mac sign and notarize

.github/workflows/release.yml

@@ -32,6 +32,13 @@ jobs:
       fail-fast: false
     outputs:
       cache-hit: ${{ steps.cache-check.outputs.cache-hit }}
+    env:
+      GORELEASER_KEY: ${{ secrets.GORELEASER_KEY }}
+      MACOS_SIGN_P12: ${{ secrets.MACOS_SIGN_P12 }}
+      MACOS_SIGN_PASSWORD: ${{ secrets.MACOS_SIGN_PASSWORD }}
+      MACOS_NOTARY_ISSUER_ID: ${{ secrets.MACOS_NOTARY_ISSUER_ID }}
+      MACOS_NOTARY_KEY: ${{ secrets.MACOS_NOTARY_KEY }}
+      MACOS_NOTARY_KEY_ID: ${{ secrets.MACOS_NOTARY_KEY_ID }}
     steps:
       - uses: actions/checkout@v4
         with:
@@ -54,18 +61,12 @@ jobs:
           distribution: goreleaser-pro
           version: nightly
           args: release --clean --split ${{ matrix._ids }}
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          GORELEASER_KEY: ${{ secrets.GORELEASER_KEY }}
       - if: (github.event_name == 'schedule' || github.event_name == 'workflow_dispatch' || (github.event_name == 'push' && !startsWith(github.ref, 'refs/tags/v'))) && steps.cache-check.outputs.cache-hit != 'true'
         uses: goreleaser/[email protected]
         with:
           distribution: goreleaser-pro
           version: nightly
           args: release --clean --split ${{ matrix._ids }} --nightly --skip=winget
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          GORELEASER_KEY: ${{ secrets.GORELEASER_KEY }}
   release:
     # skip if cache exists for same commit, since we probably already released
     if: needs.build.outputs.cache-hit != 'true'
@@ -110,4 +111,3 @@ jobs:
           CARGO_REGISTRY_TOKEN: ${{ secrets.CARGO_REGISTRY_TOKEN }}
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           GORELEASER_KEY: ${{ secrets.GORELEASER_KEY }}
-          # macos notarization env vars

.goreleaser.yaml

@@ -117,6 +117,18 @@ dmg:
   - name: "{{ .ProjectName }}"
     use: appbundle
 
+notarize:
+  macos:
+    - enabled: '{{ isEnvSet "MACOS_SIGN_P12" }}'
+      sign:
+        certificate: '{{ .Env.MACOS_SIGN_P12 }}'
+        password: '{{ .Env.MACOS_SIGN_PASSWORD }}'
+      notarize:
+        issuer_id: '{{ .Env.MACOS_NOTARY_ISSUER_ID }}'
+        key: '{{ .Env.MACOS_NOTARY_KEY }}'
+        key_id: '{{ .Env.MACOS_NOTARY_KEY_ID }}'
+        wait: false
+
 app_bundles:
   - icon: ./misc/osx/Rio.app/Contents/Resources/icon.icns
     bundle: com.raphaelamorim.rio