version | |
| run: | | |
| if [ "${{ github.event.inputs.tag }}" != "" ]; then | |
| echo "version=${{ github.event.inputs.tag }}" >> $GITHUB_OUTPUT | |
| echo "checkout_ref=refs/tags/${{ github.event.inputs.tag }}" >> $GITHUB_OUTPUT | |
| else | |
| echo "version=0.0.0-test" >> $GITHUB_OUTPUT | |
| echo "checkout_ref=refs/heads/main" >> $GITHUB_OUTPUT | |
| fi | |
| build-tauri-macos: | |
| needs: get-version | |
| if: needs.get-version.outputs.version != '' | |
| runs-on: macos-latest | |
| steps: | |
| - name: Checkout release repo | |
| uses: actions/checkout@v4 | |
| - name: Clone lumis source code | |
| run: | | |
| git clone https://x-access-token:${{ secrets.LUMIS_TOKEN }}@github.com/${{ env.LUMIS_REPO }}.git lumis | |
| cd lumis | |
| git checkout ${{ needs.get-version.outputs.checkout_ref }} | |
| - name: Setup Node.js | |
| uses: actions/setup-node@v4 | |
| with: | |
| node-version: ${{ env.NODE_VERSION }} | |
| - name: Install pnpm | |
| uses: pnpm/action-setup@v2 | |
| with: | |
| version: 9 | |
| - name: Add pnpm to PATH | |
| run: | | |
| echo "$HOME/.local/bin" >> $GITHUB_PATH | |
| echo "PNPM_HOME=$HOME/.local" >> $GITHUB_ENV | |
| - name: Setup Python | |
| uses: actions/setup-python@v5 | |
| with: | |
| python-version: '3.12' | |
| - name: Setup Rust | |
| uses: dtolnay/rust-toolchain@stable | |
| with: | |
| toolchain: ${{ env.RUST_VERSION }} | |
| - name: Install Rust targets | |
| run: | | |
| rustup target add aarch64-apple-darwin | |
| rustup target add x86_64-apple-darwin | |
| - name: Get pnpm store directory | |
| run: | | |
| echo "STORE_PATH=$(pnpm store path --silent)" >> $GITHUB_ENV | |
| - name: Setup pnpm cache | |
| uses: actions/cache@v3 | |
| with: | |
| path: ${{ env.STORE_PATH }} | |
| key: ${{ runner.os }}-pnpm-store-${{ hashFiles('lumis/**/pnpm-lock.yaml') }} | |
| restore-keys: | | |
| ${{ runner.os }}-pnpm-store- | |
| - name: Install dependencies | |
| working-directory: ./lumis | |
| run: pnpm install --frozen-lockfile --ignore-scripts | |
| - name: Rebuild native modules for Tauri | |
| working-directory: ./lumis | |
| run: | | |
| pnpm rebuild better-sqlite3 | |
| cd node_modules/@photon-ai/imessage-kit && pnpm rebuild | |
| - name: Create .env file | |
| working-directory: ./lumis/apps/web | |
| run: | | |
| cp .env.example .env | |
| # Remove POSTGRES_URL to skip database migration in CI | |
| grep -v '^POSTGRES_URL=' .env > .env.tmp && mv .env.tmp .env | |
| - name: Import Apple Certificate and Intermediate Certificates | |
| env: | |
| APPLE_CERTIFICATE: "${{ secrets.APPLE_CERTIFICATE }}" | |
| APPLE_CERTIFICATE_PASSWORD: "${{ secrets.APPLE_CERTIFICATE_PASSWORD }}" | |
| run: | | |
| # Create a new keychain | |
| KEYCHAIN_PATH=$RUNNER_TEMP/app-signing.keychain-db | |
| security create-keychain -p "" $KEYCHAIN_PATH | |
| security set-keychain-settings -lut 21600 $KEYCHAIN_PATH | |
| security unlock-keychain -p "" $KEYCHAIN_PATH | |
| # Import the Apple certificate | |
| echo "$APPLE_CERTIFICATE" | base64 --decode > cert.p12 | |
| security import cert.p12 -P "$APPLE_CERTIFICATE_PASSWORD" -A -k $KEYCHAIN_PATH | |
| rm cert.p12 | |
| # Download and import Apple intermediate certificates (not available in CI) | |
| curl -s -o /tmp/AppleWWDRCAG3.cer https://www.apple.com/certificateauthority/AppleWWDRCAG3.cer | |
| curl -s -o /tmp/DeveloperIDG2CA.cer https://www.apple.com/certificateauthority/DeveloperIDG2CA.cer | |
| security import /tmp/AppleWWDRCAG3.cer -A -k $KEYCHAIN_PATH | |
| security import /tmp/DeveloperIDG2CA.cer -A -k $KEYCHAIN_PATH | |
| # List keychains to ensure system can access certificates | |
| security list-keychain -d user -s $KEYCHAIN_PATH | |
| - name: Build Tauri app (Apple Silicon) without notarization | |
| working-directory: ./lumis/apps/web | |
| run: pnpm tauri:build | |
| env: | |
| APPLE_CERTIFICATE: "${{ secrets.APPLE_CERTIFICATE }}" | |
