From a0ae84c71d663e0b009383cda1b7066b88380ece Mon Sep 17 00:00:00 2001 From: Erik Gomez Date: Tue, 21 Mar 2023 10:41:24 -0500 Subject: [PATCH] update gha and use new certs --- .github/workflows/build_python_3.10.yml | 26 ++++++++++++------------- .github/workflows/build_python_3.11.yml | 26 ++++++++++++------------- .github/workflows/build_python_3.9.yml | 26 ++++++++++++------------- build_all_python_frameworks.zsh | 2 +- build_python_framework_pkgs.zsh | 4 ++-- 5 files changed, 42 insertions(+), 42 deletions(-) diff --git a/.github/workflows/build_python_3.10.yml b/.github/workflows/build_python_3.10.yml index 9be13a6..95da687 100644 --- a/.github/workflows/build_python_3.10.yml +++ b/.github/workflows/build_python_3.10.yml @@ -2,8 +2,8 @@ name: Build Python 3.10 env: TYPE: "recommended" - DEV_INSTALLER_ID: "Developer ID Installer: Clever DevOps Co. (9GQZ7KUFR6)" - DEV_APPLICATION_ID: "Developer ID Application: Clever DevOps Co. (9GQZ7KUFR6)" + DEV_INSTALLER_ID: "Developer ID Installer: Mac Admins Open Source (T4SK8ZXCXG)" + DEV_APPLICATION_ID: "Developer ID Application: Mac Admins Open Source (T4SK8ZXCXG)" NOTARY_PASS: ${{ secrets.NOTARY_PASS }} PYTHON_VERSION: "3.10.9" @@ -17,24 +17,24 @@ jobs: steps: - name: Checkout python repo - uses: actions/checkout@v2 + uses: actions/checkout@24cb9080177205b6e8c946b17badbe402adc938f # v3.4.0 with: fetch-depth: 0 - name: Install Apple Developer ID Application certificates - uses: ssrobins/import-codesign-certs@04ce695a5e6002f1971a8ed78fedd676318f950f # Move back to apple-actions/import-codesign-certs when merged + uses: apple-actions/import-codesign-certs@8f3fb608891dd2244cdab3d69cd68c0d37a7fe93 # v2.0.0 with: - keychain-password: ${{ secrets.KEYCHAIN_PASSWORD }} - p12-file-base64: ${{ secrets.DEV_APP_CERTIFICATES_P12 }} - p12-password: ${{ secrets.DEV_APP_CERTIFICATES_P12_PASSWORD }} + keychain-password: ${{ github.run_id }} + p12-file-base64: ${{ secrets.APP_CERTIFICATES_P12_PASSWORD_MAOS }} + p12-password: ${{ secrets.APP_CERTIFICATES_P12_PASSWORD_MAOS_PASSWORD }} - name: Install Apple Developer ID Installer certificates - uses: ssrobins/import-codesign-certs@04ce695a5e6002f1971a8ed78fedd676318f950f # Move back to apple-actions/import-codesign-certs when merged + uses: apple-actions/import-codesign-certs@8f3fb608891dd2244cdab3d69cd68c0d37a7fe93 # v2.0.0 with: create-keychain: false # do not create a new keychain for this value - keychain-password: ${{ secrets.KEYCHAIN_PASSWORD }} - p12-file-base64: ${{ secrets.CERTIFICATES_P12 }} - p12-password: ${{ secrets.CERTIFICATES_P12_PASSWORD }} + keychain-password: ${{ github.run_id }} + p12-file-base64: ${{ secrets.PKG_CERTIFICATES_P12_MAOS }} + p12-password: ${{ secrets.PKG_CERTIFICATES_P12_MAOS_PASSWORD }} - name: Run build package script run: ./build_python_framework_pkgs.zsh "$TYPE" "$DEV_INSTALLER_ID" "$DEV_APPLICATION_ID" "$PYTHON_VERSION" "${NOTARY_PASS}" @@ -46,7 +46,7 @@ jobs: - name: Generate changelog id: changelog - uses: metcalfc/changelog-generator@31b6d6f9e6e17e84ad34bee780f82d8ee79f6842 # v4.0.1 + uses: metcalfc/changelog-generator@afdcb9470aebdb2252c0c95a1c130723c9e21f3a # v4.1 with: myToken: ${{ secrets.GITHUB_TOKEN }} reverse: 'true' @@ -83,7 +83,7 @@ jobs: files: ${{github.workspace}}/outputs/*.pkg - name: Upload packages - uses: actions/upload-artifact@v3.1.1 + uses: actions/upload-artifact@0b7f8abb1508181956e8e162db84b466c27e18ce # v3.1.2 with: name: packages path: outputs/ diff --git a/.github/workflows/build_python_3.11.yml b/.github/workflows/build_python_3.11.yml index c8c3ba9..a587d6c 100644 --- a/.github/workflows/build_python_3.11.yml +++ b/.github/workflows/build_python_3.11.yml @@ -2,8 +2,8 @@ name: