Skip to content

Commit 1121df4

Browse files
author
Evgeniy
committed
Fix CI: use env vars instead of secrets in step-level if conditions
GitHub Actions does not allow secrets context in step-level if expressions directly. Use a detect step that sets CODESIGN_ENABLED/NOTARIZE_ENABLED env vars via GITHUB_ENV, then reference env.X in subsequent if conditions.
1 parent 9e2517e commit 1121df4

1 file changed

Lines changed: 70 additions & 37 deletions

File tree

‎.github/workflows/build.yml‎

Lines changed: 70 additions & 37 deletions
Original file line numberDiff line numberDiff line change
@@ -7,10 +7,6 @@ on:
77
pull_request:
88
branches: [ main ]
99

10-
env:
11-
KEYCHAIN_NAME: build.keychain-db
12-
KEYCHAIN_PASSWORD: ${{ secrets.MACOS_KEYCHAIN_PASSWORD }}
13-
1410
jobs:
1511
test:
1612
name: Run Tests
@@ -43,12 +39,32 @@ jobs:
4339
- name: Select Xcode
4440
run: sudo xcode-select -s /Applications/Xcode_15.4.app/Contents/Developer || sudo xcode-select -s /Applications/Xcode.app/Contents/Developer
4541

46-
- name: Setup codesigning
47-
if: ${{ secrets.MACOS_CERTIFICATE_P12 != '' }}
42+
- name: Detect codesigning configuration
43+
env:
44+
HAS_CERT: ${{ secrets.MACOS_CERTIFICATE_P12 }}
45+
HAS_NOTARIZE: ${{ secrets.MACOS_NOTARIZATION_APPLE_ID }}
46+
run: |
47+
if [ -n "$HAS_CERT" ]; then
48+
echo "CODESIGN_ENABLED=true" >> $GITHUB_ENV
49+
else
50+
echo "CODESIGN_ENABLED=false" >> $GITHUB_ENV
51+
fi
52+
if [ -n "$HAS_NOTARIZE" ]; then
53+
echo "NOTARIZE_ENABLED=true" >> $GITHUB_ENV
54+
else
55+
echo "NOTARIZE_ENABLED=false" >> $GITHUB_ENV
56+
fi
57+
58+
- name: Setup codesigning keychain
59+
if: env.CODESIGN_ENABLED == 'true'
4860
env:
4961
CERTIFICATE_P12: ${{ secrets.MACOS_CERTIFICATE_P12 }}
5062
CERTIFICATE_PASSWORD: ${{ secrets.MACOS_CERTIFICATE_PASSWORD }}
63+
KEYCHAIN_PASSWORD: ${{ secrets.MACOS_KEYCHAIN_PASSWORD }}
5164
run: |
65+
KEYCHAIN_NAME="build.keychain-db"
66+
echo "KEYCHAIN_NAME=$KEYCHAIN_NAME" >> $GITHUB_ENV
67+
5268
# Decode certificate
5369
echo "$CERTIFICATE_P12" | base64 --decode > certificate.p12
5470
@@ -75,13 +91,6 @@ jobs:
7591
rm certificate.p12
7692
7793
echo "CODESIGN_IDENTITY=${{ secrets.MACOS_SIGNING_IDENTITY }}" >> $GITHUB_ENV
78-
echo "CODESIGN_ENABLED=true" >> $GITHUB_ENV
79-
80-
- name: Set ad-hoc signing (fallback)
81-
if: ${{ secrets.MACOS_CERTIFICATE_P12 == '' }}
82-
run: |
83-
echo "CODESIGN_IDENTITY=-" >> $GITHUB_ENV
84-
echo "CODESIGN_ENABLED=false" >> $GITHUB_ENV
8594
8695
- name: Build arm64
8796
run: |
@@ -166,7 +175,7 @@ jobs:
166175
ditto -c -k --sequesterRsrc --keepParent "$APP_PATH" "LangSwitcher-${VERSION}-arm64.zip"
167176
168177
- name: Notarize DMG
169-
if: ${{ secrets.MACOS_CERTIFICATE_P12 != '' && secrets.MACOS_NOTARIZATION_APPLE_ID != '' }}
178+
if: env.CODESIGN_ENABLED == 'true' && env.NOTARIZE_ENABLED == 'true'
170179
env:
171180
APPLE_ID: ${{ secrets.MACOS_NOTARIZATION_APPLE_ID }}
172181
APPLE_PASSWORD: ${{ secrets.MACOS_NOTARIZATION_PASSWORD }}
@@ -183,7 +192,7 @@ jobs:
183192
xcrun stapler staple "$DMG_NAME"
184193
185194
- name: Cleanup keychain
186-
if: ${{ always() && secrets.MACOS_CERTIFICATE_P12 != '' }}
195+
if: always() && env.CODESIGN_ENABLED == 'true'
187196
run: |
188197
security delete-keychain "$KEYCHAIN_NAME" 2>/dev/null || true
189198
@@ -212,12 +221,31 @@ jobs:
212221
- name: Select Xcode
213222
run: sudo xcode-select -s /Applications/Xcode_15.4.app/Contents/Developer || sudo xcode-select -s /Applications/Xcode.app/Contents/Developer
214223

