test-signing.yml

name: Test Code Signing

on:
  workflow_dispatch:

jobs:
  test-signing:
    runs-on: macos-latest
    steps:
      - uses: actions/checkout@v4

      - name: Import code signing certificate
        env:
          CERTIFICATE_BASE64: ${{ secrets.APPLE_CERTIFICATE }}
          CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
          KEYCHAIN_PASSWORD: ${{ secrets.KEYCHAIN_PASSWORD }}
        run: |
          CERTIFICATE_PATH="$RUNNER_TEMP/build_certificate.p12"
          KEYCHAIN_PATH="$RUNNER_TEMP/app-signing.keychain-db"

          if [ -z "$CERTIFICATE_BASE64" ] || [ -z "$CERTIFICATE_PASSWORD" ] || [ -z "$KEYCHAIN_PASSWORD" ]; then
            echo "Missing required secrets: APPLE_CERTIFICATE, APPLE_CERTIFICATE_PASSWORD, KEYCHAIN_PASSWORD" >&2
            exit 1
          fi

          echo -n "$CERTIFICATE_BASE64" | base64 --decode > "$CERTIFICATE_PATH" || \
            echo -n "$CERTIFICATE_BASE64" | base64 -D > "$CERTIFICATE_PATH"

          security create-keychain -p "$KEYCHAIN_PASSWORD" "$KEYCHAIN_PATH"
          security set-keychain-settings -lut 21600 "$KEYCHAIN_PATH"
          security unlock-keychain -p "$KEYCHAIN_PASSWORD" "$KEYCHAIN_PATH"
          security import "$CERTIFICATE_PATH" -P "$CERTIFICATE_PASSWORD" -A -t cert -f pkcs12 -k "$KEYCHAIN_PATH"
          security set-key-partition-list -S apple-tool:,apple: -k "$KEYCHAIN_PASSWORD" "$KEYCHAIN_PATH"
          security list-keychain -d user -s "$KEYCHAIN_PATH"

          echo "KEYCHAIN_PATH=$KEYCHAIN_PATH" >> "$GITHUB_ENV"

      - name: List available identities
        run: |
          security find-identity -v -p codesigning "$KEYCHAIN_PATH"

      - name: Create test binary
        run: |
          cat > /tmp/test.c <<'SRC'
          int main(void) { return 0; }
          SRC
          clang -o /tmp/attn-sign-test /tmp/test.c
          file /tmp/attn-sign-test

      - name: Sign and verify test binary
        env:
          APPLE_SIGNING_IDENTITY: ${{ secrets.APPLE_SIGNING_IDENTITY }}
        run: |
          if [ -z "$APPLE_SIGNING_IDENTITY" ]; then
            echo "Missing required secret: APPLE_SIGNING_IDENTITY" >&2
            exit 1
          fi

          codesign --sign "$APPLE_SIGNING_IDENTITY" \
            --keychain "$KEYCHAIN_PATH" \
            --options runtime \
            --timestamp \
            /tmp/attn-sign-test

          codesign --verify --verbose=4 /tmp/attn-sign-test
          codesign -dv --verbose=4 /tmp/attn-sign-test 2>&1

      - name: Cleanup keychain
        if: always()
        run: |
          if [ -n "${KEYCHAIN_PATH:-}" ] && [ -f "$KEYCHAIN_PATH" ]; then
            security delete-keychain "$KEYCHAIN_PATH"
          fi