Build Python 3.11 env: TYPE: "recommended" - DEV_INSTALLER_ID: "Developer ID Installer: Clever DevOps Co. (9GQZ7KUFR6)" - DEV_APPLICATION_ID: "Developer ID Application: Clever DevOps Co. (9GQZ7KUFR6)" + DEV_INSTALLER_ID: "Developer ID Installer: Mac Admins Open Source (T4SK8ZXCXG)" + DEV_APPLICATION_ID: "Developer ID Application: Mac Admins Open Source (T4SK8ZXCXG)" NOTARY_PASS: ${{ secrets.NOTARY_PASS }} PYTHON_VERSION: "3.11.1" @@ -17,24 +17,24 @@ jobs: steps: - name: Checkout python repo - uses: actions/checkout@v2 + uses: actions/checkout@24cb9080177205b6e8c946b17badbe402adc938f # v3.4.0 with: fetch-depth: 0 - name: Install Apple Developer ID Application certificates - uses: ssrobins/import-codesign-certs@04ce695a5e6002f1971a8ed78fedd676318f950f # Move back to apple-actions/import-codesign-certs when merged + uses: apple-actions/import-codesign-certs@8f3fb608891dd2244cdab3d69cd68c0d37a7fe93 # v2.0.0 with: - keychain-password: ${{ secrets.KEYCHAIN_PASSWORD }} - p12-file-base64: ${{ secrets.DEV_APP_CERTIFICATES_P12 }} - p12-password: ${{ secrets.DEV_APP_CERTIFICATES_P12_PASSWORD }} + keychain-password: ${{ github.run_id }} + p12-file-base64: ${{ secrets.APP_CERTIFICATES_P12_PASSWORD_MAOS }} + p12-password: ${{ secrets.APP_CERTIFICATES_P12_PASSWORD_MAOS_PASSWORD }} - name: Install Apple Developer ID Installer certificates - uses: ssrobins/import-codesign-certs@04ce695a5e6002f1971a8ed78fedd676318f950f # Move back to apple-actions/import-codesign-certs when merged + uses: apple-actions/import-codesign-certs@8f3fb608891dd2244cdab3d69cd68c0d37a7fe93 # v2.0.0 with: create-keychain: false # do not create a new keychain for this value - keychain-password: ${{ secrets.KEYCHAIN_PASSWORD }} - p12-file-base64: ${{ secrets.CERTIFICATES_P12 }} - p12-password: ${{ secrets.CERTIFICATES_P12_PASSWORD }} + keychain-password: ${{ github.run_id }} + p12-file-base64: ${{ secrets.PKG_CERTIFICATES_P12_MAOS }} + p12-password: ${{ secrets.PKG_CERTIFICATES_P12_MAOS_PASSWORD }} - name: Run build package script run: ./build_python_framework_pkgs.zsh "$TYPE" "$DEV_INSTALLER_ID" "$DEV_APPLICATION_ID" "$PYTHON_VERSION" "${NOTARY_PASS}" @@ -46,7 +46,7 @@ jobs: - name: Generate changelog id: changelog - uses: metcalfc/changelog-generator@31b6d6f9e6e17e84ad34bee780f82d8ee79f6842 # v4.0.1 + uses: metcalfc/changelog-generator@afdcb9470aebdb2252c0c95a1c130723c9e21f3a # v4.1 with: myToken: ${{ secrets.GITHUB_TOKEN }} reverse: 'true' @@ -83,7 +83,7 @@ jobs: files: ${{github.workspace}}/outputs/*.pkg - name: Upload packages - uses: actions/upload-artifact@v3.1.1 + uses: actions/upload-artifact@0b7f8abb1508181956e8e162db84b466c27e18ce # v3.1.2 with: name: packages path: outputs/ diff --git a/.github/workflows/build_python_3.9.yml b/.github/workflows/build_python_3.9.yml index 6ae487b..2137666 100644 --- a/.github/workflows/build_python_3.9.yml +++ b/.github/workflows/build_python_3.9.yml @@ -2,8 +2,8 @@ name: Build Python 3.9 env: TYPE: "recommended" - DEV_INSTALLER_ID: "Developer ID Installer: Clever DevOps Co. (9GQZ7KUFR6)" - DEV_APPLICATION_ID: "Developer ID Application: Clever DevOps Co. (9GQZ7KUFR6)" + DEV_INSTALLER_ID: "Developer ID Installer: Mac Admins Open Source (T4SK8ZXCXG)" + DEV_APPLICATION_ID: "Developer ID Application: Mac Admins Open Source (T4SK8ZXCXG)" NOTARY_PASS: ${{ secrets.NOTARY_PASS }} PYTHON_VERSION: "3.9.13" @@ -17,24 +17,24 @@ jobs: steps: - name: Checkout python repo - uses: actions/checkout@v2 + uses: actions/checkout@24cb9080177205b6e8c946b17badbe402adc938f # v3.4.0 with: fetch-depth: 0 - name: Install Apple Developer ID Application certificates - uses: ssrobins/import-codesign-certs@04ce695a5e6002f1971a8ed78fedd676318f950f # Move