From 6db6899e426297c425adabe852c053a07c7c352c Mon Sep 17 00:00:00 2001
From: Stef Tervelde <stef@steftervelde.nl>
Date: Fri, 6 Dec 2024 08:40:37 +0100
Subject: [PATCH] Sign the build commits so they can be used on macOS

---
 .github/workflows/build.yml        | 8 ++++++++
 .github/workflows/pull_request.yml | 8 ++++++++
 build/build.xml                    | 2 +-
 3 files changed, 17 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 29e165a39..79a3e0002 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -66,8 +66,16 @@ jobs:
           architecture: ${{ matrix.arch }}
       - name: Setup Ant
         uses: cedx/setup-ant@v3
+      - name: Install Certificates for Code Signing
+        if: ${{ matrix.os_prefix == 'macos' }}
+        uses: apple-actions/import-codesign-certs@v3
+        with:
+          p12-file-base64: ${{ secrets.CERTIFICATES_P12 }}
+          p12-password: ${{ secrets.CERTIFICATES_P12_PASSWORD }}
       - name: Build Release
         run: ant -noinput -buildfile build/build.xml ${{ matrix.os_prefix }}-dist -Dversion="${{ github.sha }}"
+        with:
+          PROCESSING_APP_SIGNING: true
       - name: Add artifact
         uses: actions/upload-artifact@v4
         with:
diff --git a/.github/workflows/pull_request.yml b/.github/workflows/pull_request.yml
index 54ae96e71..8b7cc07ff 100644
--- a/.github/workflows/pull_request.yml
+++ b/.github/workflows/pull_request.yml
@@ -51,8 +51,16 @@ jobs:
           architecture: ${{ matrix.arch }}
       - name: Setup Ant
         uses: cedx/setup-ant@v3
+      - name: Install Certificates for Code Signing
+        if: ${{ matrix.os_prefix == 'macos' }}
+        uses: apple-actions/import-codesign-certs@v3
+        with:
+          p12-file-base64: ${{ secrets.CERTIFICATES_P12 }}
+          p12-password: ${{ secrets.CERTIFICATES_P12_PASSWORD }}
       - name: Build Release
         run: ant -noinput -buildfile build/build.xml ${{ matrix.os_prefix }}-dist -Dversion="${{ github.sha }}"
+        with:
+          PROCESSING_APP_SIGNING: true
       - name: Add artifact
         uses: actions/upload-artifact@v3
         id: upload
diff --git a/build/build.xml b/build/build.xml
index 4d873869b..abb29cc23 100644
--- a/build/build.xml
+++ b/build/build.xml
@@ -778,7 +778,7 @@
     </exec>
   </target>
 
-  <target name="macos-dist-sign" if="env.PROCESSING_APP_PASSWORD">
+  <target name="macos-dist-sign" if="env.PROCESSING_APP_PASSWORD | env.PROCESSING_APP_SIGNING">
     <echo>
       Code signing will only work if you have a $99/yr Apple developer ID.
     </echo>