Desktop: Build and Sign Mac and Windows Bundles in CI (#3728)

* Desktop: Build and Sign Mac and Windows Bundles in CI * Desktop: Remove unnecessary CEF files from Windows Bundle * Desktop: Use a temp file for license generation on Windows to avoid PowerShell modifying stdout
2026-09-20 20:56:09 +08:00 · 2026-02-06 13:37:07 +00:00
parent 5efa81df85
commit acab171bc5
5 changed files with 376 additions and 10 deletions
@@ -0,0 +1,153 @@
+name: Build Mac Bundle
+
+on:
+  push:
+    branches:
+      - master
+
+jobs:
+  build:
+    runs-on: macos-latest
+
+    env:
+      WASM_BINDGEN_CLI_VERSION: "0.2.100"
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup Rust
+        uses: actions-rust-lang/setup-rust-toolchain@v1
+        with:
+          toolchain: stable
+          override: true
+          rustflags: ""
+          target: wasm32-unknown-unknown
+
+      - name: Cache Cargo
+        uses: actions/cache@v4
+        with:
+          path: |
+            ~/.cargo/registry
+            ~/.cargo/git
+            target
+          key: cargo-${{ runner.os }}-${{ hashFiles('**/Cargo.lock') }}
+
+      - name: Setup Node
+        uses: actions/setup-node@v4
+        with:
+          node-version-file: .nvmrc
+          cache: npm
+          cache-dependency-path: |
+            package-lock.json
+            frontend/package-lock.json
+
+      - name: Install Native Dependencies
+        env:
+          GITHUB_TOKEN: ${{ github.token }}
+          BINSTALL_DISABLE_TELEMETRY: "true"
+        run: |
+          brew update
+          brew install \
+            pkg-config \
+            openssl@3 \
+            binaryen \
+            llvm \
+            cargo-binstall
+
+          echo "OPENSSL_DIR=$(brew --prefix openssl@3)" >> $GITHUB_ENV
+          echo "PKG_CONFIG_PATH=$(brew --prefix openssl@3)/lib/pkgconfig" >> $GITHUB_ENV
+          echo "$(brew --prefix llvm)/bin" >> $GITHUB_PATH
+
+          cargo binstall --no-confirm --force wasm-pack
+          cargo binstall --no-confirm --force cargo-about
+          cargo binstall --no-confirm --force "wasm-bindgen-cli@${WASM_BINDGEN_CLI_VERSION}"
+
+      - name: Build Mac Bundle
+        env:
+          CARGO_TERM_COLOR: always
+        run: npm run build-desktop
+
+      - name: Stage Artifacts
+        shell: bash
+        run: |
+          rm -rf target/artifacts
+          mkdir -p target/artifacts
+          cp -R target/release/Graphite.app target/artifacts/Graphite.app
+
+      - name: Upload Mac Bundle
+        uses: actions/upload-artifact@v4
+        with:
+          name: graphite-mac-bundle
+          path: target/artifacts
+
+      - name: Sign and Notarize Mac Bundle Preparation
+        env:
+          APPLE_CERT_BASE64: ${{ secrets.APPLE_CERT_BASE64 }}
+          APPLE_CERT_PASSWORD: ${{ secrets.APPLE_CERT_PASSWORD }}
+        run: |
+          mkdir -p .sign
+          echo "$APPLE_CERT_BASE64" | base64 --decode > .sign/certificate.p12
+
+          security create-keychain -p "" .sign/main.keychain
+          security default-keychain -s .sign/main.keychain
+          security unlock-keychain -p "" .sign/main.keychain
+          security set-keychain-settings -t 3600 -u .sign/main.keychain
+
+          security import .sign/certificate.p12 -k .sign/main.keychain -P "$APPLE_CERT_PASSWORD" -T /usr/bin/codesign -T /usr/bin/productsign