215-
- name: Setup codesigning
216-
if: ${{ secrets.MACOS_CERTIFICATE_P12 != '' }}
224+
- name: Detect codesigning configuration
225+
env:
226+
HAS_CERT: ${{ secrets.MACOS_CERTIFICATE_P12 }}
227+
HAS_NOTARIZE: ${{ secrets.MACOS_NOTARIZATION_APPLE_ID }}
228+
run: |
229+
if [ -n "$HAS_CERT" ]; then
230+
echo "CODESIGN_ENABLED=true" >> $GITHUB_ENV
231+
else
232+
echo "CODESIGN_ENABLED=false" >> $GITHUB_ENV
233+
fi
234+
if [ -n "$HAS_NOTARIZE" ]; then
235+
echo "NOTARIZE_ENABLED=true" >> $GITHUB_ENV
236+
else
237+
echo "NOTARIZE_ENABLED=false" >> $GITHUB_ENV
238+
fi
239+
240+
- name: Setup codesigning keychain
241+
if: env.CODESIGN_ENABLED == 'true'
217242
env:
218243
CERTIFICATE_P12: ${{ secrets.MACOS_CERTIFICATE_P12 }}
219244
CERTIFICATE_PASSWORD: ${{ secrets.MACOS_CERTIFICATE_PASSWORD }}
245+
KEYCHAIN_PASSWORD: ${{ secrets.MACOS_KEYCHAIN_PASSWORD }}
220246
run: |
247+
KEYCHAIN_NAME="build.keychain-db"
248+
echo "KEYCHAIN_NAME=$KEYCHAIN_NAME" >> $GITHUB_ENV
221249
echo "$CERTIFICATE_P12" | base64 --decode > certificate.p12
222250
security create-keychain -p "$KEYCHAIN_PASSWORD" "$KEYCHAIN_NAME"
223251
security set-keychain-settings -lut 21600 "$KEYCHAIN_NAME"
@@ -232,13 +260,6 @@ jobs:
232260
security list-keychains -d user -s "$KEYCHAIN_NAME" $(security list-keychains -d user | tr -d '"')
233261
rm certificate.p12
234262
echo "CODESIGN_IDENTITY=${{ secrets.MACOS_SIGNING_IDENTITY }}" >> $GITHUB_ENV
235-
echo "CODESIGN_ENABLED=true" >> $GITHUB_ENV
236-
237-
- name: Set ad-hoc signing (fallback)
238-
if: ${{ secrets.MACOS_CERTIFICATE_P12 == '' }}
239-
run: |
240-
echo "CODESIGN_IDENTITY=-" >> $GITHUB_ENV
241-
echo "CODESIGN_ENABLED=false" >> $GITHUB_ENV
242263
243264
- name: Build x86_64
244265
run: |
@@ -322,7 +343,7 @@ jobs:
322343
ditto -c -k --sequesterRsrc --keepParent "$APP_PATH" "LangSwitcher-${VERSION}-x86_64.zip"
323344
324345
- name: Notarize DMG
325-
if: ${{ secrets.MACOS_CERTIFICATE_P12 != '' && secrets.MACOS_NOTARIZATION_APPLE_ID != '' }}
346+
if: env.CODESIGN_ENABLED == 'true' && env.NOTARIZE_ENABLED == 'true'
326347
env:
327348
APPLE_ID: ${{ secrets.MACOS_NOTARIZATION_APPLE_ID }}
328349
APPLE_PASSWORD: ${{ secrets.MACOS_NOTARIZATION_PASSWORD }}
@@ -339,7 +360,7 @@ jobs:
339360
xcrun stapler staple "$DMG_NAME"
340361
341362
- name: Cleanup keychain
342-
if: ${{ always() && secrets.MACOS_CERTIFICATE_P12 != '' }}
363+
if: always() && env.CODESIGN_ENABLED == 'true'
343364
run: |
344365
security delete-keychain "$KEYCHAIN_NAME" 2>/dev/null || true
345366
@@ -368,12 +389,31 @@ jobs:
368389
- name: Select Xcode
369390
run: sudo xcode-select -s /Applications/Xcode_15.4.app/Contents/Developer || sudo xcode-select -s /Applications/Xcode.app/Contents/Developer
370391

