Support MAS build

make-pear-app/action.yml

@@ -17,6 +17,10 @@ inputs:
     description: 'macOS DMG to upload'
     required: false
     default: ''
+  macos_mas_zip:
+    description: 'macOS MAS ZIP to upload'
+    required: false
+    default: ''
   macos_certificate_base64:
     description: 'Base64-encoded Apple distribution certificate (P12 format)'
     required: false
@@ -57,6 +61,10 @@ inputs:
     description: 'UUID that identifies the API key issuer'
     required: false
     default: ''
+  macos_provisioning_profile_base64:
+    description: 'Base64-encoded Apple provisioning profile for MAS build (mobileprovision)'
+    required: false
+    default: ''
   windows_msix:
     description: 'Windows MSIX to upload'
     required: false
@@ -119,7 +127,7 @@ runs:
     - name: 'Setup certificates on macOS'
       id: setup-certificates-macos
       if: ${{ runner.os == 'macOS' }}
-      uses: holepunchto/actions/setup-certificates/macos@v1
+      uses: RaisinTen/actions/setup-certificates/macos@support-mas-build # TODO
       with:
         certificate_base64: ${{ inputs.macos_certificate_base64 }}
         p12_password: ${{ inputs.macos_p12_password }}
@@ -130,17 +138,18 @@ runs:
         api_key_base64: ${{ inputs.macos_api_key_base64 }}
         api_key_id: ${{ inputs.macos_api_key_id }}
         api_issuer: ${{ inputs.macos_api_issuer }}
+        provisioning_profile_base64: ${{ inputs.macos_provisioning_profile_base64 }}
     - name: 'Setup certificates on Windows'
       id: setup-certificates-windows
       if: ${{ runner.os == 'Windows' }}
-      uses: holepunchto/actions/setup-certificates/windows@v1
+      uses: RaisinTen/actions/setup-certificates/windows@support-mas-build # TODO
       with:
         signing_method: ${{ inputs.windows_signing_method }}
         cert_pfx_base64: ${{ inputs.windows_cert_pfx_base64 }}
         cert_password: ${{ inputs.windows_cert_password }}
     - name: 'Set up Snapcraft'
       if: ${{ runner.os == 'Linux' && inputs.linux_snap != '' }}
-      uses: holepunchto/actions/setup-snapcraft@v1
+      uses: RaisinTen/actions/setup-snapcraft@support-mas-build # TODO
     - name: 'Build application (Linux)'
       if: ${{ runner.os == 'Linux' }}
       env:
@@ -159,9 +168,12 @@ runs:
         UPGRADE_KEY: "${{ inputs.upgrade_key != '' && inputs.upgrade_key || null }}"
         MAC_CODESIGN_IDENTITY: '${{ inputs.macos_codesign_identity }}'
         KEYCHAIN_PROFILE: ${{ steps.setup-certificates-macos.outputs.keychain-profile }}
+        MAS_PROVISIONING_PROFILE: ${{ steps.setup-certificates-macos.outputs.provisioning-profile }}
         NODE_ENV: production
+        DEBUG: 'electron-*'
       run: |
-        npm run make
+        npm run package -- --platform=mas
+        file out/* # TODO
       shell: bash
     - name: 'Build application (Windows)'
       if: ${{ runner.os == 'Windows' }}
@@ -175,6 +187,13 @@ runs:
       run: |
         npm run make
       shell: pwsh
+    - name: Create MAS ZIP
+      if: ${{ runner.os == 'macOS' }}
+      run: |
+        ditto -c -k --sequesterRsrc --keepParent \
+          out/Keet-Internal-mas-arm64/Keet-Internal.app \
+          out/Keet-Internal-mas-arm64.zip
+      shell: bash
     - name: 'Upload standalone executable artifact'
       if: ${{ inputs.standalone != '' }}
       uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
@@ -210,6 +229,13 @@ runs:
         name: ${{ inputs.macos_dmg }}
         path: out/make/**/${{ inputs.macos_dmg }}
         if-no-files-found: error
+    - name: 'Upload macOS MAS ZIP artifact'
+      if: ${{ runner.os == 'macOS' && inputs.macos_mas_zip != '' }}
+      uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
+      with:
+        name: ${{ inputs.macos_mas_zip }}
+        path: out/${{ inputs.macos_mas_zip }}
+        if-no-files-found: error
     - name: 'Upload Windows MSIX artifact'
       if: ${{ runner.os == 'Windows' && inputs.windows_msix != '' }}
       uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0

setup-certificates/macos/action.yml

@@ -35,11 +35,18 @@ inputs:
     description: 'UUID that identifies the API key issuer'
     required: false
     default: ''
+  provisioning_profile_base64:
+    description: 'Base64-encoded Apple provisioning profile for MAS build (mobileprovision)'
+    required: false
+    default: ''
 
 outputs:
   keychain-profile:
     description: 'Keychain profile'
     value: ${{ steps.setup-certificates.outputs.keychain_profile }}
+  provisioning-profile:
+    description: 'Provisioning profile'
+    value: ${{ steps.setup-certificates.outputs.provisioning_profile }}
 
 runs:
   using: composite
@@ -57,15 +64,19 @@ runs:
         APPLE_ID: ${{ inputs.apple_id }}
         APPLE_PASSWORD: ${{ inputs.apple_password }}
         APPLE_TEAM_ID: ${{ inputs.apple_team_id }}
+        PROVISIONING_PROFILE_BASE64: ${{ inputs.provisioning_profile_base64 }}
       run: |
         # create variables
         CERTIFICATE_PATH=$RUNNER_TEMP/build_certificate.p12
+        PP_PATH=$RUNNER_TEMP/app.mas.provisionprofile
         KEYCHAIN_PATH=$RUNNER_TEMP/app-signing.keychain-db
         KEYCHAIN_PASSWORD=keychain-password
         KEYCHAIN_PROFILE=notary
 
         # import certificate and API key from secrets
         echo -n "$CERTIFICATE_BASE64" | base64 --decode -o $CERTIFICATE_PATH
+        echo -n "$PROVISIONING_PROFILE_BASE64" | base64 --decode -o "$PP_PATH"
+
         # create temporary keychain
         security create-keychain -p "$KEYCHAIN_PASSWORD" $KEYCHAIN_PATH
         security set-keychain-settings -lut 21600 $KEYCHAIN_PATH
@@ -95,5 +106,10 @@ runs:
             --keychain "$KEYCHAIN_PATH"
         fi
 
+        # apply provisioning profile
+        mkdir -p ~/Library/MobileDevice/Provisioning\ Profiles
+        cp "$PP_PATH" ~/Library/MobileDevice/Provisioning\ Profiles/app.mas.provisionprofile
+
         echo "keychain_profile=$KEYCHAIN_PROFILE" >> $GITHUB_OUTPUT
+        echo "provisioning_profile=$PP_PATH" >> $GITHUB_OUTPUT
       shell: bash