Skip to content

Commit fa3f1d1

Browse files
peterjahpeterjah
committed
debug release workflow
1 parent f078d78 commit fa3f1d1

File tree

3 files changed

+142
-89
lines changed

3 files changed

+142
-89
lines changed

‎.github/workflows/build.yml‎

Lines changed: 77 additions & 51 deletions
Original file line numberDiff line numberDiff line change
@@ -20,20 +20,20 @@ jobs:
2020
matrix:
2121
include:
2222
# The first combination is Ubuntu running on an AMD64 processor, building for Windows.
23-
- os: ubuntu-24.04
24-
arch: amd64
25-
target: windows
26-
ext: .exe
23+
# - os: ubuntu-24.04
24+
# arch: amd64
25+
# target: windows
26+
# ext: .exe
2727

28-
# The second combination is Ubuntu running on an AMD64 processor, building for Linux.
29-
- os: ubuntu-24.04
30-
arch: amd64
31-
target: linux
28+
# # The second combination is Ubuntu running on an AMD64 processor, building for Linux.
29+
# - os: ubuntu-24.04
30+
# arch: amd64
31+
# target: linux
3232

3333
# The third combination is macOS running on an AMD64 processor, building for Darwin (macOS).
34-
- os: macos-13
35-
arch: amd64
36-
target: darwin
34+
# - os: macos-13
35+
# arch: amd64
36+
# target: darwin
3737

3838
# The fourth combination is macOS running on an ARM64 processor, building for Darwin (macOS).
3939
- os: macos-13
@@ -66,20 +66,46 @@ jobs:
6666
if: ${{ matrix.target != 'windows' }}
6767
run: |
6868
ls -la build/
69-
chmod +x build/node-manager-plugin*
69+
chmod +x build/node-manager-plugin
70+
md5 build/node-manager-plugin
7071
71-
- name: Sign Macos binary
72-
uses: massalabs/massa/.github/actions/sign-macos@ccc3f02e34544f722634a6fb7732cc4bb515e90b
73-
if: ${{ runner.os == 'macOS' }}
72+
# - name: Sign Macos binary
73+
# uses: massalabs/massa/.github/actions/sign-macos@ccc3f02e34544f722634a6fb7732cc4bb515e90b
74+
# if: ${{ runner.os == 'macOS' }}
75+
# with:
76+
# paths: "build/node-manager-plugin"
77+
# certificate-p12-base64: ${{ secrets.APPLE_CERTIFICATE_P12_BASE64 }}
78+
# certificate-password: ${{ secrets.APPLE_CERTIFICATE_P12_PASSWORD }}
79+
# signing-identity: ${{ vars.APPLE_DEVELOPER_ID_APPLICATION }}
80+
81+
- name: Import Apple signing certificate
82+
uses: Apple-Actions/import-codesign-certs@v3
7483
with:
75-
paths: "build/node-manager-plugin"
76-
certificate-p12-base64: ${{ secrets.APPLE_CERTIFICATE_P12_BASE64 }}
77-
certificate-password: ${{ secrets.APPLE_CERTIFICATE_P12_PASSWORD }}
78-
signing-identity: ${{ vars.APPLE_DEVELOPER_ID_APPLICATION }}
84+
p12-file-base64: ${{ inputs.certificate-p12-base64 }}
85+
p12-password: ${{ inputs.certificate-password }}
86+
87+
- name: Re-sign with entitlements (if custom action doesn't support entitlements)
88+
if: ${{ runner.os == 'macOS' }}
89+
run: |
90+
echo "Re-signing with entitlements to ensure proper hardened runtime..."
91+
codesign --force --options runtime --entitlements entitlements.plist --sign "${{ vars.APPLE_DEVELOPER_ID_APPLICATION }}" build/node-manager-plugin
92+
echo "Verifying re-signed binary..."
93+
codesign --verify --verbose build/node-manager-plugin
94+
95+
- name: Verify code signing
96+
if: ${{ runner.os == 'macOS' }}
97+
run: |
98+
echo "Verifying code signature..."
99+
codesign --verify --verbose build/node-manager-plugin
100+
codesign --display --verbose=4 build/node-manager-plugin
101+
spctl --assess --type execute --verbose build/node-manager-plugin || echo "SPCTL assessment failed - this is expected before notarization"
79102
80103
- name: Rename Plugin artifact
81-
run:
104+
run: |
105+
md5 build/node-manager-plugin
82106
mv build/node-manager-plugin${{ matrix.ext }} ${{ env.TARGET_NAME }}${{ matrix.ext }}
107+
ls -la
108+
md5 ${{ env.TARGET_NAME }}${{ matrix.ext }}
83109
84110
- name: Upload artifacts
85111
uses: actions/upload-artifact@v4
@@ -88,35 +114,35 @@ jobs:
88114
path: |
89115
${{ env.TARGET_NAME }}${{ matrix.ext }}
90116
91-
sign-windows-binary:
92-
name: Sign Windows binary
93-
needs: build
94-
runs-on: windows-latest
95-
permissions:
96-
contents: write
97-
id-token: write
98-
env:
99-
TARGET_NAME: node-manager-plugin_windows-amd64
100-
steps:
101-
- name: Download Windows artifacts
102-
uses: actions/download-artifact@v4
103-
with:
104-
name: ${{ env.TARGET_NAME }}
105-
path: .
117+
# sign-windows-binary:
118+
# name: Sign Windows binary
119+
# needs: build
120+
# runs-on: windows-latest
121+
# permissions:
122+
# contents: write
123+
# id-token: write
124+
# env:
125+
# TARGET_NAME: node-manager-plugin_windows-amd64
126+
# steps:
127+
# - name: Download Windows artifacts
128+
# uses: actions/download-artifact@v4
129+
# with:
130+
# name: ${{ env.TARGET_NAME }}
131+
# path: .
106132