+          security set-key-partition-list -S apple-tool:,apple: -s -k "" .sign/main.keychain
+
+          cat > .sign/entitlements.plist <<'EOF'
+          <?xml version="1.0" encoding="UTF-8"?>
+          <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+          <plist version="1.0">
+          <dict>
+              <key>com.apple.security.cs.allow-jit</key>
+              <true/>
+              <key>com.apple.security.cs.allow-unsigned-executable-memory</key>
+              <true/>
+              <key>com.apple.security.cs.disable-executable-page-protection</key>
+              <true/>
+              <key>com.apple.security.cs.disable-library-validation</key>
+              <true/>
+          </dict>
+          </plist>
+          EOF
+
+      - name: Sign and Notarize Mac Bundle
+        env:
+          APPLE_EMAIL: ${{ secrets.APPLE_EMAIL }}
+          APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
+          APPLE_PASSWORD: ${{ secrets.APPLE_PASSWORD }}
+          APPLE_CERT_NAME: ${{ secrets.APPLE_CERT_NAME }}
+        run: |
+          CERTIFICATE="$APPLE_CERT_NAME"
+          ENTITLEMENTS=".sign/entitlements.plist"
+          APP_PATH="target/artifacts/Graphite.app"
+          ZIP_PATH=".sign/Graphite.zip"
+
+          codesign --force --options runtime --entitlements "$ENTITLEMENTS" --sign "$CERTIFICATE" "$APP_PATH/Contents/Frameworks/Graphite Helper.app"
+          codesign --force --options runtime --entitlements "$ENTITLEMENTS" --sign "$CERTIFICATE" "$APP_PATH/Contents/Frameworks/Graphite Helper (GPU).app"
+          codesign --force --options runtime --entitlements "$ENTITLEMENTS" --sign "$CERTIFICATE" "$APP_PATH/Contents/Frameworks/Graphite Helper (Renderer).app"
+          codesign --force --options runtime --entitlements "$ENTITLEMENTS" --sign "$CERTIFICATE" "$APP_PATH/Contents/Frameworks/Chromium Embedded Framework.framework"
+          codesign --force --options runtime --entitlements "$ENTITLEMENTS" --sign "$CERTIFICATE" "$APP_PATH/Contents/Frameworks/Chromium Embedded Framework.framework/Libraries/libcef_sandbox.dylib"
+          codesign --force --options runtime --entitlements "$ENTITLEMENTS" --sign "$CERTIFICATE" "$APP_PATH/Contents/Frameworks/Chromium Embedded Framework.framework/Libraries/libEGL.dylib"
+          codesign --force --options runtime --entitlements "$ENTITLEMENTS" --sign "$CERTIFICATE" "$APP_PATH/Contents/Frameworks/Chromium Embedded Framework.framework/Libraries/libGLESv2.dylib"
+          codesign --force --options runtime --entitlements "$ENTITLEMENTS" --sign "$CERTIFICATE" "$APP_PATH/Contents/Frameworks/Chromium Embedded Framework.framework/Libraries/libvk_swiftshader.dylib"
+          codesign --force --options runtime --entitlements "$ENTITLEMENTS" --sign "$CERTIFICATE" "$APP_PATH" --deep
+
+          codesign --verify --deep --strict --verbose=4 "$APP_PATH"
+
+          ditto -c -k --keepParent "$APP_PATH" "$ZIP_PATH"
+          xcrun notarytool submit "$ZIP_PATH" --wait --apple-id "$APPLE_EMAIL" --team-id "$APPLE_TEAM_ID" --password "$APPLE_PASSWORD"
+          rm "$ZIP_PATH"
+
+          xcrun stapler staple -v "$APP_PATH"
+
+          spctl -a -vv "$APP_PATH"
+
+      - name: Upload Mac Bundle Signed
+        uses: actions/upload-artifact@v4
+        with:
+          name: graphite-mac-bundle-signed
+          path: target/artifacts