back to apple-actions/import-codesign-certs when merged + uses: apple-actions/import-codesign-certs@8f3fb608891dd2244cdab3d69cd68c0d37a7fe93 # v2.0.0 with: - keychain-password: ${{ secrets.KEYCHAIN_PASSWORD }} - p12-file-base64: ${{ secrets.DEV_APP_CERTIFICATES_P12 }} - p12-password: ${{ secrets.DEV_APP_CERTIFICATES_P12_PASSWORD }} + keychain-password: ${{ github.run_id }} + p12-file-base64: ${{ secrets.APP_CERTIFICATES_P12_PASSWORD_MAOS }} + p12-password: ${{ secrets.APP_CERTIFICATES_P12_PASSWORD_MAOS_PASSWORD }} - name: Install Apple Developer ID Installer certificates - uses: ssrobins/import-codesign-certs@04ce695a5e6002f1971a8ed78fedd676318f950f # Move back to apple-actions/import-codesign-certs when merged + uses: apple-actions/import-codesign-certs@8f3fb608891dd2244cdab3d69cd68c0d37a7fe93 # v2.0.0 with: create-keychain: false # do not create a new keychain for this value - keychain-password: ${{ secrets.KEYCHAIN_PASSWORD }} - p12-file-base64: ${{ secrets.CERTIFICATES_P12 }} - p12-password: ${{ secrets.CERTIFICATES_P12_PASSWORD }} + keychain-password: ${{ github.run_id }} + p12-file-base64: ${{ secrets.PKG_CERTIFICATES_P12_MAOS }} + p12-password: ${{ secrets.PKG_CERTIFICATES_P12_MAOS_PASSWORD }} - name: Run build package script run: ./build_python_framework_pkgs.zsh "$TYPE" "$DEV_INSTALLER_ID" "$DEV_APPLICATION_ID" "$PYTHON_VERSION" "${NOTARY_PASS}" @@ -46,7 +46,7 @@ jobs: - name: Generate changelog id: changelog - uses: metcalfc/changelog-generator@31b6d6f9e6e17e84ad34bee780f82d8ee79f6842 # v4.0.1 + uses: metcalfc/changelog-generator@afdcb9470aebdb2252c0c95a1c130723c9e21f3a # v4.1 with: myToken: ${{ secrets.GITHUB_TOKEN }} reverse: 'true' @@ -88,7 +88,7 @@ jobs: files: ${{github.workspace}}/outputs/*.pkg - name: Upload packages - uses: actions/upload-artifact@v3.1.1 + uses: actions/upload-artifact@0b7f8abb1508181956e8e162db84b466c27e18ce # v3.1.2 with: name: packages path: outputs/ diff --git a/build_all_python_frameworks.zsh b/build_all_python_frameworks.zsh index 53d1e3b..84948c0 100755 --- a/build_all_python_frameworks.zsh +++ b/build_all_python_frameworks.zsh @@ -6,7 +6,7 @@ # Run this with your current directory being the path where this script is located TOOLSDIR=$(dirname $0) -SIGNING_IDENTITY="Developer ID Installer: Clever DevOps Co. (9GQZ7KUFR6)" +SIGNING_IDENTITY="Developer ID Installer: Mac Admins Open Source (T4SK8ZXCXG)" "$TOOLSDIR/build_python_framework_pkgs.zsh" minimal ${SIGNING_IDENTITY} "$TOOLSDIR/build_python_framework_pkgs.zsh" no_customization ${SIGNING_IDENTITY} diff --git a/build_python_framework_pkgs.zsh b/build_python_framework_pkgs.zsh index 89b60f2..e57f1d2 100755 --- a/build_python_framework_pkgs.zsh +++ b/build_python_framework_pkgs.zsh @@ -245,7 +245,7 @@ if [ -n "$2" ]; then { "ownership": "recommended", "suppress_bundle_relocation": true, - "identifier": "org.macadmins.python.$TYPE", + "identifier": "io.macadmins.python.$TYPE", "postinstall_action": "none", "distribution_style": true, "version": "$AUTOMATED_PYTHON_BUILD", @@ -266,7 +266,7 @@ SIGNED_JSONFILE else if [ -n "$5" ]; then # Notarize and staple the package - $XCODE_NOTARY_PATH store-credentials --apple-id "macadmins@cleverdevops.com" --team-id "9GQZ7KUFR6" --password "$NOTARY_PASS" macadminpython + $XCODE_NOTARY_PATH store-credentials --apple-id "opensource@macadmins.io" --team-id "T4SK8ZXCXG" --password "$NOTARY_PASS" macadminpython # If these fail, it will bail on the entire process $XCODE_NOTARY_PATH submit "$TOOLSDIR/$TYPE/build/python_${TYPE}_signed-$AUTOMATED_PYTHON_BUILD.pkg" --keychain-profile "macadminpython" --wait $XCODE_STAPLER_PATH staple "$TOOLSDIR/$TYPE/build/python_${TYPE}_signed-$AUTOMATED_PYTHON_BUILD.pkg"