macOS Developer ID Application 自分发证书申请与 GitHub Actions 自动化构建

应用程序 > 实用工具 > 钥匙串访问.app

# 转换并复制到剪贴板
base64 -i /path/to/certificate.p12 | pbcopy

name: Build and Release macOS App

on:
  push:
    tags:
      - 'v*.*.*-beta'
      - 'v*.*.*'

jobs:
  build:
    runs-on: macos-latest
    permissions:
      contents: write  # Required for creating releases
    
    steps:
      - name: Checkout code
        uses: actions/checkout@v4
      
      # 重要：Python 3.12+ 移除了 distutils，导致 node-gyp 编译失败
      # 使用 Python 3.11 或更早版本来编译原生模块
      - name: Setup Python
        uses: actions/setup-python@v5
        with:
          python-version: '3.11'
      
      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: '22.14.0'
      
      - name: Setup pnpm
        uses: pnpm/action-setup@v3
        with:
          version: 8
      
      - name: Import Apple Developer Certificate
        env:
          BUILD_CERTIFICATE_BASE64: ${{ secrets.MACOS_CERTIFICATE }}
          P12_PASSWORD: ${{ secrets.MACOS_CERTIFICATE_PWD }}
          KEYCHAIN_PASSWORD: ${{ secrets.KEYCHAIN_PASSWORD || 'temp_keychain_password_123456' }}
        run: |
          # Create temporary keychain
          security create-keychain -p "$KEYCHAIN_PASSWORD" build.keychain
          security default-keychain -s build.keychain
          security unlock-keychain -p "$KEYCHAIN_PASSWORD" build.keychain
          security set-keychain-settings -t 3600 -u build.keychain
          
          # Import certificate
          echo $BUILD_CERTIFICATE_BASE64 | base64 --decode > certificate.p12
          security import certificate.p12 -k build.keychain -P "$P12_PASSWORD" -T /usr/bin/codesign
          security set-key-partition-list -S apple-tool:,apple:,codesign: -s -k "$KEYCHAIN_PASSWORD" build.keychain
          
          # 重要：自动提取证书身份，去掉 "Developer ID Application:" 前缀
          # electron-builder 不接受带前缀的证书名称
          CERT_IDENTITY=$(security find-identity -v -p codesigning build.keychain | grep "Developer ID Application" | head -1 | sed -n 's/.*"Developer ID Application: \(.*\)"/\1/p')
          if [ -z "$CERT_IDENTITY" ]; then
            echo "❌ Error: Failed to extract certificate identity from keychain"
            echo "Available identities:"
            security find-identity -v -p codesigning build.keychain
            exit 1
          fi
          echo "CSC_IDENTITY=$CERT_IDENTITY" >> $GITHUB_ENV
          echo "✓ Certificate identity extracted: $CERT_IDENTITY"
          
          # Clean up certificate file
          rm certificate.p12
      
      - name: Install dependencies
        run: pnpm install
      
      - name: Build application
        run: pnpm run build
      
      - name: Package application
        run: pnpm run pkg:mac:prod
        env:
          # CSC_IDENTITY 已在上一步自动设置到 GITHUB_ENV
          # 公证凭据（可选，如需公证）
          APPLE_ID: ${{ secrets.APPLE_ID }}
          APPLE_APP_SPECIFIC_PASSWORD: ${{ secrets.APPLE_APP_SPECIFIC_PASSWORD }}
          APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
      
      - name: Upload to GitHub Release
        uses: softprops/action-gh-release@v1
        with:
          files: |
            dist-electron/*.dmg
            dist-electron/*.zip
            dist-electron/latest-mac.yml
          prerelease: ${{ contains(github.ref_name, 'beta') }}
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
      
      - name: Clean up keychain
        if: always()
        run: |
          security delete-keychain build.keychain || true

const baseConfig = {
  appId: 'com.example.myapp',
  productName: 'MyApp',
  mac: {
    target: [
      { target: 'dmg', arch: ['arm64'] },
      { target: 'zip', arch: ['arm64'] }
    ],
    icon: 'build/logo.png',
    category: 'public.app-category.productivity',
    hardenedRuntime: true,
    gatekeeperAssess: false,
    entitlements: 'build/entitlements.mac.plist',
    entitlementsInherit: 'build/entitlements.mac.inherit.plist',
    // 关键：让 electron-builder 从环境变量读取证书身份
    // undefined 时会自动在 keychain 中查找
    identity: process.env.CSC_IDENTITY,
    // 使用自定义公证脚本
    notarize: false
  }
};

const config = {
  development: {
    ...baseConfig,
    appId: 'com.example.myapp.dev',
    mac: {
      ...baseConfig.mac,
      identity: null  // 开发环境不签名
    }
  },
  production: {
    ...baseConfig,
    // 生产环境启用公证
    afterSign: 'notarize.cjs'
  }
};

const env = process.env.NODE_ENV || 'production';
export default config[env] || config.production;

const { notarize } = require('@electron/notarize');

exports.default = async function notarizing(context) {
  const { electronPlatformName, appOutDir } = context;
  
  if (electronPlatformName !== 'darwin') {
    return;
  }

  const appName = context.packager.appInfo.productFilename;
  const appPath = `${appOutDir}/${appName}.app`;
  // 重要：从 context 动态获取 Bundle ID，确保一致性
  const appBundleId = context.packager.appInfo.id;

  const appleId = process.env.APPLE_ID;
  const appleIdPassword = process.env.APPLE_APP_SPECIFIC_PASSWORD;
  const teamId = process.env.APPLE_TEAM_ID;

  // 凭据缺失时优雅跳过
  if (!appleId || !appleIdPassword || !teamId) {
    console.log('⏭️  Skipping notarization: missing Apple credentials');
    return;
  }

  console.log('🔐 Starting Apple notarization...');
  
  await notarize({
    tool: 'notarytool',
    appBundleId: appBundleId,  // 使用动态获取的 ID
    appPath: appPath,
    appleId: appleId,
    appleIdPassword: appleIdPassword,
    teamId: teamId,
  });

  console.log('✅ Notarization completed');
};

- name: Setup Python
  uses: actions/setup-python@v5
  with:
    python-version: '3.11'

CSC_IDENTITY="Developer ID Application: Your Name (TEAM_ID)"  # ❌

CSC_IDENTITY="Your Name (TEAM_ID)"  # ✅

# 使用 sed 去掉前缀
CERT_IDENTITY=$(security find-identity -v -p codesigning build.keychain | \
  grep "Developer ID Application" | head -1 | \
  sed -n 's/.*"Developer ID Application: \(.*\)"/\1/p')

// ❌ 错误
identity: process.env.CSC_IDENTITY || null

// ✅ 正确 - undefined 时自动检测
identity: process.env.CSC_IDENTITY

// ❌ 错误 - 硬编码
appBundleId: 'com.example.wrongapp'

// ✅ 正确 - 动态获取
const appBundleId = context.packager.appInfo.id;

{
  "scripts": {
    "postinstall": "electron-rebuild -f -w native-module-name"
  }
}

# 查看所有代码签名证书
security find-identity -v -p codesigning

# 查看特定 keychain 中的证书
security find-identity -v -p codesigning build.keychain

# 验证应用签名
codesign -vvv --deep --strict MyApp.app

# 验证 Gatekeeper 评估
spctl -a -vv -t exec MyApp.app

# 从 p12 文件提取证书信息
openssl pkcs12 -in certificate.p12 -nokeys -passin pass:YOUR_PASSWORD | \
  openssl x509 -noout -subject