Separate keychain for builds

.github/workflows/build-macos.yaml

@@ -12,6 +12,8 @@ on:
       - v*.*.*
 
 env:
+  SCCACHE_GHA_ENABLED: "true"
+  RUSTC_WRAPPER: "sccache"
   SQLX_OFFLINE: "1"
 
 jobs:
@@ -23,11 +25,8 @@ jobs:
     env:
       APPLE_SIGNING_IDENTITY: "Apple Distribution: defguard sp. z o.o. (82GZ7KN29J)"
       APPLE_SIGNING_IDENTITY_INSTALLER: "3rd Party Mac Developer Installer: defguard sp. z o.o. (82GZ7KN29J)"
-      APPLE_PROVIDER_SHORT_NAME: "82GZ7KN29J"
-      APPLE_ID: "kamil@defguard.net"
-      APPLE_TEAM_ID: "82GZ7KN29J"
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           submodules: recursive
 
@@ -47,6 +46,7 @@ jobs:
       - uses: pnpm/action-setup@v6
         with:
           cache: true
+          run_install: false
           version: 11
 
       - name: Install Node dependencies for New UI
@@ -59,15 +59,15 @@ jobs:
         with:
           targets: aarch64-apple-darwin,x86_64-apple-darwin
 
+      - name: Run sccache-cache
+        uses: mozilla-actions/sccache-action@v0.0.10
+
       - name: Set build number
         run: |
           sed -i '' "s,@BUILD_NUMBER@,${{ github.run_number }}," swift/extension/VPNExtension.xcodeproj/project.pbxproj
           sed -i '' "s,@BUILD_NUMBER@,${{ github.run_number }}," src-tauri/client-cli/Info.plist
           sed -i '' "s,@BUILD_NUMBER@,${{ github.run_number }}," src-tauri/tauri.macos.conf.json
 
-      - name: Unlock keychain
-        run: security -v unlock-keychain -p "${{ secrets.KEYCHAIN_PASSWORD }}" login.keychain
-
       - name: Build new UI
         run: |
           cd new-ui
@@ -80,34 +80,17 @@ jobs:
         with:
           args: --config src-tauri/tauri.app.conf.json --target universal-apple-darwin
 
-      # - name: Bundle Defguard CLI
-      #   env:
-      #     BUNDLE: "target/universal-apple-darwin/release/bundle/macos/Defguard.app"
-      #   run: |
-      #     cd src-tauri
-      #     mkdir -p ${BUNDLE}/Contents/Helpers/defguard-cli/Contents/MacOS
-      #     lipo -create -output ${BUNDLE}/Contents/Helpers/defguard-cli/Contents/MacOS/defguard-cli \
-      #       target/aarch64-apple-darwin/release/defguard-cli \
-      #       target/x86_64-apple-darwin/release/defguard-cli
-      #     ln -f client-cli/Info.plist ${BUNDLE}/Contents/Helpers/defguard-cli/Contents/Info.plist
-      #     pushd ${BUNDLE}/Contents/Helpers/defguard-cli/Contents
-      #     ln -f ../../../embedded.provisionprofile .
-      #     popd
-      #     codesign --verbose --force --options runtime \
-      #       --sign "${{ env.APPLE_SIGNING_IDENTITY }}" \
-      #       --prefix net.defguard. --entitlements Client.entitlements \
-      #       ${BUNDLE}/Contents/Helpers/defguard-cli
-      #     codesign --verbose --force --options runtime \
-      #       --sign "${{ env.APPLE_SIGNING_IDENTITY }}" \
-      #       --entitlements Client.entitlements ${BUNDLE}
-
       - name: Build installation package
         run: |
-          security -v unlock-keychain -p "${{ secrets.KEYCHAIN_PASSWORD }}" login.keychain
-          xcrun productbuild --sign "${{ env.APPLE_SIGNING_IDENTITY_INSTALLER }}" --component "src-tauri/target/universal-apple-darwin/release/bundle/macos/Defguard.app" /Applications defguard-client.pkg
-          xcrun altool --api-key ${{ secrets.APPLE_API_KEY }} --api-issuer ${{ secrets.APPLE_API_ISSUER }} --upload-app --platform macos --file defguard-client.pkg --wait
-          # xcrun notarytool submit --wait --apple-id ${{ env.APPLE_ID }} --password ${{ secrets.NOTARYTOOL_APP_SPECIFIC_PASSWORD }} --team-id ${{ env.APPLE_TEAM_ID }} defguard-client.pkg
-          # xcrun stapler staple defguard-client.pkg
+          security unlock-keychain -p "${{ secrets.BUILD_KEYCHAIN_PASSWORD }}" build.keychain
+          xcrun productbuild --keychain build.keychain \
+            --sign "${{ env.APPLE_SIGNING_IDENTITY_INSTALLER }}" \
+            --component "src-tauri/target/universal-apple-darwin/release/bundle/macos/Defguard.app" \
+            /Applications defguard-client.pkg
+          xcrun notarytool submit defguard-client.pkg \
+            --key ~/.private_keys/AuthKey_${{ secrets.APPLE_API_KEY }}.p8 \
+            --key-id "${{ secrets.APPLE_API_KEY }}" --issuer "${{ secrets.APPLE_API_ISSUER }}" \
+            --wait
 
       - name: Upload What's New
         env:

.github/workflows/posture.yaml

@@ -44,10 +44,6 @@ jobs:
         run: |
           cargo test -p defguard-client-posture --locked --lib inspector::tests::ci::linux::setup1 -- --ignored
 
-      - name: Show sccache stats
-        run: sccache --show-stats
-
-
   test-linux-postures-encrypted:
     name: Linux postures - encrypted
     runs-on:
@@ -77,10 +73,6 @@ jobs:
         run: |
           cargo test -p defguard-client-posture --locked --lib inspector::tests::ci::linux::setup2 -- --ignored
 
-      - name: Show sccache stats
-        run: sccache --show-stats
-
-
   test-windows-postures-setup1:
     name: Windows postures - setup1
     runs-on:
@@ -106,9 +98,6 @@ jobs:
         run: |
           cargo test -p defguard-client-posture --locked --lib inspector::tests::ci::windows::setup1 -- --ignored
 
-      - name: Show sccache stats
-        run: sccache --show-stats
-
   test-windows-postures-setup2:
     name: Windows postures - setup2
     runs-on:
@@ -134,9 +123,6 @@ jobs:
         run: |
           cargo test -p defguard-client-posture --locked --lib inspector::tests::ci::windows::setup2 -- --ignored
 
-      - name: Show sccache stats
-        run: sccache --show-stats
-
   test-macos-postures-unencrypted:
     name: macOS postures - unencrypted
     runs-on:
@@ -159,9 +145,6 @@ jobs:
         run: |
           cargo test -p defguard-client-posture --locked --lib inspector::tests::ci::macos::setup1 -- --ignored
 
-      - name: Show sccache stats
-        run: sccache --show-stats
-
   test-macos-postures-encrypted:
     name: macOS postures - encrypted
     runs-on:
@@ -183,6 +166,3 @@ jobs:
         working-directory: src-tauri/
         run: |
           cargo test -p defguard-client-posture --locked --lib inspector::tests::ci::macos::setup2 -- --ignored
-
-      - name: Show sccache stats
-        run: sccache --show-stats

.github/workflows/release-macos.yaml

@@ -8,6 +8,8 @@ on:
         type: string
 
 env:
+  SCCACHE_GHA_ENABLED: "true"
+  RUSTC_WRAPPER: "sccache"
   SQLX_OFFLINE: "1"
 
 jobs:
@@ -17,7 +19,7 @@ jobs:
       - macOS
       - native
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           submodules: recursive
 
@@ -37,6 +39,7 @@ jobs:
       - uses: pnpm/action-setup@v6
         with:
           cache: true
+          run_install: false
           version: 11
 
       - name: Install Node dependencies for New UI
@@ -49,15 +52,15 @@ jobs:
         with:
           targets: aarch64-apple-darwin,x86_64-apple-darwin
 
+      - name: Run sccache-cache
+        uses: mozilla-actions/sccache-action@v0.0.10
+
       - name: Set build number
         run: |
           sed -i '' "s,@BUILD_NUMBER@,${{ github.run_number }}," swift/extension/VPNExtension.xcodeproj/project.pbxproj
           sed -i '' "s,@BUILD_NUMBER@,${{ github.run_number }}," src-tauri/client-cli/Info.plist
           sed -i '' "s,@BUILD_NUMBER@,${{ github.run_number }}," src-tauri/tauri.macos.conf.json
 
-      - name: Unlock keychain
-        run: security -v unlock-keychain -p "${{ secrets.KEYCHAIN_PASSWORD }}" login.keychain
-
       - name: Build new UI
         run: |
           cd new-ui