ci: require imported macOS signing identity

Author: zouyonghe

.github/workflows/build-desktop-tauri.yml

@@ -276,9 +276,16 @@ jobs:
         run: |
           set -euo pipefail
           if [ -z "${APPLE_CERTIFICATE:-}" ]; then
-            echo "APPLE_CERTIFICATE is not configured; skipping certificate import."
-            printf 'signing_identity=\n' >> "$GITHUB_OUTPUT"
-            exit 0
+            echo "::error::APPLE_CERTIFICATE is required for macOS release builds." >&2
+            exit 1
+          fi
+          if [ -z "${APPLE_CERTIFICATE_PASSWORD:-}" ]; then
+            echo "::error::APPLE_CERTIFICATE_PASSWORD is required for macOS release builds." >&2
+            exit 1
+          fi
+          if [ -z "${KEYCHAIN_PASSWORD:-}" ]; then
+            echo "::error::KEYCHAIN_PASSWORD is required for macOS release builds." >&2
+            exit 1
           fi
           CERT_PATH="$RUNNER_TEMP/certificate.p12"
           KEYCHAIN_PATH="$RUNNER_TEMP/build.keychain"
@@ -311,9 +318,20 @@ jobs:
             echo "::error::Failed to parse the imported Developer ID Application identity." >&2
             exit 1
           fi
+          CERT_TEAM_ID="$({
+            security find-certificate -c "$CERT_ID" -p "$KEYCHAIN_PATH" |
+              openssl x509 -noout -subject -nameopt RFC2253
+          } | tr ',' '\n' | awk -F= '$1 == "OU" { print $2; exit }')"
+          if ! printf '%s' "$CERT_TEAM_ID" | grep -Eq '^[A-Z0-9]{10}$'; then
+            echo "::error::Failed to extract a valid Apple Team ID from the imported certificate." >&2
+            exit 1
+          fi
           printf 'APPLE_SIGNING_IDENTITY=%s\n' "$CERT_ID" >> "$GITHUB_ENV"
+          printf 'APPLE_TEAM_ID=%s\n' "$CERT_TEAM_ID" >> "$GITHUB_ENV"
           printf 'signing_identity=%s\n' "$CERT_ID" >> "$GITHUB_OUTPUT"
+          printf 'team_id=%s\n' "$CERT_TEAM_ID" >> "$GITHUB_OUTPUT"
           echo "Imported signing identity: $CERT_ID"
+          echo "Imported certificate team: $CERT_TEAM_ID"
 
       - name: Prepare desktop resources (macOS)
         env:
@@ -369,11 +387,8 @@ jobs:
           ASTRBOT_DESKTOP_CRYPTOGRAPHY_FALLBACK_VERSIONS: ${{ vars.ASTRBOT_DESKTOP_CRYPTOGRAPHY_FALLBACK_VERSIONS || '' }}
           ASTRBOT_MACOS_BUILD_MAX_ATTEMPTS: ${{ vars.ASTRBOT_MACOS_BUILD_MAX_ATTEMPTS || '3' }}
           ASTRBOT_MACOS_BUILD_RETRY_SLEEP_SECONDS: ${{ vars.ASTRBOT_MACOS_BUILD_RETRY_SLEEP_SECONDS || '8' }}
-          APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }}
-          APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
           APPLE_ID: ${{ secrets.APPLE_ID }}
           APPLE_PASSWORD: ${{ secrets.APPLE_PASSWORD }}
-          APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
           GITHUB_TOKEN: ${{ github.token }}
           GH_TOKEN: ${{ github.token }}
         shell: bash

scripts/ci/build-desktop-tauri-workflow.test.mjs

@@ -13,6 +13,7 @@ const RELEASE_JOB = 'release';
 const PREPARE_RESOURCES_RUN = /pnpm run prepare:resources/;
 const PRESIGN_BACKEND_RUN = /codesign-macos-nested\.sh\s+"resources\/backend"/;
 const BUILD_APP_BUNDLE_RUN = /cargo tauri build --verbose --target/;
+const IMPORT_APPLE_CERTIFICATE_RUN = /security import "\$CERT_PATH"/;
 
 test('findStep supports predicate and regex matching', () => {
   const steps = [
@@ -70,6 +71,32 @@ test('macOS workflow prepares resources before optional pre-signing', async () =
   );
 });
 
+test('macOS workflow requires one certificate and derives its team ID', async () => {
+  const workflowObject = await readWorkflowObject(WORKFLOW_FILE);
+  const steps = extractWorkflowJobSteps(workflowObject, BUILD_MACOS_JOB);
+  const importStep = findStep(
+    steps,
+    'Import Apple Developer Certificate',
+    (step) => IMPORT_APPLE_CERTIFICATE_RUN.test(step.run ?? ''),
+  );
+  const buildStep = findStep(
+    steps,
+    'Build desktop app bundle (macOS)',
+    (step) => BUILD_APP_BUNDLE_RUN.test(step.run ?? ''),
+  );
+
+  assert.equal(importStep.env?.APPLE_CERTIFICATE, '${{ secrets.APPLE_CERTIFICATE }}');
+  assert.equal(importStep.env?.APPLE_CERTIFICATE_PASSWORD, '${{ secrets.APPLE_CERTIFICATE_PASSWORD }}');
+  assert.match(importStep.run, /APPLE_CERTIFICATE is required for macOS release builds/);
+  assert.match(importStep.run, /APPLE_CERTIFICATE_PASSWORD is required for macOS release builds/);
+  assert.match(importStep.run, /Expected exactly one Developer ID Application identity/);
+  assert.match(importStep.run, /openssl x509 -noout -subject -nameopt RFC2253/);
+  assert.match(importStep.run, /APPLE_TEAM_ID=%s/);
+  assert.equal(buildStep.env?.APPLE_CERTIFICATE, undefined);
+  assert.equal(buildStep.env?.APPLE_CERTIFICATE_PASSWORD, undefined);
+  assert.equal(buildStep.env?.APPLE_TEAM_ID, undefined);
+});
+
 test('release workflow disables generated release notes for nightly builds', async () => {
   const workflowObject = await readWorkflowObject(WORKFLOW_FILE);
   const steps = extractWorkflowJobSteps(workflowObject, RELEASE_JOB);