Most of it is fairly boilerplate stuff that you'll find by searching how to integrate signing/notarization into CI. Adds an input to the workflow that when checked, requires the following secrets:
APPLE_DEVID_APP_CERT_DATA: Your Developer ID Application certificate exported as P12 + base64 encoded
APPLE_DEVID_APP_CERT_PASS: The export password for that certificate
APPLE_ID_USER: Your Apple ID (i.e. email address)
APPLE_ID_PASS: Not your actual Apple password; rather an app-specific password
The openssl/grep/awk stuff is just some magic to detect the common name from the certificate instead of needing to have an additional pre-defined variable or secret for it.
Most of it is fairly boilerplate stuff that you'll find by searching how to integrate signing/notarization into CI. Adds an input to the workflow that when checked, requires the following secrets: APPLE_DEVID_APP_CERT_DATA: Your Developer ID Application certificate exported as P12 + base64 encoded APPLE_DEVID_APP_CERT_PASS: The export password for that certificate APPLE_ID_USER: Your Apple ID (i.e. email address) APPLE_ID_PASS: Not your actual Apple password; rather an app-specific password
The openssl/grep/awk stuff is just some magic to detect the common name from the certificate instead of needing to have an additional pre-defined variable or secret for it.