From 0fff66eec446d2836878567c87a7edbe558ab33a Mon Sep 17 00:00:00 2001 From: Darshan Sen Date: Fri, 19 Jun 2026 19:12:36 +0530 Subject: [PATCH 01/10] Support MAS build Signed-off-by: Darshan Sen --- make-pear-app/action.yml | 8 +++++++- setup-certificates/macos/action.yml | 16 ++++++++++++++++ 2 files changed, 23 insertions(+), 1 deletion(-) diff --git a/make-pear-app/action.yml b/make-pear-app/action.yml index 75f24af..cb28a9e 100644 --- a/make-pear-app/action.yml +++ b/make-pear-app/action.yml @@ -57,6 +57,10 @@ inputs: description: 'UUID that identifies the API key issuer' required: false default: '' + macos_provisioning_profile_base64: + description: 'Base64-encoded Apple provisioning profile for MAS build (mobileprovision)' + required: false + default: '' windows_msix: description: 'Windows MSIX to upload' required: false @@ -130,6 +134,7 @@ runs: api_key_base64: ${{ inputs.macos_api_key_base64 }} api_key_id: ${{ inputs.macos_api_key_id }} api_issuer: ${{ inputs.macos_api_issuer }} + provisioning_profile_base64: ${{ inputs.macos_provisioning_profile_base64 }} - name: 'Setup certificates on Windows' id: setup-certificates-windows if: ${{ runner.os == 'Windows' }} @@ -159,9 +164,10 @@ runs: UPGRADE_KEY: "${{ inputs.upgrade_key != '' && inputs.upgrade_key || null }}" MAC_CODESIGN_IDENTITY: '${{ inputs.macos_codesign_identity }}' KEYCHAIN_PROFILE: ${{ steps.setup-certificates-macos.outputs.keychain-profile }} + MAS_PROVISIONING_PROFILE: ${{ steps.setup-certificates-macos.outputs.provisioning-profile }} NODE_ENV: production run: | - npm run make + npm run make -- --platform=mas shell: bash - name: 'Build application (Windows)' if: ${{ runner.os == 'Windows' }} diff --git a/setup-certificates/macos/action.yml b/setup-certificates/macos/action.yml index 67ea6ba..401c695 100644 --- a/setup-certificates/macos/action.yml +++ b/setup-certificates/macos/action.yml @@ -35,11 +35,18 @@ inputs: description: 'UUID that identifies the API key issuer' required: false default: '' + provisioning_profile_base64: + description: 'Base64-encoded Apple provisioning profile for MAS build (mobileprovision)' + required: false + default: '' outputs: keychain-profile: description: 'Keychain profile' value: ${{ steps.setup-certificates.outputs.keychain_profile }} + provisioning-profile: + description: 'Provisioning profile' + value: ${{ steps.setup-certificates.outputs.provisioning_profile }} runs: using: composite @@ -57,15 +64,19 @@ runs: APPLE_ID: ${{ inputs.apple_id }} APPLE_PASSWORD: ${{ inputs.apple_password }} APPLE_TEAM_ID: ${{ inputs.apple_team_id }} + PROVISIONING_PROFILE_BASE64: ${{ inputs.provisioning_profile_base64 }} run: | # create variables CERTIFICATE_PATH=$RUNNER_TEMP/build_certificate.p12 + PP_PATH=$RUNNER_TEMP/app.mas.provisionprofile KEYCHAIN_PATH=$RUNNER_TEMP/app-signing.keychain-db KEYCHAIN_PASSWORD=keychain-password KEYCHAIN_PROFILE=notary # import certificate and API key from secrets echo -n "$CERTIFICATE_BASE64" | base64 --decode -o $CERTIFICATE_PATH + echo -n "$PROVISIONING_PROFILE_BASE64" | base64 --decode -o "$PP_PATH" + # create temporary keychain security create-keychain -p "$KEYCHAIN_PASSWORD" $KEYCHAIN_PATH security set-keychain-settings -lut 21600 $KEYCHAIN_PATH @@ -95,5 +106,10 @@ runs: --keychain "$KEYCHAIN_PATH" fi + # apply provisioning profile + mkdir -p ~/Library/MobileDevice/Provisioning\ Profiles + cp "$PP_PATH" ~/Library/MobileDevice/Provisioning\ Profiles/app.mas.provisionprofile + echo "keychain_profile=$KEYCHAIN_PROFILE" >> $GITHUB_OUTPUT + echo "provisioning_profile=$PP_PATH" >> $GITHUB_OUTPUT shell: bash From 3a5c6f4a1bbeb447ac0b9098cac9e87071a75499 Mon Sep 17 00:00:00 2001 From: Darshan Sen Date: Fri, 19 Jun 2026 19:26:22 +0530 Subject: [PATCH 02/10] Use my fork Signed-off-by: Darshan Sen --- make-pear-app/action.