https://github.com/block/apple-codesign-action
A GitHub action for code-signing Block open source software for Apple platforms
https://github.com/block/apple-codesign-action
Last synced: 19 days ago
JSON representation
A GitHub action for code-signing Block open source software for Apple platforms
- Host: GitHub
- URL: https://github.com/block/apple-codesign-action
- Owner: block
- License: apache-2.0
- Created: 2026-03-18T19:52:32.000Z (4 months ago)
- Default Branch: main
- Last Pushed: 2026-03-20T18:43:11.000Z (4 months ago)
- Last Synced: 2026-06-23T20:31:00.040Z (26 days ago)
- Language: Shell
- Size: 21.5 KB
- Stars: 1
- Watchers: 0
- Forks: 0
- Open Issues: 1
-
Metadata Files:
- Readme: README.md
- License: LICENSE
- Codeowners: CODEOWNERS
- Governance: GOVERNANCE.md
Awesome Lists containing this project
README
# Apple Code Signing Action
Reusable GitHub Action for signing Apple applications via Block's internal codesigning service (`codesign_helper` Lambda + Buildkite).
## Setup
Reach out to **#mdx-ios** on Slack to get codesigning configured for your repo. They will provision the required infrastructure and set up two repository secrets:
| Secret | Description |
|---|---|
| `OSX_CODESIGN_ROLE` | IAM role ARN for OIDC authentication with AWS |
| `CODESIGN_S3_BUCKET` | S3 bucket for artifact transfer |
## Usage
The calling job must have `id-token: write` permission for OIDC authentication with AWS.
```yaml
# Example workflow — replace the build and release steps with your own
name: Build and Release
on:
push:
tags: ['v*']
jobs:
release:
runs-on: macos-latest
permissions:
contents: write
id-token: write # Required — the action uses OIDC to authenticate with AWS
steps:
# ...
# Your build step — produces an unsigned .app or .zip
# ...
# apple-codesign-action — signs and notarizes the artifact
# Sign a .app or .zip
- name: Codesign and Notarize
id: codesign
uses: block/apple-codesign-action@XXX # use the latest version ref
with:
osx-codesign-role: ${{ secrets.OSX_CODESIGN_ROLE }}
codesign-s3-bucket: ${{ secrets.CODESIGN_S3_BUCKET }}
unsigned-artifact-path: # .app, .zip, or .dmg
entitlements-plist-path: # Optional
# Use the signed artifact in subsequent steps
# steps.codesign.outputs.signed-artifact-path — signed .app (always set)
# steps.codesign.outputs.signed-dmg-path — signed DMG (only when input was .dmg)
# ...
```
See [apple-codesign-action-example](https://github.com/block/apple-codesign-action-example) for runnable end-to-end examples (`.app`, `.zip`, `.dmg`, Electron, Xcode).
## Inputs
| Input | Required | Default | Description |
|---|---|---|---|
| `osx-codesign-role` | **yes** | — | `${{ secrets.OSX_CODESIGN_ROLE }}` |
| `codesign-s3-bucket` | **yes** | — | `${{ secrets.CODESIGN_S3_BUCKET }}` |
| `unsigned-artifact-path` | **yes** | — | Local path to unsigned artifact (`.app`, `.zip` containing a `.app`, or `.dmg` containing a `.app`) |
| `entitlements-plist-path` | no | `''` | Path to entitlements plist to bundle into the signing payload |
| `artifact-name` | no | `$GITHUB_SHA-$GITHUB_RUN_ID` | Unique S3 key suffix |
| `branch` | no | `main` | Branch override for the signing pipeline (only honored for approved repos) |
## Outputs
| Output | Description |
|---|---|
| `signed-artifact-path` | Local path to the downloaded signed artifact (`.app` inside a `.zip`) |
| `signed-dmg-path` | Local path to the DMG with signed `.app` swapped in (only set when input was a `.dmg`) |
| `build-number` | Build number from the signing service |
| `signing-duration` | Wall-clock seconds the signing took |
## Project Resources
| Resource | Description |
| ------------------------------------------ | ------------------------------------------------------------------------------ |
| [CODEOWNERS](./CODEOWNERS) | Outlines the project lead(s) |
| [GOVERNANCE.md](./GOVERNANCE.md) | Project governance |
| [LICENSE](./LICENSE) | Apache License, Version 2.0 |