ci: build unsigned desktop artifacts without signing secrets (#1530)

scripts/release-desktop.test.sh

@@ -6,6 +6,19 @@ TMP_DIR="$(mktemp -d)"
 trap 'rm -rf "$TMP_DIR"' EXIT
 OUT_FILE="$TMP_DIR/out"
 ERR_FILE="$TMP_DIR/err"
+SIGNING_SECRET_ENV=(
+  -u APPLE_CERTIFICATE
+  -u APPLE_CERTIFICATE_PASSWORD
+  -u KEYCHAIN_PASSWORD
+  -u APPLE_ID
+  -u APPLE_PASSWORD
+  -u APPLE_TEAM_ID
+  -u APPLE_API_KEY
+  -u APPLE_API_ISSUER
+  -u APPLE_API_KEY_P8
+  -u WINDOWS_CERTIFICATE
+  -u WINDOWS_CERTIFICATE_PASSWORD
+)
 
 fail() {
   echo "FAIL: $*" >&2
@@ -16,6 +29,10 @@ pass() {
   echo "PASS: $*"
 }
 
+signing_secret_env() {
+  env "${SIGNING_SECRET_ENV[@]}" "$@"
+}
+
 write_runtime() {
   local dir="$1"
   local helper="${2:-with-helper}"
@@ -119,6 +136,48 @@ printf 'desktop artifact\n' > "$artifact"
 "$ROOT_DIR/scripts/release/verify-desktop-assets.sh" "$assets_dir" linux-x64 >/dev/null
 pass "verify-desktop-assets accepts matching checksums"
 
+if signing_secret_env "$ROOT_DIR/scripts/release/desktop-signing-ready.sh" macos >"$OUT_FILE" 2>"$ERR_FILE"; then
+  fail "desktop-signing-ready should report macOS signing not ready without secrets"
+fi
+grep -q "APPLE_CERTIFICATE" "$ERR_FILE" || fail "desktop-signing-ready did not report missing Apple certificate"
+grep -q "APPLE_ID/APPLE_PASSWORD/APPLE_TEAM_ID" "$ERR_FILE" || fail "desktop-signing-ready did not report missing notarization inputs"
+pass "desktop-signing-ready reports incomplete macOS inputs"
+
+signing_secret_env \
+  APPLE_CERTIFICATE=cert \
+  APPLE_CERTIFICATE_PASSWORD=cert-password \
+  KEYCHAIN_PASSWORD=keychain-password \
+  APPLE_ID=apple@example.test \
+  APPLE_PASSWORD=apple-password \
+  APPLE_TEAM_ID=TEAMID123 \
+  "$ROOT_DIR/scripts/release/desktop-signing-ready.sh" macos >"$OUT_FILE"
+grep -q "complete for macos" "$OUT_FILE" || fail "desktop-signing-ready rejected Apple ID notarization inputs"
+pass "desktop-signing-ready accepts Apple ID notarization inputs"
+
+signing_secret_env \
+  APPLE_CERTIFICATE=cert \
+  APPLE_CERTIFICATE_PASSWORD=cert-password \
+  KEYCHAIN_PASSWORD=keychain-password \
+  APPLE_API_KEY=api-key \
+  APPLE_API_ISSUER=api-issuer \
+  APPLE_API_KEY_P8=api-key-p8 \
+  "$ROOT_DIR/scripts/release/desktop-signing-ready.sh" macos >"$OUT_FILE"
+grep -q "complete for macos" "$OUT_FILE" || fail "desktop-signing-ready rejected App Store Connect API notarization inputs"
+pass "desktop-signing-ready accepts API key notarization inputs"
+
+if signing_secret_env "$ROOT_DIR/scripts/release/desktop-signing-ready.sh" windows >"$OUT_FILE" 2>"$ERR_FILE"; then
+  fail "desktop-signing-ready should report Windows signing not ready without secrets"
+fi
+grep -q "WINDOWS_CERTIFICATE" "$ERR_FILE" || fail "desktop-signing-ready did not report missing Windows certificate"
+pass "desktop-signing-ready reports incomplete Windows inputs"
+
+signing_secret_env \
+  WINDOWS_CERTIFICATE=windows-cert \
+  WINDOWS_CERTIFICATE_PASSWORD=windows-password \
+  "$ROOT_DIR/scripts/release/desktop-signing-ready.sh" windows >"$OUT_FILE"
+grep -q "complete for windows" "$OUT_FILE" || fail "desktop-signing-ready rejected Windows signing inputs"
+pass "desktop-signing-ready accepts Windows signing inputs"
+
 fallback_tools_dir="$TMP_DIR/sha256sum-tools"
 fallback_assets_dir="$TMP_DIR/sha256sum-assets"
 mkdir -p "$fallback_tools_dir" "$fallback_assets_dir"

scripts/release/desktop-signing-ready.sh

@@ -0,0 +1,65 @@
+#!/usr/bin/env bash
+# Return success when desktop signing inputs are complete for a platform family.
+set -euo pipefail
+
+usage() {
+  cat <<'EOF'
+Usage: desktop-signing-ready.sh <macos|windows>
+
+Checks whether the current environment has enough signing/notarization inputs
+to produce signed desktop artifacts for the requested platform family. Missing
+inputs are reported, but incomplete signing is not a workflow error by itself.
+EOF
+}
+
+if [ "${1:-}" = "-h" ] || [ "${1:-}" = "--help" ]; then
+  usage
+  exit 0
+fi
+
+PLATFORM="${1:-}"
+missing=()
+
+require_secret() {
+  local name="$1"
+  if [ -z "${!name:-}" ]; then
+    missing+=("$name")
+  fi
+}
+
+case "$PLATFORM" in
+  macos)
+    require_secret APPLE_CERTIFICATE
+    require_secret APPLE_CERTIFICATE_PASSWORD
+    require_secret KEYCHAIN_PASSWORD
+
+    apple_id_notarization=false
+    if [ -n "${APPLE_ID:-}" ] && [ -n "${APPLE_PASSWORD:-}" ] && [ -n "${APPLE_TEAM_ID:-}" ]; then
+      apple_id_notarization=true
+    fi
+
+    api_key_notarization=false
+    if [ -n "${APPLE_API_KEY:-}" ] && [ -n "${APPLE_API_ISSUER:-}" ] && [ -n "${APPLE_API_KEY_P8:-}" ]; then
+      api_key_notarization=true
+    fi
+
+    if [ "$apple_id_notarization" = "false" ] && [ "$api_key_notarization" = "false" ]; then
+      missing+=("APPLE_ID/APPLE_PASSWORD/APPLE_TEAM_ID or APPLE_API_KEY/APPLE_API_ISSUER/APPLE_API_KEY_P8")
+    fi
+    ;;
+  windows)
+    require_secret WINDOWS_CERTIFICATE
+    require_secret WINDOWS_CERTIFICATE_PASSWORD
+    ;;
+  *)
+    usage >&2
+    exit 2
+    ;;
+esac
+
+if [ "${#missing[@]}" -gt 0 ]; then
+  printf 'Desktop signing inputs incomplete for %s: %s\n' "$PLATFORM" "${missing[*]}" >&2
+  exit 1
+fi
+
+printf 'Desktop signing inputs complete for %s.\n' "$PLATFORM"