update gha and use new certs

macadmins · Mar 21, 2023 · a0ae84c · a0ae84c
1 parent 3de6920
commit a0ae84c
Show file tree

Hide file tree

Showing 5 changed files with 42 additions and 42 deletions.
diff --git a/.github/workflows/build_python_3.10.yml b/.github/workflows/build_python_3.10.yml
@@ -2,8 +2,8 @@ name: Build Python 3.10
 
 env:
   TYPE: "recommended"
-  DEV_INSTALLER_ID: "Developer ID Installer: Clever DevOps Co. (9GQZ7KUFR6)"
-  DEV_APPLICATION_ID: "Developer ID Application: Clever DevOps Co. (9GQZ7KUFR6)"
+  DEV_INSTALLER_ID: "Developer ID Installer: Mac Admins Open Source (T4SK8ZXCXG)"
+  DEV_APPLICATION_ID: "Developer ID Application: Mac Admins Open Source (T4SK8ZXCXG)"
   NOTARY_PASS: ${{ secrets.NOTARY_PASS }}
   PYTHON_VERSION: "3.10.9"
 
@@ -17,24 +17,24 @@ jobs:
 
     steps:
     - name: Checkout python repo
-      uses: actions/checkout@v2
+      uses: actions/checkout@24cb9080177205b6e8c946b17badbe402adc938f # v3.4.0
       with:
         fetch-depth: 0
 
     - name: Install Apple Developer ID Application certificates
-      uses: ssrobins/import-codesign-certs@04ce695a5e6002f1971a8ed78fedd676318f950f # Move back to apple-actions/import-codesign-certs when merged
+      uses: apple-actions/import-codesign-certs@8f3fb608891dd2244cdab3d69cd68c0d37a7fe93 # v2.0.0
       with:
-        keychain-password: ${{ secrets.KEYCHAIN_PASSWORD }}
-        p12-file-base64: ${{ secrets.DEV_APP_CERTIFICATES_P12 }}
-        p12-password: ${{ secrets.DEV_APP_CERTIFICATES_P12_PASSWORD }}
+        keychain-password: ${{ github.run_id }}
+        p12-file-base64: ${{ secrets.APP_CERTIFICATES_P12_PASSWORD_MAOS }}
+        p12-password: ${{ secrets.APP_CERTIFICATES_P12_PASSWORD_MAOS_PASSWORD }}
 
     - name: Install Apple Developer ID Installer certificates
-      uses: ssrobins/import-codesign-certs@04ce695a5e6002f1971a8ed78fedd676318f950f # Move back to apple-actions/import-codesign-certs when merged
+      uses: apple-actions/import-codesign-certs@8f3fb608891dd2244cdab3d69cd68c0d37a7fe93 # v2.0.0
       with:
         create-keychain: false # do not create a new keychain for this value
-        keychain-password: ${{ secrets.KEYCHAIN_PASSWORD }}
-        p12-file-base64: ${{ secrets.CERTIFICATES_P12 }}
-        p12-password: ${{ secrets.CERTIFICATES_P12_PASSWORD }}
+        keychain-password: ${{ github.run_id }}
+        p12-file-base64: ${{ secrets.PKG_CERTIFICATES_P12_MAOS }}
+        p12-password: ${{ secrets.PKG_CERTIFICATES_P12_MAOS_PASSWORD }}
 
     - name: Run build package script
       run: ./build_python_framework_pkgs.zsh "$TYPE" "$DEV_INSTALLER_ID" "$DEV_APPLICATION_ID" "$PYTHON_VERSION" "${NOTARY_PASS}"
@@ -46,7 +46,7 @@ jobs:
 
     - name: Generate changelog
       id: changelog
-      uses: metcalfc/changelog-generator@31b6d6f9e6e17e84ad34bee780f82d8ee79f6842 # v4.0.1
+      uses: metcalfc/changelog-generator@afdcb9470aebdb2252c0c95a1c130723c9e21f3a # v4.1
       with:
         myToken: ${{ secrets.GITHUB_TOKEN }}
         reverse: 'true'
@@ -83,7 +83,7 @@ jobs:
         files: ${{github.workspace}}/outputs/*.pkg
 
     - name: Upload packages
-      uses: actions/[email protected].1
+      uses: actions/upload-artifact@0b7f8abb1508181956e8e162db84b466c27e18ce # v3.1.2
       with:
         name: packages
         path: outputs/
diff --git a/.github/workflows/build_python_3.11.yml b/.github/workflows/build_python_3.11.yml
@@ -2,8 +2,8 @@ name: Build Python 3.11
 
 env:
   TYPE: "recommended"
-  DEV_INSTALLER_ID: "Developer ID Installer: Clever DevOps Co. (9GQZ7KUFR6)"
-  DEV_APPLICATION_ID: "Developer ID Application: Clever DevOps Co. (9GQZ7KUFR6)"
+  DEV_INSTALLER_ID: "Developer ID Installer: Mac Admins Open Source (T4SK8ZXCXG)"
+  DEV_APPLICATION_ID: "Developer ID Application: Mac Admins Open Source (T4SK8ZXCXG)"
   NOTARY_PASS: ${{ secrets.NOTARY_PASS }}
   PYTHON_VERSION: "3.11.1"
 