| APPLE_CERTIFICATE_PASSWORD: "${{ secrets.APPLE_CERTIFICATE_PASSWORD }}" | |
| APPLE_SIGNING_IDENTITY: "${{ secrets.APPLE_SIGNING_IDENTITY }}" | |
| APPLE_ID: "${{ secrets.APPLE_ID }}" | |
| APPLE_PASSWORD: "${{ secrets.APPLE_PASSWORD }}" | |
| APPLE_TEAM_ID: "${{ secrets.APPLE_TEAM_ID }}" | |
| APPLE_NOTARIZE: false | |
| - name: Deep sign all binaries in bundle | |
| working-directory: ./lumis/apps/web/src-tauri/target/release/bundle/macos/Lumis.app | |
| run: | | |
| # Sign all executable files, .node files, and dylib recursively | |
| echo "Signing all .node files..." | |
| find . -type f -name "*.node" -print0 | xargs -0 codesign --force --sign "${{ secrets.APPLE_SIGNING_IDENTITY }}" --options runtime --timestamp || true | |
| echo "Signing all .dylib files..." | |
| find . -type f -name "*.dylib" -print0 | xargs -0 codesign --force --sign "${{ secrets.APPLE_SIGNING_IDENTITY }}" --options runtime --timestamp || true | |
| echo "Signing all executable files..." | |
| find . -type f -perm +111 -print0 | xargs -0 codesign --force --sign "${{ secrets.APPLE_SIGNING_IDENTITY }}" --options runtime --timestamp || true | |
| - name: Sign specific problematic binaries | |
| working-directory: ./lumis/apps/web/src-tauri/target/release/bundle/macos/Lumis.app | |
| run: | | |
| # Sign all known problematic binaries in nested directories | |
| BINARY_PATHS=( | |
| "./Contents/Resources/_up_/cli-bundle/node" | |
| "./Contents/Resources/_up_/cli-bundle/vendor/ripgrep/arm64-darwin/rg" | |
| "./Contents/Resources/_up_/cli-bundle/vendor/ripgrep/arm64-darwin/ripgrep.node" | |
| "./Contents/Resources/_up_/.next/standalone/apps/web/cli-bundle/node" | |
| "./Contents/Resources/_up_/.next/standalone/apps/web/cli-bundle/vendor/ripgrep/arm64-darwin/rg" | |
| "./Contents/Resources/_up_/.next/standalone/apps/web/cli-bundle/vendor/ripgrep/arm64-darwin/ripgrep.node" | |
| ) | |
| for BINARY in "${BINARY_PATHS[@]}"; do | |
| if [ -f "$BINARY" ]; then | |
| echo "Signing: $BINARY" | |
| xattr -cr "$BINARY" 2>/dev/null || true | |
| codesign --force --sign "${{ secrets.APPLE_SIGNING_IDENTITY }}" --options runtime --timestamp "$BINARY" | |
| else | |
| echo "File not found: $BINARY" | |
| fi | |
| done | |
| - name: Re-sign entire app bundle | |
| working-directory: ./lumis/apps/web/src-tauri/target/release/bundle/macos/Lumis.app | |
| run: | | |
| # Finally re-sign the entire app bundle | |
| echo "Re-signing entire app bundle..." | |
| xattr -cr . 2>/dev/null || true | |
| codesign --force --sign "${{ secrets.APPLE_SIGNING_IDENTITY }}" --options runtime --timestamp . | |
| - name: Rebuild DMG after signing | |
| working-directory: ./lumis/apps/web/src-tauri/target/release/bundle/macos | |
| run: | | |
| # Remove old DMG and rebuild with signed app | |
| rm -f dmg/*.dmg | |
| # Get app version from package.json | |
| VERSION=$(cat ../../../../../package.json | jq -r '.version') | |
| # Create new DMG with signed app | |
| hdiutil create -volname "Lumis" -srcfolder "Lumis.app" -ov -format UDZO "dmg/Lumis_${VERSION}_aarch64.dmg" | |
| - name: Notarize DMG | |
| run: | | |
| DMG_PATH=$(ls ./lumis/apps/web/src-tauri/target/release/bundle/dmg/Lumis*.dmg) | |
| echo "Notarizing: $DMG_PATH" | |
| xcrun notarytool submit "$DMG_PATH" \ | |
| --apple-id "${{ secrets.APPLE_ID }}" \ | |
| --password "${{ secrets.APPLE_PASSWORD }}" \ | |
| --team-id "${{ secrets.APPLE_TEAM_ID }}" \ | |
| --wait | |
| - name: Find DMG file | |
| id: dmg | |
| working-directory: ./lumis/apps/web/src-tauri/target/release/bundle/dmg | |
| run: echo "path=$(ls Lumis*.dmg)" >> $GITHUB_OUTPUT | |
| - name: Upload Apple Silicon DMG | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: lumis-dmg-arm64 | |
| path: ./lumis/apps/web/src-tauri/target/release/bundle/dmg/${{ steps.dmg.outputs.path }} | |
| build-tauri-linux: | |
| needs: get-version | |
| if: needs.get-version.outputs.version != '' | |
| runs-on: ubuntu-22.04 | |
| steps: | |
