PetschStudios/KanbanGit
3
0
Fork 0
Code Issues Pull Requests 2 Actions Packages Projects Releases 24 Wiki Activity

feat(KAN-58): add macOS actions and Hetzner release pipeline
CI/CD / preconditions (pull_request) Successful in 2s
Details
Native JavaScript checks / Native launcher and release tests (pull_request) Successful in 57s
Details
CI/CD / test_and_check_app (pull_request) Successful in 6m33s
Details
CI/CD / Publish immutable image (pull_request) Skipped
Details
macOS checks / Native Rust tests and unsigned build (pull_request) Canceled after 0s
Details

Browse Source
This commit is contained in:
Twyco
2026-09-27 08:08:57 +00:00
parent 2f99b8e65c
commit fcba7673c2
8 changed files with 1245 additions and 43 deletions
Download Patch File Download Diff File Expand all files Collapse all files
native/release-macos.mjs
+49 -43
View File
@@ -37,6 +37,54 @@ function execute(command, args, options) {
return result.stdout?.trim() || result.stderr?.trim() || '';
}
export function verifySignedMacosApp({ app, version, step }) {
step('Verifying Developer ID signature and team', 'codesign', [
'--verify',
'--deep',
'--strict',
'--verbose=2',
'-R',
`=anchor apple generic and identifier "${bundleIdentifier}" and certificate leaf[subject.OU] = "${appleTeamId}" and certificate leaf[field.1.2.840.113635.100.6.1.13] exists`,
app,
]);
const signature = step('Checking hardened runtime', 'codesign', [
'--display',
'--verbose=4',
app,
]);
if (!/^CodeDirectory .*flags=.*\bruntime\b/m.test(signature)) {
throw new Error(
'The release signature does not enable Hardened Runtime.',
);
}
const cdhash = signature.match(/^CDHash=([\da-f]+)$/m)?.[1];
if (!cdhash) {
throw new Error(
'The signed app has no CodeDirectory hash to match against Apple notarization.',
);
}
const bundledVersion = step('Checking bundled release version', 'plutil', [
'-extract',
'CFBundleShortVersionString',
'raw',
'-o',
'-',
join(app, 'Contents/Info.plist'),
]);
if (bundledVersion.trim() !== version) {
throw new Error(
'The built app version does not match the release version.',
);
}
return cdhash;
}
export function releaseMacos({
env = process.env,
platform = process.platform,
@@ -213,49 +261,7 @@ export function releaseMacos({
throw new Error('The release build did not produce KanbanGit.app.');
}
step('Verifying Developer ID signature and team', 'codesign', [
'--verify',
'--deep',
'--strict',
'--verbose=2',
'-R',
`=anchor apple generic and identifier "${bundleIdentifier}" and certificate leaf[subject.OU] = "${appleTeamId}" and certificate leaf[field.1.2.840.113635.100.6.1.13] exists`,
app,
]);
const signature = step('Checking hardened runtime', 'codesign', [
'--display',
'--verbose=4',
app,
]);
if (!/^CodeDirectory .*flags=.*\bruntime\b/m.test(signature)) {
throw new Error(
'The release signature does not enable Hardened Runtime.',
);
}
const cdhash = signature.match(/^CDHash=([\da-f]+)$/m)?.[1];
if (!cdhash) {
throw new Error(
'The signed app has no CodeDirectory hash to match against Apple notarization.',
);
}
const version = step('Checking bundled release version', 'plutil', [
'-extract',
'CFBundleShortVersionString',
'raw',
'-o',
'-',
join(app, 'Contents/Info.plist'),
]);
if (version.trim() !== config.version) {
throw new Error(
'The built app version does not match the release version.',
);
}
const cdhash = verifySignedMacosApp({ app, version: config.version, step });
mkdirSync(releaseDirectory, { recursive: true });
const staging = mkdtempSync(join(releaseDirectory, '.pending-'));