From e25e31315588b1b98164bbeaa8ffb9d10e5f121d Mon Sep 17 00:00:00 2001
From: Wyvest <wyvestbusiness@gmail.com>
Date: Tue, 24 Feb 2026 00:20:04 -0500
Subject: [PATCH] Implement Apple Developer Certificate handling in workflow

Added steps to import and verify Apple Developer Certificate for macOS builds.
---
 .github/workflows/oneclient_release.yml | 52 ++++++++++++++++++++++++-
 1 file changed, 51 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/oneclient_release.yml b/.github/workflows/oneclient_release.yml
index be59122f..807e0feb 100644
--- a/.github/workflows/oneclient_release.yml
+++ b/.github/workflows/oneclient_release.yml
@@ -39,7 +39,57 @@ jobs:
       - name: Setup Packages
         uses: ./.github/actions/setup-packages
 
-      - uses: tauri-apps/tauri-action@dev
+      - name: import Apple Developer Certificate
+        if: startsWith(matrix.platform, 'macos')
+        # Prevents keychain from locking automatically for 3600 seconds.
+        env:
+          APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }}
+          APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
+          KEYCHAIN_PASSWORD: ${{ secrets.KEYCHAIN_PASSWORD }}
+        run: |
+          echo $APPLE_CERTIFICATE | base64 --decode > certificate.p12
+          security create-keychain -p "$KEYCHAIN_PASSWORD" build.keychain
+          security default-keychain -s build.keychain
+          security unlock-keychain -p "$KEYCHAIN_PASSWORD" build.keychain
+          security set-keychain-settings -t 3600 -u build.keychain
+          security import certificate.p12 -k build.keychain -P "$APPLE_CERTIFICATE_PASSWORD" -T /usr/bin/codesign
+          security set-key-partition-list -S apple-tool:,apple:,codesign: -s -k "$KEYCHAIN_PASSWORD" build.keychain
+          security find-identity -v -p codesigning build.keychain
+
+      - name: verify certificate
+        if: startsWith(matrix.platform, 'macos')
+        run: |
+          CERT_INFO=$(security find-identity -v -p codesigning build.keychain | grep "Developer ID Application")
+          CERT_ID=$(echo "$CERT_INFO" | awk -F'"' '{print $2}')
+          echo "CERT_ID=$CERT_ID" >> $GITHUB_ENV
+          echo "Certificate imported."
+
+      - name: Build App (macOS)
+        if: startsWith(matrix.platform, 'macos')
+        uses: tauri-apps/tauri-action@dev
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
+          TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
+          APPLE_ID: ${{ secrets.APPLE_ID }}
+          APPLE_PASSWORD: ${{ secrets.APPLE_PASSWORD }}
+          APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
+          APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }}
+          APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
+          APPLE_SIGNING_IDENTITY: ${{ env.CERT_ID }}
+        with:
+          tagName: oneclient-__VERSION__
+          releaseName: OneClient __VERSION__
+          releaseDraft: true
+          prerelease: ${{ startsWith(github.ref, 'refs/tags/v') && contains(github.ref, '-alpha') || false }}
+          tauriScript: pnpm -w oneclient:desktop
+          args: ${{ matrix.args }}
+          projectPath: ./apps/oneclient/desktop/
+          uploadUpdaterJson: true
+          
+      - name: Build App (non-macOS)
+        if: startsWith(matrix.platform, 'macos') == false
+        uses: tauri-apps/tauri-action@dev
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}