| - name: Checkout release repo | |
| uses: actions/checkout@v4 | |
| - name: Clone lumis source code | |
| run: | | |
| git clone https://x-access-token:${{ secrets.LUMIS_TOKEN }}@github.com/${{ env.LUMIS_REPO }}.git lumis | |
| cd lumis | |
| git checkout ${{ needs.get-version.outputs.checkout_ref }} | |
| - name: Setup Node.js | |
| uses: actions/setup-node@v4 | |
| with: | |
| node-version: ${{ env.NODE_VERSION }} | |
| - name: Install pnpm | |
| uses: pnpm/action-setup@v2 | |
| with: | |
| version: 9 | |
| - name: Add pnpm to PATH | |
| run: | | |
| echo "$HOME/.local/bin" >> $GITHUB_PATH | |
| echo "PNPM_HOME=$HOME/.local" >> $GITHUB_ENV | |
| - name: Setup Rust | |
| uses: dtolnay/rust-toolchain@stable | |
| with: | |
| toolchain: ${{ env.RUST_VERSION }} | |
| - name: Install Rust target | |
| run: | | |
| rustup target add x86_64-unknown-linux-gnu | |
| - name: Install dependencies | |
| working-directory: ./lumis | |
| run: pnpm install --frozen-lockfile --ignore-scripts | |
| - name: Rebuild native modules for Tauri | |
| working-directory: ./lumis | |
| run: | | |
| pnpm rebuild better-sqlite3 | |
| cd node_modules/@photon-ai/imessage-kit && pnpm rebuild | |
| - name: Create .env file | |
| working-directory: ./lumis/apps/web | |
| run: | | |
| cp .env.example .env | |
| # Remove POSTGRES_URL to skip database migration in CI | |
| grep -v '^POSTGRES_URL=' .env > .env.tmp && mv .env.tmp .env | |
| - name: Install Linux build dependencies | |
| run: | | |
| sudo apt-get update | |
| sudo apt-get install -y libwebkit2gtk-4.1-dev libappindicator3-dev librsvg2-dev patchelf | |
| - name: Build Tauri app (Linux) | |
| working-directory: ./lumis/apps/web | |
| run: pnpm tauri:build | |
| - name: Find deb file | |
| id: deb | |
| working-directory: ./lumis/apps/web/src-tauri/target/release/bundle/deb | |
| run: echo "path=$(ls lumis*.deb)" >> $GITHUB_OUTPUT | |
| - name: Upload Linux deb | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: lumis-linux | |
| path: ./lumis/apps/web/src-tauri/target/release/bundle/deb/${{ steps.deb.outputs.path }} | |
| release: | |
| needs: [get-version, build-tauri-macos, build-tauri-linux] | |
| if: needs.get-version.outputs.version != '' | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: write | |
| steps: | |
| - name: Download Apple Silicon DMG | |
| uses: actions/download-artifact@v4 | |
| with: | |
| name: lumis-dmg-arm64 | |
| - name: Download Linux deb | |
| uses: actions/download-artifact@v4 | |
| with: | |
| name: lumis-linux | |
| - name: Create Release | |
| uses: softprops/action-gh-release@v1 | |
| with: | |
| tag_name: ${{ needs.get-version.outputs.version }} | |
| name: 'Lumis ${{ needs.get-version.outputs.version }}' | |
| body: 'See the assets to download this version and install.' | |
| draft: true | |
| files: | | |
| Lumis*.dmg | |
| lumis*.deb | |
| env: | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| - name: Checkout repository | |
| uses: actions/checkout@v4 | |
| - name: Update Homebrew Cask | |
| run: | | |
| # Find DMG file | |
| DMG_FILE=$(ls Lumis*.dmg) | |
| # Extract version from filename (e.g., Lumis_0.3.0_aarch64.dmg -> 0.3.0) | |
| VERSION=$(echo "$DMG_FILE" | sed -E 's/Lumis_([0-9.]+)_aarch64.dmg/\1/') | |
| # Calculate SHA256 | |
| SHA256=$(sha256sum "$DMG_FILE" | awk '{print $1}') | |
| # Update cask file | |
| sed -i "s/version \"[^\"]*\"/version \"$VERSION\"/" Casks/lumis.rb | |
| sed -i "s/sha256 \"[^\"]*\"/sha256 \"$SHA256\"/" Casks/lumis.rb | |
| # Commit changes | |
| git config --local user.email "github-actions[bot]@users.noreply.github.com" | |
| git config --local user.name "github-actions[bot]" | |
| git add Casks/lumis.rb | |
| git commit -m "chore: update Homebrew cask to v$VERSION" || echo "No changes to commit" | |
| - name: Push changes | |
| uses: ad-m/github-push-action@master | |
| with: | |
| github_token: ${{ secrets.GITHUB_TOKEN }} |