@@ -17,24 +17,24 @@ jobs:
 
     steps:
     - name: Checkout python repo
-      uses: actions/checkout@v2
+      uses: actions/checkout@24cb9080177205b6e8c946b17badbe402adc938f # v3.4.0
       with:
         fetch-depth: 0
 
     - name: Install Apple Developer ID Application certificates
-      uses: ssrobins/import-codesign-certs@04ce695a5e6002f1971a8ed78fedd676318f950f # Move back to apple-actions/import-codesign-certs when merged
+      uses: apple-actions/import-codesign-certs@8f3fb608891dd2244cdab3d69cd68c0d37a7fe93 # v2.0.0
       with:
-        keychain-password: ${{ secrets.KEYCHAIN_PASSWORD }}
-        p12-file-base64: ${{ secrets.DEV_APP_CERTIFICATES_P12 }}
-        p12-password: ${{ secrets.DEV_APP_CERTIFICATES_P12_PASSWORD }}
+        keychain-password: ${{ github.run_id }}
+        p12-file-base64: ${{ secrets.APP_CERTIFICATES_P12_PASSWORD_MAOS }}
+        p12-password: ${{ secrets.APP_CERTIFICATES_P12_PASSWORD_MAOS_PASSWORD }}
 
     - name: Install Apple Developer ID Installer certificates
-      uses: ssrobins/import-codesign-certs@04ce695a5e6002f1971a8ed78fedd676318f950f # Move back to apple-actions/import-codesign-certs when merged
+      uses: apple-actions/import-codesign-certs@8f3fb608891dd2244cdab3d69cd68c0d37a7fe93 # v2.0.0
       with:
         create-keychain: false # do not create a new keychain for this value
-        keychain-password: ${{ secrets.KEYCHAIN_PASSWORD }}
-        p12-file-base64: ${{ secrets.CERTIFICATES_P12 }}
-        p12-password: ${{ secrets.CERTIFICATES_P12_PASSWORD }}
+        keychain-password: ${{ github.run_id }}
+        p12-file-base64: ${{ secrets.PKG_CERTIFICATES_P12_MAOS }}
+        p12-password: ${{ secrets.PKG_CERTIFICATES_P12_MAOS_PASSWORD }}
 
     - name: Run build package script
       run: ./build_python_framework_pkgs.zsh "$TYPE" "$DEV_INSTALLER_ID" "$DEV_APPLICATION_ID" "$PYTHON_VERSION" "${NOTARY_PASS}"
@@ -46,7 +46,7 @@ jobs:
 
     - name: Generate changelog
       id: changelog
-      uses: metcalfc/changelog-generator@31b6d6f9e6e17e84ad34bee780f82d8ee79f6842 # v4.0.1
+      uses: metcalfc/changelog-generator@afdcb9470aebdb2252c0c95a1c130723c9e21f3a # v4.1
       with:
         myToken: ${{ secrets.GITHUB_TOKEN }}
         reverse: 'true'
@@ -83,7 +83,7 @@ jobs:
         files: ${{github.workspace}}/outputs/*.pkg
 
     - name: Upload packages
-      uses: actions/[email protected].1
+      uses: actions/upload-artifact@0b7f8abb1508181956e8e162db84b466c27e18ce # v3.1.2
       with:
         name: packages
         path: outputs/
diff --git a/.github/workflows/build_python_3.9.yml b/.github/workflows/build_python_3.9.yml
@@ -2,8 +2,8 @@ name: Build Python 3.9
 
 env:
   TYPE: "recommended"
-  DEV_INSTALLER_ID: "Developer ID Installer: Clever DevOps Co. (9GQZ7KUFR6)"
-  DEV_APPLICATION_ID: "Developer ID Application: Clever DevOps Co. (9GQZ7KUFR6)"
+  DEV_INSTALLER_ID: "Developer ID Installer: Mac Admins Open Source (T4SK8ZXCXG)"
+  DEV_APPLICATION_ID: "Developer ID Application: Mac Admins Open Source (T4SK8ZXCXG)"
   NOTARY_PASS: ${{ secrets.NOTARY_PASS }}
   PYTHON_VERSION: "3.9.13"
 
@@ -17,24 +17,24 @@ jobs:
 
     steps:
     - name: Checkout python repo
-      uses: actions/checkout@v2
+      uses: actions/checkout@24cb9080177205b6e8c946b17badbe402adc938f # v3.4.0
       with:
         fetch-depth: 0
 
