Wire Apple KMS release signing

.forgejo/workflows/publish-store-uploads.yml

@@ -62,10 +62,83 @@ env:
   BURROW_NIX_CACHE_URL: ${{ vars.BURROW_NIX_CACHE_URL || 'https://nix.burrow.net/burrow' }}
   BURROW_NIX_CACHE_PUBLIC_KEY: ${{ vars.BURROW_NIX_CACHE_PUBLIC_KEY }}
   BURROW_APPLE_BUNDLE_ID: ${{ vars.BURROW_APPLE_BUNDLE_ID || 'net.burrow.app' }}
+  BURROW_APPLE_NETWORK_EXTENSION_BUNDLE_ID: ${{ vars.BURROW_APPLE_NETWORK_EXTENSION_BUNDLE_ID || 'net.burrow.app.network' }}
+  BURROW_IOS_DISTRIBUTION_CERTIFICATE_ID: ${{ vars.BURROW_IOS_DISTRIBUTION_CERTIFICATE_ID || '3G42677598' }}
+  BURROW_DEVELOPER_ID_CERTIFICATE_ID: ${{ vars.BURROW_DEVELOPER_ID_CERTIFICATE_ID || '9JKN6HXBHC' }}
+  BURROW_APPLE_SIGNING_MODE: ${{ vars.BURROW_APPLE_SIGNING_MODE || 'google-kms-staged' }}
+  BURROW_NOTARIZE_MACOS: ${{ vars.BURROW_NOTARIZE_MACOS || 'true' }}
+  BURROW_SPARKLE_SIGN_WITH_KMS: ${{ vars.BURROW_SPARKLE_SIGN_WITH_KMS || 'true' }}
+  BURROW_SPARKLE_KMS_KEY: ${{ vars.BURROW_SPARKLE_KMS_KEY || 'sparkle-ed25519' }}
+  BURROW_SPARKLE_KMS_VERSION: ${{ vars.BURROW_SPARKLE_KMS_VERSION || '1' }}
+  BURROW_KMS_LOCATION: ${{ vars.BURROW_KMS_LOCATION || 'global' }}
+  BURROW_KMS_KEYRING: ${{ vars.BURROW_KMS_KEYRING || 'burrow-identity' }}
 
 jobs:
+  sign-apple-kms:
+    name: Sign (Apple KMS)
+    if: ${{ github.event.inputs.upload_app_store == 'true' || github.event.inputs.upload_sparkle == 'true' }}
+    runs-on: namespace-profile-linux-medium
+    steps:
+      - name: Checkout
+        uses: https://code.forgejo.org/actions/checkout@v4
+        with:
+          token: ${{ github.token }}
+          fetch-depth: 0
+
+      - name: Ensure Nix
+        shell: bash
+        run: bash Scripts/ci/ensure-nix.sh
+
+      - name: Configure Age
+        shell: bash
+        env:
+          AGE_FORGE_SSH_KEY: ${{ secrets.AGE_FORGE_SSH_KEY }}
+        run: Scripts/resolve-age-identity.sh >> "$GITHUB_ENV"
+
+      - name: Decrypt Release Secrets
+        uses: ./.forgejo/actions/decrypt-release-secrets
+
+      - name: Validate App Store Credentials
+        shell: bash
+        run: Scripts/ci/check-release-config.sh app-store
+
+      - name: Download Staged Apple Artifacts
+        shell: bash
+        env:
+          BUILD_NUMBER: ${{ github.event.inputs.build_number }}
+        run: |
+          set -euo pipefail
+          nix develop .#ci -c Scripts/ci/google-wif-auth.sh
+          mkdir -p "dist/builds/${BUILD_NUMBER}/apple"
+          nix develop .#ci -c gcloud storage rsync --recursive "gs://${BURROW_RELEASE_GCS_BUCKET}/builds/${BUILD_NUMBER}/apple" "dist/builds/${BUILD_NUMBER}/apple"
+          find "dist/builds/${BUILD_NUMBER}/apple" -type f -print | sort
+
+      - name: Sync Apple Provisioning Profiles
+        shell: bash
+        run: nix develop .#ci -c Scripts/ci/sync-apple-provisioning-profiles.sh all
+
+      - name: Sign Apple Artifacts With KMS
+        shell: bash
+        env:
+          BUILD_NUMBER: ${{ github.event.inputs.build_number }}
+          SPARKLE_CHANNEL_INPUT: ${{ github.event.inputs.sparkle_channel }}
+        run: |
+          set -euo pipefail
+          channel="${SPARKLE_CHANNEL_INPUT:-}"
+          if [[ -z "$channel" ]]; then
+            channel="build-${BUILD_NUMBER}"
+          fi
+          SPARKLE_CHANNEL="$channel" nix develop .#ci -c Scripts/apple/sign-release-artifacts-kms.sh all
+
+      - name: Upload Signed Apple Artifacts
+        shell: bash
+        env:
+          BUILD_NUMBER: ${{ github.event.inputs.build_number }}
+        run: nix develop .#ci -c Scripts/ci/upload-release-storage.sh
+
   upload-app-store:
     name: Upload (App Store Connect)
+    needs: sign-apple-kms
     if: ${{ github.event.inputs.upload_app_store == 'true' }}
     runs-on: namespace-profile-macos-large
     steps:
@@ -120,7 +193,11 @@ jobs:
           cp "$key_path" "$altool_key_dir/AuthKey_${ASC_API_KEY_ID}.p8"
           chmod 600 "$key_path" "$altool_key_dir/AuthKey_${ASC_API_KEY_ID}.p8"
           shopt -s nullglob
-          artifacts=(publish/apple/*.ipa publish/apple/*.pkg)
+          artifacts=()
+          for artifact in publish/apple/*.ipa publish/apple/*.pkg; do
+            [[ "$artifact" == *.unsigned.ipa ]] && continue
+            artifacts+=("$artifact")
+          done
           if (( ${#artifacts[@]} == 0 )); then
             echo "::error ::No Apple upload artifacts found for build ${{ github.event.inputs.build_number }}."
             exit 1
@@ -219,6 +296,7 @@ jobs:
 
   upload-sparkle:
     name: Upload (Sparkle)
+    needs: sign-apple-kms
     if: ${{ github.event.inputs.upload_sparkle == 'true' }}
     runs-on: namespace-profile-linux-medium
     steps: