@@ -1021,7 +1021,7 @@ jobs:
10211021needs :
10221022 -changes
10231023 -build-dylib
1024- if :github.ref == 'refs/heads/main' && needs.changes.outputs.docs-only == 'false' && !github.event.pull_request.head.repo.fork
1024+ #
10251025runs-on :${{ github.repository_owner == 'coder' && 'depot-ubuntu-22.04-8' || 'ubuntu-22.04' }}
10261026permissions :
10271027# Necessary to push docker images to ghcr.io.
@@ -1060,6 +1060,27 @@ jobs:
10601060 -name :Setup Go
10611061uses :./.github/actions/setup-go
10621062
1063+ -name :Install rcodesign
1064+ run :|
1065+ set -euo pipefail
1066+ wget -O /tmp/rcodesign.tar.gz https://github.com/indygreg/apple-platform-rs/releases/download/apple-codesign%2F0.22.0/apple-codesign-0.22.0-x86_64-unknown-linux-musl.tar.gz
1067+ sudo tar -xzf /tmp/rcodesign.tar.gz \
1068+ -C /usr/bin \
1069+ --strip-components=1 \
1070+ apple-codesign-0.22.0-x86_64-unknown-linux-musl/rcodesign
1071+ rm /tmp/rcodesign.tar.gz
1072+
1073+ name :Setup Apple Developer certificate
1074+ run :|
1075+ set -euo pipefail
1076+ touch /tmp/{apple_cert.p12,apple_cert_password.txt}
1077+ chmod 600 /tmp/{apple_cert.p12,apple_cert_password.txt}
1078+ echo "$AC_CERTIFICATE_P12_BASE64" | base64 -d > /tmp/apple_cert.p12
1079+ echo "$AC_CERTIFICATE_PASSWORD" > /tmp/apple_cert_password.txt
1080+ env :
1081+ AC_CERTIFICATE_P12_BASE64 :${{ secrets.AC_CERTIFICATE_P12_BASE64 }}
1082+ AC_CERTIFICATE_PASSWORD :${{ secrets.AC_CERTIFICATE_PASSWORD }}
1083+
10631084# Necessary for signing Windows binaries.
10641085 -name :Setup Java
10651086uses :actions/setup-java@c5195efecf7bdfc987ee8bae7a71cb8b11521c00 # v4.7.1
@@ -1138,6 +1159,9 @@ jobs:
11381159CODER_WINDOWS_RESOURCES :" 1"
11391160CODER_SIGN_GPG :" 1"
11401161CODER_GPG_RELEASE_KEY_BASE64 :${{ secrets.GPG_RELEASE_KEY_BASE64 }}
1162+ CODER_SIGN_DARWIN :" 1"
1163+ AC_CERTIFICATE_FILE :/tmp/apple_cert.p12
1164+ AC_CERTIFICATE_PASSWORD_FILE :/tmp/apple_cert_password.txt
11411165EV_KEY :${{ secrets.EV_KEY }}
11421166EV_KEYSTORE :${{ secrets.EV_KEYSTORE }}
11431167EV_TSA_URL :${{ secrets.EV_TSA_URL }}