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/make-pear-app/action.yml b/make-pear-app/action.yml index cb28a9e..9560133 100644 --- a/make-pear-app/action.yml +++ b/make-pear-app/action.yml @@ -123,7 +123,7 @@ runs: - name: 'Setup certificates on macOS' id: setup-certificates-macos if: ${{ runner.os == 'macOS' }} - uses: holepunchto/actions/setup-certificates/macos@v1 + uses: RaisinTen/actions/setup-certificates/macos@support-mas-build with: certificate_base64: ${{ inputs.macos_certificate_base64 }} p12_password: ${{ inputs.macos_p12_password }} From 8475b478a39b19fc640c59a51ee0c63d1530e546 Mon Sep 17 00:00:00 2001 From: Darshan Sen Date: Fri, 19 Jun 2026 19:28:07 +0530 Subject: [PATCH 03/10] Add logging Signed-off-by: Darshan Sen --- make-pear-app/action.yml | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/make-pear-app/action.yml b/make-pear-app/action.yml index 9560133..a57c22a 100644 --- a/make-pear-app/action.yml +++ b/make-pear-app/action.yml @@ -123,7 +123,7 @@ runs: - name: 'Setup certificates on macOS' id: setup-certificates-macos if: ${{ runner.os == 'macOS' }} - uses: RaisinTen/actions/setup-certificates/macos@support-mas-build + uses: RaisinTen/actions/setup-certificates/macos@support-mas-build # TODO with: certificate_base64: ${{ inputs.macos_certificate_base64 }} p12_password: ${{ inputs.macos_p12_password }} @@ -168,6 +168,7 @@ runs: NODE_ENV: production run: | npm run make -- --platform=mas + file out/make/* # TODO shell: bash - name: 'Build application (Windows)' if: ${{ runner.os == 'Windows' }} From a0ee605fbaad31a9f7be53670fd1739173667621 Mon Sep 17 00:00:00 2001 From: Darshan Sen Date: Fri, 19 Jun 2026 19:43:47 +0530 Subject: [PATCH 04/10] Use my fork Signed-off-by: Darshan Sen --- make-pear-app/action.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/make-pear-app/action.yml b/make-pear-app/action.yml index a57c22a..35a89cd 100644 --- a/make-pear-app/action.yml +++ b/make-pear-app/action.yml @@ -138,14 +138,14 @@ runs: - name: 'Setup certificates on Windows' id: setup-certificates-windows if: ${{ runner.os == 'Windows' }} - uses: holepunchto/actions/setup-certificates/windows@v1 + uses: RaisinTen/actions/setup-certificates/windows@support-mas-build # TODO with: signing_method: ${{ inputs.windows_signing_method }} cert_pfx_base64: ${{ inputs.windows_cert_pfx_base64 }} cert_password: ${{ inputs.windows_cert_password }} - name: 'Set up Snapcraft' if: ${{ runner.os == 'Linux' && inputs.linux_snap != '' }} - uses: holepunchto/actions/setup-snapcraft@v1 + uses: RaisinTen/actions/setup-snapcraft@support-mas-build # TODO - name: 'Build application (Linux)' if: ${{ runner.os == 'Linux' }} env: From b02a37affa48fd6acf274b86c99415adffe5349d Mon Sep 17 00:00:00 2001 From: Darshan Sen Date: Fri, 19 Jun 2026 19:59:11 +0530 Subject: [PATCH 05/10] Find identity Signed-off-by: Darshan Sen --- make-pear-app/action.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/make-pear-app/action.yml b/make-pear-app/action.yml index 35a89cd..8d410df 100644 --- a/make-pear-app/action.yml +++ b/make-pear-app/action.yml @@ -167,6 +167,7 @@ runs: MAS_PROVISIONING_PROFILE: ${{ steps.setup-certificates-macos.outputs.provisioning-profile }} NODE_ENV: production run: | + security find-identity -v npm run make -- --platform=mas file out/make/* # TODO shell: bash From 63470ad5eac9ff08fb3d83b13aa9ec5c8adeca9e Mon Sep 17 00:00:00 2001 From: Darshan Sen Date: Mon, 22 Jun 2026 14:23:27 +0530 Subject: [PATCH 06/10] Add more logs Signed-off-by: Darshan Sen --- make-pear-app/action.yml | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/make-pear-app/action.yml b/make-pear-app/action.yml index 8d410df..9b7624e 100644 --- a/make-pear-app/action.yml +++ b/make-pear-app/action.yml @@ -166,8 +166,12 @@ runs: KEYCHAIN_PROFILE: ${{ steps.setup-certificates-macos.outputs.keychain-profile }} MAS_PROVISIONING_PROFILE: ${{ steps.setup-certificates-macos.outputs.provisioning-profile }} NODE_ENV: production + DEBUG: '*' run: | + echo "Logging identities" security find-identity -v + echo "Logging identities in keychain" + security find-identity -v $KEYCHAIN_PROFILE npm run make -- --platform=mas file out/make/* # TODO shell: bash From f661bd98bbd58a5a465d0aba37f5bd1c2828551e Mon Sep 17 00:00:00 2001 From: Darshan Sen Date: Mon, 22 Jun 2026 14:27:51 +0530 Subject: [PATCH 07/10] Debug only electron-* Signed-off-by: Darshan Sen --- make-pear-app/action.