371-
- name: Setup codesigning
372-
if: ${{ secrets.MACOS_CERTIFICATE_P12 != '' }}
392+
- name: Detect codesigning configuration
393+
env:
394+
HAS_CERT: ${{ secrets.MACOS_CERTIFICATE_P12 }}
395+
HAS_NOTARIZE: ${{ secrets.MACOS_NOTARIZATION_APPLE_ID }}
396+
run: |
397+
if [ -n "$HAS_CERT" ]; then
398+
echo "CODESIGN_ENABLED=true" >> $GITHUB_ENV
399+
else
400+
echo "CODESIGN_ENABLED=false" >> $GITHUB_ENV
401+
fi
402+
if [ -n "$HAS_NOTARIZE" ]; then
403+
echo "NOTARIZE_ENABLED=true" >> $GITHUB_ENV
404+
else
405+
echo "NOTARIZE_ENABLED=false" >> $GITHUB_ENV
406+
fi
407+
408+
- name: Setup codesigning keychain
409+
if: env.CODESIGN_ENABLED == 'true'
373410
env:
374411
CERTIFICATE_P12: ${{ secrets.MACOS_CERTIFICATE_P12 }}
375412
CERTIFICATE_PASSWORD: ${{ secrets.MACOS_CERTIFICATE_PASSWORD }}
413+
KEYCHAIN_PASSWORD: ${{ secrets.MACOS_KEYCHAIN_PASSWORD }}
376414
run: |
415+
KEYCHAIN_NAME="build.keychain-db"
416+
echo "KEYCHAIN_NAME=$KEYCHAIN_NAME" >> $GITHUB_ENV
377417
echo "$CERTIFICATE_P12" | base64 --decode > certificate.p12
378418
security create-keychain -p "$KEYCHAIN_PASSWORD" "$KEYCHAIN_NAME"
379419
security set-keychain-settings -lut 21600 "$KEYCHAIN_NAME"
@@ -388,13 +428,6 @@ jobs:
388428
security list-keychains -d user -s "$KEYCHAIN_NAME" $(security list-keychains -d user | tr -d '"')
389429
rm certificate.p12
390430
echo "CODESIGN_IDENTITY=${{ secrets.MACOS_SIGNING_IDENTITY }}" >> $GITHUB_ENV
391-
echo "CODESIGN_ENABLED=true" >> $GITHUB_ENV
392-
393-
- name: Set ad-hoc signing (fallback)
394-
if: ${{ secrets.MACOS_CERTIFICATE_P12 == '' }}
395-
run: |
396-
echo "CODESIGN_IDENTITY=-" >> $GITHUB_ENV
397-
echo "CODESIGN_ENABLED=false" >> $GITHUB_ENV
398431
399432
- name: Build Universal (arm64 + x86_64)
400433
run: |
@@ -478,7 +511,7 @@ jobs:
478511
ditto -c -k --sequesterRsrc --keepParent "$APP_PATH" "LangSwitcher-${VERSION}-universal.zip"
479512
480513
- name: Notarize DMG
481-
if: ${{ secrets.MACOS_CERTIFICATE_P12 != '' && secrets.MACOS_NOTARIZATION_APPLE_ID != '' }}
514+
if: env.CODESIGN_ENABLED == 'true' && env.NOTARIZE_ENABLED == 'true'
482515
env:
483516
APPLE_ID: ${{ secrets.MACOS_NOTARIZATION_APPLE_ID }}
484517
APPLE_PASSWORD: ${{ secrets.MACOS_NOTARIZATION_PASSWORD }}
@@ -495,7 +528,7 @@ jobs:
495528
xcrun stapler staple "$DMG_NAME"
496529
497530
- name: Cleanup keychain
498-
if: ${{ always() && secrets.MACOS_CERTIFICATE_P12 != '' }}
531+
if: always() && env.CODESIGN_ENABLED == 'true'
499532
run: |
500533
security delete-keychain "$KEYCHAIN_NAME" 2>/dev/null || true
501534

0 commit comments

Comments
 (0)