Skip to content

feat: build, sign and notarize macOS app bundle in CI #2614

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
ansgarbecker merged 6 commits into from
Sep 28, 2026
Merged

feat: build, sign and notarize macOS app bundle in CI #2614

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
b2f44f0
feat: build, sign and notarize macOS app bundle in CI
mistral-vibe Sep 27, 2026
e5076e6
fix: move secrets check from step if: into script (secrets context no…
mistral-vibe Sep 27, 2026
a2b588a
fix: use plain string for codesign flags instead of empty array (set …
mistral-vibe Sep 27, 2026
60e48f3
chore: trigger CI with signing secrets configured
mistral-vibe Sep 28, 2026
0b09691
fix: correct argument order for security set-keychain-settings
mistral-vibe Sep 28, 2026
fe5f5bb
fix: remove invalid -s flag from security set-key-partition-list
mistral-vibe Sep 28, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
95 changes: 94 additions & 1 deletion .github/workflows/lazarus.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -174,6 +174,92 @@ jobs:
name: ${{ matrix.operating-system }}
path: out/macos/heidisql

build-macos-app:
name: macOS App Bundle
if: github.repository == 'HeidiSQL/HeidiSQL'
runs-on: macos-15
env:
GITHUB: 1
steps:
- name: Checkout source code
uses: actions/checkout@v4

- name: Install Lazarus 4.8 (macOS)
run: |
wget -q "https://sourceforge.net/projects/lazarus/files/Lazarus%20macOS%20x86-64/Lazarus%204.8/fpc-3.2.4rc1a.intelarm64-macosx.dmg" -O "$RUNNER_TEMP/fpc.dmg"
wget -q "https://sourceforge.net/projects/lazarus/files/Lazarus%20macOS%20aarch64/Lazarus%204.8/lazarus-darwin-aarch64-4.8.zip" -O "$RUNNER_TEMP/lazarus.zip"
sudo hdiutil attach "$RUNNER_TEMP/fpc.dmg"
FPC_VOL=$(ls -d /Volumes/fpc* | head -1)
FPC_PKG=$(find "$FPC_VOL" -maxdepth 1 -name "*.pkg" | head -1)
sudo installer -package "$FPC_PKG" -target /
sudo hdiutil detach "$FPC_VOL"
xattr -cr "$RUNNER_TEMP/lazarus.zip"
unzip -q "$RUNNER_TEMP/lazarus.zip" -d "$RUNNER_TEMP"
sed -i '' 's|"/Developer/lazarus/"|"'$RUNNER_TEMP'/lazarus/"|g' "$RUNNER_TEMP/lazarus/config/environmentoptions.xml" 2>/dev/null || true
sudo ln -sf "$RUNNER_TEMP/lazarus/lazbuild" /usr/local/bin/lazbuild
echo "$RUNNER_TEMP/lazarus" >> $GITHUB_PATH

- name: Import code signing certificate
env:
MACOS_CERTIFICATE_P12_BASE64: ${{ secrets.MACOS_CERTIFICATE_P12_BASE64 }}
MACOS_CERTIFICATE_PASSWORD: ${{ secrets.MACOS_CERTIFICATE_PASSWORD }}
run: |
if [ -z "${MACOS_CERTIFICATE_P12_BASE64}" ]; then
echo "No signing certificate configured, skipping keychain setup"
exit 0
fi
KEYCHAIN_PATH="$RUNNER_TEMP/signing.keychain-db"
KEYCHAIN_PASSWORD=$(uuidgen)
security create-keychain -p "$KEYCHAIN_PASSWORD" "$KEYCHAIN_PATH"
security set-keychain-settings -lut 21600 "$KEYCHAIN_PATH"
security unlock-keychain -p "$KEYCHAIN_PASSWORD" "$KEYCHAIN_PATH"
echo "$MACOS_CERTIFICATE_P12_BASE64" | base64 --decode > "$RUNNER_TEMP/certificate.p12"
security import "$RUNNER_TEMP/certificate.p12" -k "$KEYCHAIN_PATH" -P "$MACOS_CERTIFICATE_PASSWORD" -T /usr/bin/codesign
security list-keychain -d user -s "$KEYCHAIN_PATH"
security set-key-partition-list -S apple-tool:,apple: -k "$KEYCHAIN_PASSWORD" "$KEYCHAIN_PATH" >/dev/null
rm -f "$RUNNER_TEMP/certificate.p12"
echo "KEYCHAIN_PATH=$KEYCHAIN_PATH" >> "$GITHUB_ENV"

- name: Build HeidiSQL (macOS)
run: make build-macos

- name: Create, sign and notarize app bundle
env:
MACOS_CODESIGN_IDENTITY: ${{ secrets.MACOS_CODESIGN_IDENTITY }}
MACOS_TEAM_ID: ${{ secrets.MACOS_TEAM_ID }}
APPLE_ID: ${{ secrets.APPLE_NOTARY_APPLE_ID }}
APPLE_TEAM_ID: ${{ secrets.APPLE_NOTARY_TEAM_ID }}
APPLE_PASSWORD: ${{ secrets.APPLE_NOTARY_PASSWORD }}
run: |
if [ -n "${MACOS_CODESIGN_IDENTITY}" ] && [ -n "${APPLE_ID}" ]; then
xcrun notarytool store-credentials notarytool-profile-ci \
--apple-id "${APPLE_ID}" \
--team-id "${APPLE_TEAM_ID}" \
--password "${APPLE_PASSWORD}"
export MACOS_NOTARY_PROFILE=notarytool-profile-ci
./create-macos-app.sh --notarize
else
echo "Signing secrets not available, creating ad-hoc signed bundle"
./create-macos-app.sh --adhoc
fi

- name: Zip app bundle
run: |
cd "$(pwd)"
rm -f heidisql-macos-app.zip
/usr/bin/zip -r -y heidisql-macos-app.zip heidisql.app

- name: Upload app bundle artifact
uses: actions/upload-artifact@v4
with:
name: macos-app-bundle
path: heidisql-macos-app.zip

- name: Cleanup keychain
if: always() && env.KEYCHAIN_PATH != ''
run: |
security delete-keychain "$KEYCHAIN_PATH" || true

build-qt6arm:
name: Linux ARM64 QT6
runs-on: ubuntu-24.04-arm
Expand Down Expand Up @@ -233,7 +319,7 @@ jobs:

name: Create GitHub Release
runs-on: [ubuntu-latest]
needs: [build, build-qt6arm]
needs: [build, build-qt6arm, build-macos-app]

steps:
- name: Checkout source code
Expand Down Expand Up @@ -271,6 +357,13 @@ jobs:
with:
name: ubuntu-24.04-arm-QT6
path: out/qt6arm
- name: Download macOS app bundle
uses: actions/download-artifact@v4
with:
name: macos-app-bundle
path: dist
- name: Rename macOS app bundle for release
run: mv dist/heidisql-macos-app.zip "dist/HeidiSQL-macos-${{ env.tag }}.zip"

- name: List files
run: |
Expand Down
48 changes: 38 additions & 10 deletions create-macos-app.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,10 +2,12 @@
set -euo pipefail

DO_NOTARIZE=false
DO_ADHOC=false
# parse args
for arg in "$@"; do
case "$arg" in
--notarize) DO_NOTARIZE=true ;;
--adhoc) DO_ADHOC=true ;;
esac
done

Expand All @@ -18,18 +20,37 @@ APP_DIR="$(pwd)/${BUNDLE_NAME}"
LPI_FILE="$(pwd)/heidisql.lpi"

# Path to the already built Lazarus executable
EXECUTABLE_SRC="$(pwd)/out/heidisql"
if [[ -f "$(pwd)/out/heidisql" ]]; then
EXECUTABLE_SRC="$(pwd)/out/heidisql"
elif [[ -f "$(pwd)/out/macos/heidisql" ]]; then
EXECUTABLE_SRC="$(pwd)/out/macos/heidisql"
else
echo "ERROR: No built executable found in out/ or out/macos/" >&2
exit 1
fi
EXECUTABLE_TRG="${APP_DIR}/Contents/MacOS/${APP_NAME}"

# Homebrew prefix (auto-detected; override if needed)
BREW_PREFIX="$(brew --prefix 2>/dev/null || echo "/opt/homebrew")"

# Your Developer ID identity, as shown by: security find-identity -v -p codesigning
TEAM_ID="QBD4CC6FH3"
CODESIGN_IDENTITY="Developer ID Application: Ansgar Becker (${TEAM_ID})"
# Developer ID identity, overridable via environment (CI), as shown by: security find-identity -v -p codesigning
TEAM_ID="${MACOS_TEAM_ID:-QBD4CC6FH3}"
CODESIGN_IDENTITY="${MACOS_CODESIGN_IDENTITY:-Developer ID Application: Ansgar Becker (${TEAM_ID})}"

# Ad-hoc signing (no Developer ID available, e.g. fork CI builds)
if $DO_ADHOC; then
CODESIGN_IDENTITY="-"
fi

# Name for notarytool keychain profile (store once with notarytool store-credentials)
NOTARY_PROFILE="notarytool-profile"
NOTARY_PROFILE="${MACOS_NOTARY_PROFILE:-notarytool-profile}"

# codesign flags: hardened runtime + secure timestamp only make sense with a real identity
if $DO_ADHOC; then
SIGN_OPTS=""
else
SIGN_OPTS="--options runtime --timestamp"
fi

LOCALES_ZIP_URL="https://www.heidisql.com/downloads/locale/HeidiSQL-locale.zip"

Expand Down Expand Up @@ -74,8 +95,10 @@ brew list sqlite >/dev/null 2>&1 || brew install sqlite
# MariaDB Connector/C (libmariadb*.dylib)
brew list mariadb-connector-c >/dev/null 2>&1 || brew install mariadb-connector-c

# OpenSSL 1.1 for TFPHTTPClient
brew list openssl@1.1 >/dev/null 2>&1 || brew install openssl@1.1
# OpenSSL 1.1 for TFPHTTPClient (deprecated in Homebrew, may be unavailable on CI runners)
if ! brew list openssl@1.1 >/dev/null 2>&1; then
brew install openssl@1.1 2>/dev/null || echo "WARNING: openssl@1.1 not installable, skipping" >&2
fi

MYSQL_LIB_DIR="${BREW_PREFIX}/opt/mysql-client/lib"
PG_LIB_DIR="${BREW_PREFIX}/opt/libpq/lib"
Expand All @@ -95,7 +118,7 @@ mkdir -p "${APP_DIR}/Contents/Frameworks" # where we will put .dylib and .so f
# Copy main executable
cp "${EXECUTABLE_SRC}" "${EXECUTABLE_TRG}"
chmod +x "${EXECUTABLE_TRG}"
codesign --force --options runtime --timestamp --sign "${CODESIGN_IDENTITY}" "${EXECUTABLE_TRG}"
codesign --force ${SIGN_OPTS} --sign "${CODESIGN_IDENTITY}" "${EXECUTABLE_TRG}"

# Minimal Info.plist (adjust identifiers/versions as needed)
cat > "${APP_DIR}/Contents/Info.plist" <<EOF
Expand Down Expand Up @@ -320,18 +343,23 @@ echo "Done. Bundled app is at: ${APP_DIR}"
echo "Signing embedded libraries..."
find "${APP_DIR}/Contents" -type f \( -name "*.dylib" -o -name "*.so" \) | while read -r f; do
echo " Signing ${f}"
codesign --force --options runtime --timestamp --sign "${CODESIGN_IDENTITY}" "${f}"
codesign --force ${SIGN_OPTS} --sign "${CODESIGN_IDENTITY}" "${f}"
done

echo "Signing main app bundle..."
codesign --force --options runtime --timestamp --deep --sign "${CODESIGN_IDENTITY}" "${APP_DIR}"
codesign --force ${SIGN_OPTS} --sign --deep --sign "${CODESIGN_IDENTITY}" "${APP_DIR}"

echo "Verifying code signature..."
codesign --verify --deep --strict --verbose=2 "${APP_DIR}"


### ZIP, NOTARIZE, AND STAPLE

if $DO_ADHOC; then
echo "Skip notarization (ad-hoc signed bundle cannot be notarized)"
exit 0
fi

if ! $DO_NOTARIZE; then
echo "Skip notarization (--notarize not given)"
exit 0
Expand Down
Loading