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/make-pear-app/action.yml b/make-pear-app/action.yml index 9b7624e..45a9618 100644 --- a/make-pear-app/action.yml +++ b/make-pear-app/action.yml @@ -166,7 +166,7 @@ runs: KEYCHAIN_PROFILE: ${{ steps.setup-certificates-macos.outputs.keychain-profile }} MAS_PROVISIONING_PROFILE: ${{ steps.setup-certificates-macos.outputs.provisioning-profile }} NODE_ENV: production - DEBUG: '*' + DEBUG: 'electron-*' run: | echo "Logging identities" security find-identity -v From 53e1e9c337112de2f8dc7a9242add15fabd42ba2 Mon Sep 17 00:00:00 2001 From: Darshan Sen Date: Mon, 22 Jun 2026 17:40:19 +0530 Subject: [PATCH 08/10] Just package the app without pkg Signed-off-by: Darshan Sen --- make-pear-app/action.yml | 8 ++------ 1 file changed, 2 insertions(+), 6 deletions(-) diff --git a/make-pear-app/action.yml b/make-pear-app/action.yml index 45a9618..f15737b 100644 --- a/make-pear-app/action.yml +++ b/make-pear-app/action.yml @@ -168,12 +168,8 @@ runs: NODE_ENV: production DEBUG: 'electron-*' run: | - echo "Logging identities" - security find-identity -v - echo "Logging identities in keychain" - security find-identity -v $KEYCHAIN_PROFILE - npm run make -- --platform=mas - file out/make/* # TODO + npm run package -- --platform=mas + file out/* # TODO shell: bash - name: 'Build application (Windows)' if: ${{ runner.os == 'Windows' }} From d36eb30a0b0f68f900eeb01d77901d34dbf5e705 Mon Sep 17 00:00:00 2001 From: Darshan Sen Date: Mon, 22 Jun 2026 18:14:29 +0530 Subject: [PATCH 09/10] Upload MAS ZIP Signed-off-by: Darshan Sen --- make-pear-app/action.yml | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) diff --git a/make-pear-app/action.yml b/make-pear-app/action.yml index f15737b..dd1627d 100644 --- a/make-pear-app/action.yml +++ b/make-pear-app/action.yml @@ -17,6 +17,10 @@ inputs: description: 'macOS DMG to upload' required: false default: '' + macos_mas_zip: + description: 'macOS MAS ZIP to upload' + required: false + default: '' macos_certificate_base64: description: 'Base64-encoded Apple distribution certificate (P12 format)' required: false @@ -183,6 +187,12 @@ runs: run: | npm run make shell: pwsh + - name: Create MAS ZIP + if: ${{ runner.os == 'macOS' }} + run: | + ditto -c -k --sequesterRsrc --keepParent \ + out/Keet-Internal-mas-arm64/Keet-Internal.app \ + out/Keet-Internal-mas-arm64.zip - name: 'Upload standalone executable artifact' if: ${{ inputs.standalone != '' }} uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0 @@ -218,6 +228,13 @@ runs: name: ${{ inputs.macos_dmg }} path: out/make/**/${{ inputs.macos_dmg }} if-no-files-found: error + - name: 'Upload macOS MAS ZIP artifact' + if: ${{ runner.os == 'macOS' && inputs.macos_mas_zip != '' }} + uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0 + with: + name: ${{ inputs.macos_mas_zip }} + path: out/${{ inputs.macos_mas_zip }} + if-no-files-found: error - name: 'Upload Windows MSIX artifact' if: ${{ runner.os == 'Windows' && inputs.windows_msix != '' }} uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0 From 47b23bfe3a86b7e05fcc299dd1c7f4b9115758bc Mon Sep 17 00:00:00 2001 From: Darshan Sen Date: Mon, 22 Jun 2026 18:16:15 +0530 Subject: [PATCH 10/10] Add shell Signed-off-by: Darshan Sen --- make-pear-app/action.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/make-pear-app/action.yml b/make-pear-app/action.yml index dd1627d..e8039a2 100644 --- a/make-pear-app/action.yml +++ b/make-pear-app/action.yml @@ -193,6 +193,7 @@ runs: ditto -c -k --sequesterRsrc --keepParent \ out/Keet-Internal-mas-arm64/Keet-Internal.app \ out/Keet-Internal-mas-arm64.zip + shell: bash - name: 'Upload standalone executable artifact' if: ${{ inputs.standalone != '' }} uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0