fix: Update release builds with the new notarytool tool #976
Conversation
WalkthroughThe changes in the Changes
Poem
Thank you for using CodeRabbit. We offer it for free to the OSS community and would appreciate your support in helping us grow. If you find it useful, would you consider giving us a shout-out on your favorite social media? TipsChatThere are 3 ways to chat with CodeRabbit:
Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments. CodeRabbit Commands (invoked as PR comments)
Additionally, you can add CodeRabbit Configration File (
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Files selected for processing (1)
- .github/workflows/ci_release.yml (2 hunks)
Additional comments not posted (1)
.github/workflows/ci_release.yml (1)
66-90: Ensure the new notarization process is thoroughly tested across all platforms.Verification successful
The notarization and stapling commands for both x86_64 and aarch64 dmg files are present in the GitHub Actions workflow file. This indicates that the notarization process is correctly implemented in the workflow.
xcrun notarytool submitcommands for both x86_64 and aarch64 dmg files are found.xcrun stapler staplecommands for both x86_64 and aarch64 dmg files are found.Scripts executed
The following scripts were executed for the analysis:
Script:
#!/bin/bash # Description: Verify the notarization process on all platforms. # Test: Check logs for successful notarization and stapling on macOS x86_64 and aarch64. # Expect: Logs should show successful notarization and no errors related to the notarytool. rg --type yaml "notarization complete" .github/workflows/ci_release.ymlLength of output: 73
Script:
#!/bin/bash # Description: Verify the notarization process in the GitHub Actions workflow file. # Test: Check for the presence of notarization and stapling commands in the workflow file. # Expect: The file should contain commands for notarization and stapling for both x86_64 and aarch64 dmg files. # Search for notarization commands rg --type yaml "xcrun notarytool submit" .github/workflows/ci_release.yml # Search for stapling commands rg --type yaml "xcrun stapler staple" .github/workflows/ci_release.ymlLength of output: 646
| - name: Notarization of Espressif-IDE dmg files | ||
| env: | ||
| NOTARIZATION_USERNAME: ${{ secrets.NOTARIZATION_USERNAME }} | ||
| NOTARIZATION_PASSWORD: ${{ secrets.NOTARIZATION_PASSWORD }} | ||
| run: | | ||
| echo "Notarization of Espressif-IDE-macosx-cocoa-x86_64.dmg" | ||
| xcrun altool --notarize-app -f $PWD/releng/ide-dmg-builder/Espressif-IDE-macosx-cocoa-x86_64.dmg -u $NOTARIZATION_USERNAME -p $NOTARIZATION_PASSWORD --primary-bundle-id Espressif-ide.app | ||
| - name: Notarize Espressif-IDE-macosx-cocoa-aarch64.dmg | ||
| env: | ||
| NOTARIZATION_USERNAME: ${{ secrets.NOTARIZATION_USERNAME }} | ||
| NOTARIZATION_PASSWORD: ${{ secrets.NOTARIZATION_PASSWORD }} | ||
| run: | | ||
| echo "Notarization of Espressif-IDE-macosx-cocoa-aarch64.dmg" | ||
| xcrun altool --notarize-app -f $PWD/releng/ide-dmg-builder/Espressif-IDE-macosx-cocoa-aarch64.dmg -u $NOTARIZATION_USERNAME -p $NOTARIZATION_PASSWORD --primary-bundle-id Espressif-ide.app | ||
| NOTARIZATION_USERNAME: ${{ secrets.NOTARIZATION_USERNAME }} | ||
| NOTARIZATION_PASSWORD: ${{ secrets.NOTARIZATION_PASSWORD }} | ||
| NOTARIZATION_TEAM_ID: ${{ secrets.NOTARIZATION_TEAM_ID }} | ||
| run: | | ||
| echo "Create notary keychain" | ||
| /usr/bin/security create-keychain -p espressif notary.keychain | ||
| /usr/bin/security default-keychain -s notary.keychain | ||
| /usr/bin/security unlock-keychain -p espressif notary.keychain | ||
| echo "Create keychain profile" | ||
| xcrun notarytool store-credentials "ide-notarytool-profile" --apple-id $NOTARIZATION_USERNAME --team-id $NOTARIZATION_TEAM_ID --password $NOTARIZATION_PASSWORD | ||
| xcrun notarytool submit $PWD/releng/ide-dmg-builder/Espressif-IDE-macosx-cocoa-x86_64.dmg --keychain-profile "ide-notarytool-profile" --wait | ||
|
|
||
| echo "Attach staple for x86_64.dmg" | ||
| xcrun stapler staple $PWD/releng/ide-dmg-builder/Espressif-IDE-macosx-cocoa-x86_64.dmg | ||
|
|
||
| echo "Unlock the notary keychain" | ||
| /usr/bin/security unlock-keychain -p espressif notary.keychain | ||
|
|
||
| xcrun notarytool submit $PWD/releng/ide-dmg-builder/Espressif-IDE-macosx-cocoa-aarch64.dmg --keychain-profile "ide-notarytool-profile" --wait | ||
| echo "Attach staple for aarch64.dmg" | ||
| xcrun stapler staple $PWD/releng/ide-dmg-builder/Espressif-IDE-macosx-cocoa-aarch64.dmg | ||
|
|
There was a problem hiding this comment.
The updated notarization steps appear comprehensive. Consider adding detailed logging for each step to enhance traceability and error handling.
+ echo "Starting notarization for x86_64..."
+ echo "Starting notarization for aarch64..."Committable suggestion was skipped due to low confidence.
Description
Please include a summary of the change and which issue is fixed.
Fixes # (IEP-XXX)
Type of change
Please delete options that are not relevant.
How has this been tested?
Please describe the tests that you ran to verify your changes. Provide instructions so we can reproduce. Please also list any relevant details for your test configuration
Test Configuration:
Dependent components impacted by this PR:
Checklist
Summary by CodeRabbit
NOTARIZATION_TEAM_IDfor enhanced notarization setup.