macos.yml

name: macOS signed build

# A tag produces two independently native, signed and notarized DMGs. This
# workflow deliberately does not create or modify a GitHub release: a release
# promotion step must attach the verified artifacts explicitly.
on:
  workflow_dispatch:
  push:
    tags: ["v*"]

# Artifact upload needs no repository write token. In particular, this prevents
# this signing workflow from publishing a release as a side effect of a tag.
permissions:
  contents: read

jobs:
  build:
    name: macOS ${{ matrix.arch }} signed DMG
    environment: production
    runs-on: ${{ matrix.runner }}
    strategy:
      fail-fast: false
      matrix:
        include:
          - arch: aarch64
            target: aarch64-apple-darwin
            runner: macos-14
          - arch: x86_64
            target: x86_64-apple-darwin
            runner: macos-15-intel

    steps:
      - uses: actions/checkout@v7

      - uses: dtolnay/rust-toolchain@stable
        with:
          targets: ${{ matrix.target }}
      - uses: Swatinem/rust-cache@v2

      - uses: actions/setup-node@v7
        with:
          node-version: "22"
      - uses: pnpm/action-setup@v6
        with:
          version: 10

      - name: Build frontend
        working-directory: ui
        run: |
          pnpm install --frozen-lockfile
          pnpm build

      - name: Build native helper
        run: cargo build --release --target "$TARGET" -p freeyourdisk-helper
        env:
          TARGET: ${{ matrix.target }}

      - name: Stage target-matched helper as a Tauri bundle resource
        shell: bash
        env:
          TARGET: ${{ matrix.target }}
        run: |
          set -euo pipefail
          SOURCE="target/$TARGET/release/freeyourdisk-helper"
          RESOURCE_SOURCE="target/release/freeyourdisk-helper"

          test -x "$SOURCE"
          mkdir -p "$(dirname "$RESOURCE_SOURCE")"
          install -m 0755 "$SOURCE" "$RESOURCE_SOURCE"
          cmp -s "$SOURCE" "$RESOURCE_SOURCE"

      - name: Install Tauri CLI
        run: cargo install tauri-cli --locked

      - name: Build unsigned native app bundle
        run: cargo tauri build --target "$TARGET" --bundles app --config src-tauri/tauri.macos.bundle.conf.json
        env:
          TARGET: ${{ matrix.target }}

      - name: Import Developer ID certificate
        id: signing
        shell: bash
        env:
          APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }}
          APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
        run: |
          set -euo pipefail
          CERT_PATH="$RUNNER_TEMP/freeyourdisk-certificate.p12"
          KEYCHAIN_PATH="$RUNNER_TEMP/freeyourdisk-signing.keychain-db"
          KEYCHAIN_PASSWORD="$(uuidgen)"

          cleanup() {
            rm -f "$CERT_PATH"
          }
          trap cleanup EXIT

          export APPLE_CERTIFICATE_PASSWORD="$(printf '%s' "$APPLE_CERTIFICATE_PASSWORD" | tr -d '\r\n')"
          bash packaging/macOS/prepare-signing-certificate.sh "$CERT_PATH"
          security create-keychain -p "$KEYCHAIN_PASSWORD" "$KEYCHAIN_PATH"
          security set-keychain-settings -lut 21600 "$KEYCHAIN_PATH"
          security unlock-keychain -p "$KEYCHAIN_PASSWORD" "$KEYCHAIN_PATH"
          security import "$CERT_PATH" -k "$KEYCHAIN_PATH" -P "$APPLE_CERTIFICATE_PASSWORD" \
            -T /usr/bin/codesign -T /usr/bin/xcrun
          security list-keychain -d user -s "$KEYCHAIN_PATH"
          security default-keychain -s "$KEYCHAIN_PATH"
          security set-key-partition-list -S apple-tool:,apple:,codesign: \
            -s -k "$KEYCHAIN_PASSWORD" "$KEYCHAIN_PATH"

          IDENTITY="$(security find-identity -v -p codesigning "$KEYCHAIN_PATH" \
            | sed -n 's/.*"\(Developer ID Application:.*\)".*/\1/p')"
          test -n "$IDENTITY"
          test "$(printf '%s\n' "$IDENTITY" | wc -l | tr -d ' ')" -eq 1

          {
            echo "keychain_path=$KEYCHAIN_PATH"
            echo "identity=$IDENTITY"
          } >> "$GITHUB_OUTPUT"