     - name: Install Apple Developer ID Application certificates
-      uses: ssrobins/import-codesign-certs@04ce695a5e6002f1971a8ed78fedd676318f950f # Move back to apple-actions/import-codesign-certs when merged
+      uses: apple-actions/import-codesign-certs@8f3fb608891dd2244cdab3d69cd68c0d37a7fe93 # v2.0.0
       with:
-        keychain-password: ${{ secrets.KEYCHAIN_PASSWORD }}
-        p12-file-base64: ${{ secrets.DEV_APP_CERTIFICATES_P12 }}
-        p12-password: ${{ secrets.DEV_APP_CERTIFICATES_P12_PASSWORD }}
+        keychain-password: ${{ github.run_id }}
+        p12-file-base64: ${{ secrets.APP_CERTIFICATES_P12_PASSWORD_MAOS }}
+        p12-password: ${{ secrets.APP_CERTIFICATES_P12_PASSWORD_MAOS_PASSWORD }}
 
     - name: Install Apple Developer ID Installer certificates
-      uses: ssrobins/import-codesign-certs@04ce695a5e6002f1971a8ed78fedd676318f950f # Move back to apple-actions/import-codesign-certs when merged
+      uses: apple-actions/import-codesign-certs@8f3fb608891dd2244cdab3d69cd68c0d37a7fe93 # v2.0.0
       with:
         create-keychain: false # do not create a new keychain for this value
-        keychain-password: ${{ secrets.KEYCHAIN_PASSWORD }}
-        p12-file-base64: ${{ secrets.CERTIFICATES_P12 }}
-        p12-password: ${{ secrets.CERTIFICATES_P12_PASSWORD }}
+        keychain-password: ${{ github.run_id }}
+        p12-file-base64: ${{ secrets.PKG_CERTIFICATES_P12_MAOS }}
+        p12-password: ${{ secrets.PKG_CERTIFICATES_P12_MAOS_PASSWORD }}
 
     - name: Run build package script
       run: ./build_python_framework_pkgs.zsh "$TYPE" "$DEV_INSTALLER_ID" "$DEV_APPLICATION_ID" "$PYTHON_VERSION" "${NOTARY_PASS}"
@@ -46,7 +46,7 @@ jobs:
 
     - name: Generate changelog
       id: changelog
-      uses: metcalfc/changelog-generator@31b6d6f9e6e17e84ad34bee780f82d8ee79f6842 # v4.0.1
+      uses: metcalfc/changelog-generator@afdcb9470aebdb2252c0c95a1c130723c9e21f3a # v4.1
       with:
         myToken: ${{ secrets.GITHUB_TOKEN }}
         reverse: 'true'
@@ -88,7 +88,7 @@ jobs:
         files: ${{github.workspace}}/outputs/*.pkg
 
     - name: Upload packages
-      uses: actions/[email protected].1
+      uses: actions/upload-artifact@0b7f8abb1508181956e8e162db84b466c27e18ce # v3.1.2
       with:
         name: packages
         path: outputs/
diff --git a/build_all_python_frameworks.zsh b/build_all_python_frameworks.zsh
@@ -6,7 +6,7 @@
 # Run this with your current directory being the path where this script is located
 
 TOOLSDIR=$(dirname $0)
-SIGNING_IDENTITY="Developer ID Installer: Clever DevOps Co. (9GQZ7KUFR6)"
+SIGNING_IDENTITY="Developer ID Installer: Mac Admins Open Source (T4SK8ZXCXG)"
 
 "$TOOLSDIR/build_python_framework_pkgs.zsh" minimal ${SIGNING_IDENTITY}
 "$TOOLSDIR/build_python_framework_pkgs.zsh" no_customization ${SIGNING_IDENTITY}

diff --git a/build_python_framework_pkgs.zsh b/build_python_framework_pkgs.zsh
@@ -245,7 +245,7 @@ if [ -n "$2" ]; then
   {
     "ownership": "recommended",
     "suppress_bundle_relocation": true,
-    "identifier": "org.macadmins.python.$TYPE",
+    "identifier": "io.macadmins.python.$TYPE",
     "postinstall_action": "none",
     "distribution_style": true,
     "version": "$AUTOMATED_PYTHON_BUILD",
@@ -266,7 +266,7 @@ SIGNED_JSONFILE
   else
     if [ -n "$5" ]; then
       # Notarize and staple the package
-      $XCODE_NOTARY_PATH store-credentials --apple-id "[email protected]" --team-id "9GQZ7KUFR6" --password "$NOTARY_PASS" macadminpython
+      $XCODE_NOTARY_PATH store-credentials --apple-id "[email protected]" --team-id "T4SK8ZXCXG" --password "$NOTARY_PASS" macadminpython
       # If these fail, it will bail on the entire process
       $XCODE_NOTARY_PATH submit "$TOOLSDIR/$TYPE/build/python_${TYPE}_signed-$AUTOMATED_PYTHON_BUILD.pkg" --keychain-profile "macadminpython" --wait
       $XCODE_STAPLER_PATH staple "$TOOLSDIR/$TYPE/build/python_${TYPE}_signed-$AUTOMATED_PYTHON_BUILD.pkg"