98 lines
4.2 KiB
YAML
98 lines
4.2 KiB
YAML
name: "Apple: Developer ID KMS CSR"
|
|
run-name: "Apple: Developer ID KMS CSR (${{ github.event.inputs.kms_key || 'apple-developer-id-application' }})"
|
|
|
|
on:
|
|
workflow_dispatch:
|
|
inputs:
|
|
kms_key:
|
|
description: Google KMS key name in the Burrow identity key ring
|
|
required: false
|
|
default: apple-developer-id-application
|
|
kms_version:
|
|
description: Google KMS key version
|
|
required: false
|
|
default: "1"
|
|
common_name:
|
|
description: CSR common name
|
|
required: false
|
|
default: Burrow Developer ID Application
|
|
email_address:
|
|
description: CSR email address
|
|
required: false
|
|
default: release@burrow.net
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
concurrency:
|
|
group: apple-developer-id-kms-csr-${{ github.ref }}
|
|
cancel-in-progress: false
|
|
|
|
env:
|
|
BURROW_GOOGLE_PROJECT_ID: ${{ vars.GOOGLE_PROJECT_ID || 'project-88c23ce9-918a-470a-b33' }}
|
|
GOOGLE_CLOUD_PROJECT: ${{ vars.GOOGLE_PROJECT_ID || 'project-88c23ce9-918a-470a-b33' }}
|
|
BURROW_GOOGLE_PROJECT_NUMBER: ${{ vars.GOOGLE_PROJECT_NUMBER || '416198671487' }}
|
|
BURROW_GOOGLE_WIF_POOL_ID: ${{ vars.BURROW_GOOGLE_WIF_POOL_ID || 'burrow-authentik' }}
|
|
BURROW_GOOGLE_WIF_PROVIDER_ID: ${{ vars.BURROW_GOOGLE_WIF_PROVIDER_ID || 'forgejo-runners' }}
|
|
BURROW_GOOGLE_WIF_SERVICE_ACCOUNT: ${{ vars.BURROW_GOOGLE_WIF_SERVICE_ACCOUNT || 'burrow-forgejo-runner@project-88c23ce9-918a-470a-b33.iam.gserviceaccount.com' }}
|
|
BURROW_AUTHENTIK_WIF_ISSUER: ${{ vars.BURROW_AUTHENTIK_WIF_ISSUER || 'https://auth.burrow.net/application/o/google-cloud/' }}
|
|
BURROW_AUTHENTIK_WIF_AUDIENCE: ${{ vars.BURROW_AUTHENTIK_WIF_AUDIENCE || 'google-wif.burrow.net' }}
|
|
BURROW_AUTHENTIK_WIF_CLIENT_ID: ${{ vars.BURROW_AUTHENTIK_WIF_CLIENT_ID || 'google-wif.burrow.net' }}
|
|
BURROW_AUTHENTIK_WIF_CLIENT_SECRET: ${{ secrets.BURROW_AUTHENTIK_WIF_CLIENT_SECRET }}
|
|
BURROW_KMS_LOCATION: global
|
|
BURROW_KMS_KEYRING: burrow-identity
|
|
|
|
jobs:
|
|
csr:
|
|
name: Generate CSR
|
|
runs-on: [self-hosted, linux, x86_64, burrow-forge]
|
|
timeout-minutes: 20
|
|
steps:
|
|
- name: Checkout
|
|
uses: https://code.forgejo.org/actions/checkout@v4
|
|
with:
|
|
token: ${{ github.token }}
|
|
fetch-depth: 0
|
|
|
|
- name: Ensure Nix
|
|
shell: bash
|
|
run: bash Scripts/ci/ensure-nix.sh
|
|
|
|
- name: Authenticate Google WIF
|
|
shell: bash
|
|
run: nix develop .#ci -c Scripts/ci/google-wif-auth.sh
|
|
|
|
- name: Generate KMS-backed CSR
|
|
shell: bash
|
|
env:
|
|
BURROW_APPLE_DEVELOPER_ID_KMS_KEY: ${{ github.event.inputs.kms_key || 'apple-developer-id-application' }}
|
|
BURROW_KMS_VERSION: ${{ github.event.inputs.kms_version || '1' }}
|
|
BURROW_APPLE_DEVELOPER_ID_CSR_COMMON_NAME: ${{ github.event.inputs.common_name || 'Burrow Developer ID Application' }}
|
|
BURROW_APPLE_DEVELOPER_ID_CSR_EMAIL: ${{ github.event.inputs.email_address || 'release@burrow.net' }}
|
|
run: |
|
|
set -euo pipefail
|
|
mkdir -p dist/apple-developer-id
|
|
nix develop .#ci -c Scripts/apple/google-kms-csr.py \
|
|
--output dist/apple-developer-id/developer-id-application.certSigningRequest \
|
|
--public-key-output dist/apple-developer-id/google-kms-public-key.pem
|
|
if command -v openssl >/dev/null 2>&1; then
|
|
openssl req -in dist/apple-developer-id/developer-id-application.certSigningRequest -noout -verify
|
|
fi
|
|
cat > dist/apple-developer-id/README.txt <<'EOF'
|
|
This CSR is backed by a non-exportable Google Cloud KMS key in the Burrow
|
|
identity key ring. Apple currently documents Developer ID certificate creation
|
|
through the Developer website or Xcode, not App Store Connect API creation.
|
|
|
|
Upload developer-id-application.certSigningRequest in:
|
|
Certificates, Identifiers & Profiles -> Certificates -> + -> Developer ID ->
|
|
Developer ID Application.
|
|
|
|
Keep the returned .cer file with release artifacts. The private key remains in
|
|
Google Cloud KMS and is never exported as a p12.
|
|
EOF
|
|
|
|
- name: Upload CSR Artifact
|
|
uses: https://code.forgejo.org/actions/upload-artifact@v3
|
|
with:
|
|
name: burrow-developer-id-kms-csr
|
|
path: dist/apple-developer-id
|