Merge pull request #874 from loki-project/github-actions

Only enable signing if we have a certificate on Mac

.github/workflows/build-binaries.yml

@@ -54,10 +54,12 @@ jobs:
 
       - name: Build mac production binaries
         if: runner.os == 'macOS'
-        run: $(yarn bin)/electron-builder --config.extraMetadata.environment=$SIGNAL_ENV --config.mac.bundleVersion=${{ github.ref }} --publish=never --config.directories.output=release
+        run: |
+          source ./build/setup-mac-certificate.sh
+          $(yarn bin)/electron-builder --config.extraMetadata.environment=$SIGNAL_ENV --config.mac.bundleVersion=${{ github.ref }} --publish=never --config.directories.output=release
         env:
-          CSC_LINK: ${{ secrets.MAC_CERTIFICATE }}
+          MAC_CERTIFICATE: ${{ secrets.MAC_CERTIFICATE }}
-          CSC_KEY_PASSWORD: ${{ secrets.MAC_CERTIFICATE_PASSWORD }}
+          MAC_CERTIFICATE_PASSWORD: ${{ secrets.MAC_CERTIFICATE_PASSWORD }}
           SIGNING_APPLE_ID: ${{ secrets.SIGNING_APPLE_ID }}
           SIGNING_APP_PASSWORD: ${{ secrets.SIGNING_APP_PASSWORD }}
           SIGNING_TEAM_ID: ${{ secrets.SIGNING_TEAM_ID }}

.github/workflows/release.yml

@@ -51,10 +51,12 @@ jobs:
 
       - name: Build mac production binaries
         if: runner.os == 'macOS'
-        run: $(yarn bin)/electron-builder --config.extraMetadata.environment=$SIGNAL_ENV --config.mac.bundleVersion=${{ github.ref }} --publish=always
+        run: |
+          source ./build/setup-mac-certificate.sh
+          $(yarn bin)/electron-builder --config.extraMetadata.environment=$SIGNAL_ENV --config.mac.bundleVersion=${{ github.ref }} --publish=always
         env:
-          CSC_LINK: ${{ secrets.MAC_CERTIFICATE }}
+          MAC_CERTIFICATE: ${{ secrets.MAC_CERTIFICATE }}
-          CSC_KEY_PASSWORD: ${{ secrets.MAC_CERTIFICATE_PASSWORD }}
+          MAC_CERTIFICATE_PASSWORD: ${{ secrets.MAC_CERTIFICATE_PASSWORD }}
           SIGNING_APPLE_ID: ${{ secrets.SIGNING_APPLE_ID }}
           SIGNING_APP_PASSWORD: ${{ secrets.SIGNING_APP_PASSWORD }}
           SIGNING_TEAM_ID: ${{ secrets.SIGNING_TEAM_ID }}

build/setup-mac-certificate.sh

@@ -0,0 +1,15 @@
+#!/usr/bin/env bash
+
+if [ -z "$MAC_CERTIFICATE" ]; then
+  echo "MAC_CERTIFICATE not set. Ignoring."
+else
+  export CSC_LINK="$MAC_CERTIFICATE"
+  echo "MAC_CERTIFICATE found."
+fi
+
+if [ -z "$MAC_CERTIFICATE_PASSWORD" ]; then
+  echo "MAC_CERTIFICATE_PASSWORD not set. Ignoring."
+else
+  export CSC_KEY_PASSWORD="$MAC_CERTIFICATE_PASSWORD"
+  echo "MAC_CERTIFICATE_PASSWORD found."
+fi