      - name: Embed helper and sign app bundle
        id: app
        shell: bash
        env:
          TARGET: ${{ matrix.target }}
          IDENTITY: ${{ steps.signing.outputs.identity }}
        run: |
          set -euo pipefail
          BUNDLE_DIR="target/$TARGET/release/bundle/macos"
          shopt -s nullglob
          APPS=("$BUNDLE_DIR"/*.app)
          shopt -u nullglob
          test "${#APPS[@]}" -eq 1
          APP="${APPS[0]}"
          test -d "$APP"
          HELPER="target/release/freeyourdisk-helper"
          DESTINATION="$APP/Contents/Resources/freeyourdisk-helper"

          # Tauri copied the target-matched helper through bundle.resources.
          test -x "$HELPER"
          test -x "$DESTINATION"
          cmp -s "$HELPER" "$DESTINATION"

          # Nested code must be signed before the containing app bundle.
          codesign --force --options runtime --timestamp --sign "$IDENTITY" "$DESTINATION"
          codesign --force --options runtime --timestamp --sign "$IDENTITY" "$APP"
          codesign --verify --deep --strict --verbose=2 "$APP"

          echo "app_path=$APP" >> "$GITHUB_OUTPUT"

      - name: Create, sign, notarize and staple DMG
        id: dmg
        shell: bash
        timeout-minutes: 135
        env:
          APP_PATH: ${{ steps.app.outputs.app_path }}
          ARCH: ${{ matrix.arch }}
          IDENTITY: ${{ steps.signing.outputs.identity }}
          KEYCHAIN_PATH: ${{ steps.signing.outputs.keychain_path }}
          APPLE_ID: ${{ secrets.APPLE_ID }}
          APPLE_APP_SPECIFIC_PASSWORD: ${{ secrets.APPLE_APP_SPECIFIC_PASSWORD }}
          APPLE_TEAM_ID: ${{ vars.APPLE_TEAM_ID }}
        run: |
          set -euo pipefail
          VERSION="$(awk -F'"' '/^version = / { print $2; exit }' Cargo.toml)"
          test -n "$VERSION"
          test -n "$APPLE_TEAM_ID"
          DMG="FreeYourDisk_${VERSION}_${ARCH}.dmg"
          PROFILE="freeyourdisk-notary-${ARCH}"

          hdiutil create -volname "FreeYourDisk" -srcfolder "$APP_PATH" -ov -format UDZO "$DMG"
          codesign --force --timestamp --sign "$IDENTITY" "$DMG"
          xcrun notarytool store-credentials "$PROFILE" \
            --apple-id "$APPLE_ID" \
            --password "$APPLE_APP_SPECIFIC_PASSWORD" \
            --team-id "$APPLE_TEAM_ID" \
            --keychain "$KEYCHAIN_PATH"
          node packaging/macOS/notarize-dmg.mjs "$DMG" "$PROFILE" "$KEYCHAIN_PATH"
          xcrun stapler staple "$DMG"
          xcrun stapler validate "$DMG"
          # Disk images need their primary-signature context, unlike executable apps.
          spctl -a -vvv -t open --context context:primary-signature "$DMG"

          echo "dmg_path=$DMG" >> "$GITHUB_OUTPUT"

      - name: Verify stapled distribution artifact
        shell: bash
        env:
          DMG_PATH: ${{ steps.dmg.outputs.dmg_path }}
        run: |
          set -euo pipefail
          MOUNT_POINT="$(mktemp -d "$RUNNER_TEMP/freeyourdisk-mount.XXXXXX")"
          cleanup() {
            hdiutil detach "$MOUNT_POINT" -quiet || true
            rmdir "$MOUNT_POINT" || true
          }
          trap cleanup EXIT

          hdiutil attach "$DMG_PATH" -readonly -nobrowse -mountpoint "$MOUNT_POINT"
          shopt -s nullglob
          APPS=("$MOUNT_POINT"/*.app)
          shopt -u nullglob
          test "${#APPS[@]}" -eq 1
          APP="${APPS[0]}"
          test -d "$APP"
          HELPER="$APP/Contents/Resources/freeyourdisk-helper"

          test -x "$HELPER"
          codesign --verify --strict --verbose=2 "$HELPER"
          codesign --verify --deep --strict --verbose=2 "$APP"

      - name: Upload signed and notarized DMG
        uses: actions/upload-artifact@v7
        with:
          name: freeyourdisk-macos-${{ matrix.arch }}
          path: ${{ steps.dmg.outputs.dmg_path }}
          if-no-files-found: error

      - name: Remove temporary signing keychain
        if: always()
        shell: bash
        env:
          KEYCHAIN_PATH: ${{ steps.signing.outputs.keychain_path }}
        run: |
          set -euo pipefail
          if [ -n "${KEYCHAIN_PATH:-}" ]; then
            security delete-keychain "$KEYCHAIN_PATH" || true
          fi