107-
- name: Sign Windows binary
108-
uses: massalabs/station/.github/actions/sign-file-digicert@413d4c0bbd042d5e797fbb66bcd2c96be5c3e71a
109-
with:
110-
files: ${{ env.TARGET_NAME }}.exe
111-
SM_API_KEY: ${{ secrets.SM_API_KEY }}
112-
SM_CLIENT_CERT_FILE_B64: ${{ secrets.SM_CLIENT_CERT_FILE_B64 }}
113-
SM_CLIENT_CERT_PASSWORD: ${{ secrets.SM_CLIENT_CERT_PASSWORD }}
114-
SM_CERT_FINGERPRINT: ${{ secrets.SM_CERT_FINGERPRINT }}
115-
SM_HOST: ${{ secrets.SM_HOST }}
116-
117-
- name: Upload signed Windows zip (overwrite original)
118-
uses: actions/upload-artifact@v4
119-
with:
120-
name: ${{ env.TARGET_NAME }}
121-
path: ./${{ env.TARGET_NAME }}.exe
122-
overwrite: true
133+
# - name: Sign Windows binary
134+
# uses: massalabs/station/.github/actions/sign-file-digicert@413d4c0bbd042d5e797fbb66bcd2c96be5c3e71a
135+
# with:
136+
# files: ${{ env.TARGET_NAME }}.exe
137+
# SM_API_KEY: ${{ secrets.SM_API_KEY }}
138+
# SM_CLIENT_CERT_FILE_B64: ${{ secrets.SM_CLIENT_CERT_FILE_B64 }}
139+
# SM_CLIENT_CERT_PASSWORD: ${{ secrets.SM_CLIENT_CERT_PASSWORD }}
140+
# SM_CERT_FINGERPRINT: ${{ secrets.SM_CERT_FINGERPRINT }}
141+
# SM_HOST: ${{ secrets.SM_HOST }}
142+
143+
# - name: Upload signed Windows zip (overwrite original)
144+
# uses: actions/upload-artifact@v4
145+
# with:
146+
# name: ${{ env.TARGET_NAME }}
147+
# path: ./${{ env.TARGET_NAME }}.exe
148+
# overwrite: true

‎.github/workflows/release.yml‎

Lines changed: 40 additions & 38 deletions
Original file line numberDiff line numberDiff line change
@@ -23,22 +23,22 @@ on:
2323
default: true
2424

2525
jobs:
26-
check-manifest:
27-
name: Check the Manifest
28-
runs-on: ubuntu-24.04
29-
steps:
30-
- uses: actions/checkout@v3
31-
- name: Check the manifest version
32-
if: ${{ inputs.tag_name != '' }}
33-
run: |
34-
sudo apt-get install -y jq
35-
version=$(jq -r '.version' manifest.json)
36-
tag_name=${{ inputs.tag_name }}
37-
tag_name_without_v=${tag_name#v}
38-
if [[ $version != $tag_name_without_v ]]; then
39-
echo "The manifest version is not equal to the tag version"
40-
exit 1
41-
fi
26+
# check-manifest:
27+
# name: Check the Manifest
28+
# runs-on: ubuntu-24.04
29+
# steps:
30+
# - uses: actions/checkout@v3
31+
# - name: Check the manifest version
32+
# if: ${{ inputs.tag_name != '' }}
33+
# run: |
34+
# sudo apt-get install -y jq
35+
# version=$(jq -r '.version' manifest.json)
36+
# tag_name=${{ inputs.tag_name }}
37+
# tag_name_without_v=${tag_name#v}
38+
# if [[ $version != $tag_name_without_v ]]; then
39+
# echo "The manifest version is not equal to the tag version"
40+
# exit 1
41+
# fi
4242

4343
build-plugin:
4444
name: Build node manager plugin
@@ -54,16 +54,16 @@ jobs:
5454
fail-fast: false
5555
matrix:
5656
include:
57-
- os: ubuntu-24.04
58-
target: windows
59-
ext: .exe
60-
arch: amd64
61-
- os: ubuntu-24.04
62-
target: linux
63-
arch: amd64
64-
- os: macos-13
65-
target: darwin
66-
arch: amd64
57+
# - os: ubuntu-24.04
58+
# target: windows
59+
# ext: .exe
60+
# arch: amd64
61+
# - os: ubuntu-24.04
62+
# target: linux
63+
# arch: amd64
64+
# - os: macos-13
65+
# target: darwin
66+
# arch: amd64
6767
- os: macos-13
6868
target: darwin
6969
arch: arm64
@@ -99,13 +99,15 @@ jobs:
9999

100100
- name: make bin executable
101101
run: |
102+
ls -la
102103
ls -la ${{ env.TARGET_NAME }}
103104
chmod +x ${{ env.TARGET_NAME }}/*
105+
md5 ${{ env.TARGET_NAME }}/${{ env.TARGET_NAME }}
104106
105107
- name : zip package
106108
shell: bash
107109
run: |
108-
zip -j ${{ env.TARGET_NAME }}.zip web/public/favicon.svg manifest.json ${{ env.TARGET_NAME }}/*
110+
zip -j ${{ env.TARGET_NAME }}.zip web/public/favicon.svg manifest.json ${{ env.TARGET_NAME }}/${{ env.TARGET_NAME }}
109111
cd build && zip -r ../${{ env.TARGET_NAME }}.zip node-massa
110112
111113
- name: Notarize zip for MacOS ${{ matrix.arch }}
@@ -127,7 +129,7 @@ jobs:
127129
128130
create-release:
129131
name: Create release
130-
needs: [check-manifest, zip-package]
132+
needs: [ zip-package]
131133
runs-on: ubuntu-24.04
132134
steps:
133135
- name: Checkout
@@ -139,16 +141,16 @@ jobs:
139141
pattern: 'release-zip-node-manager-plugin_*'
140142
merge-multiple: true
141143

142-
- name: Create release and upload binaries
143-
uses: softprops/action-gh-release@v1
144-
with:
145-
target_commitish: ${{ github.sha }}
146-
tag_name: ${{ inputs.tag_name }}
147-
draft: ${{ inputs.draft }}
148-
prerelease: ${{ inputs.prerelease }}
149-
generate_release_notes: ${{ inputs.generate_release_notes }}
150-
files: |
151-
*.zip
144+
# - name: Create release and upload binaries
145+
# uses: softprops/action-gh-release@v1
146+
# with:
147+
# target_commitish: ${{ github.sha }}
148+
# tag_name: ${{ inputs.tag_name }}
149+
# draft: ${{ inputs.draft }}
150+
# prerelease: ${{ inputs.prerelease }}
151+
# generate_release_notes: ${{ inputs.generate_release_notes }}
152+
# files: |
153+
# *.zip
152154

153155
- name: Configure AWS credentials
154156
uses: aws-actions/configure-aws-credentials@v4

‎entitlements.plist‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
<?xml version="1.0" encoding="UTF-8"?>
2+
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
3+
<plist version="1.0">
4+
<dict>
5+
<!-- Allow JIT compilation (needed for some Go runtime features) -->
6+
<key>com.apple.security.cs.allow-jit</key>
7+
<true/>
8+
9+
<!-- Allow unsigned executable memory (common for Go binaries) -->
10+
<key>com.apple.security.cs.allow-unsigned-executable-memory</key>
11+
<true/>
12+
13+
<!-- Allow DYLD environment variables -->
14+
<key>com.apple.security.cs.allow-dyld-environment-variables</key>
15+
<true/>
16+
17+
<!-- Disable library validation -->
18+
<key>com.apple.security.cs.disable-library-validation</key>
19+
<true/>
20+
21+
<!-- Allow debugger attachment (can be removed for production) -->
22+
<key>com.apple.security.get-task-allow</key>
23+
<false/>
24+
</dict>
25+
</plist>

0 commit comments

Comments
 (0)