lando / lando/code-sign-action

Any ability to adjust to allow multiple files being signed - either at once or multiple runs of the action in the same job?

Open
#12 2 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
PowerShell
Stars
36
Forks
4
PR merge metrics
No merged PRs in 30d

Description

Really love the action, it's saved a ton of time and copy/pasting of code signing stuff through various jobs.

Running into a use case that would love ideas/feedback on.

Trying to build and sign two files in the same GH job for a mac app signing.

Attempting to run the action a second time in a job fails with the error below.

Signsetup
  security: SecKeychainCreate macos-build.keychain: A keychain with the same name already exists.

And it doesn't look like there is any mechanism to pass multiple files in either to the action (or the underlying codesign)

Any thoughts on the best way to sign multiple files in a single job using the action rather than manually building the codesign command line?

ie:

- name: Sign Staging Binary
        uses: lando/code-sign-action@v3
        with:
          file: staging-app
          certificate-data: ${{ secrets.APPLE_CERT_DATA }}
          apple-team-id: ${{ secrets.APPLE_TEAM_ID }}
          certificate-password: ${{ secrets.APPLE_CERT_PASSWORD }}
- name: Sign Prod Binary
        uses: lando/code-sign-action@v3
        with:
          file: prod-app
          certificate-data: ${{ secrets.APPLE_CERT_DATA }}
          apple-team-id: ${{ secrets.APPLE_TEAM_ID }}
          certificate-password: ${{ secrets.APPLE_CERT_PASSWORD }}

vs

- name: Sign Staging Binary
        uses: lando/code-sign-action@v3
        with:
          file: staging-app
          certificate-data: ${{ secrets.APPLE_CERT_DATA }}
          apple-team-id: ${{ secrets.APPLE_TEAM_ID }}
          certificate-password: ${{ secrets.APPLE_CERT_PASSWORD }}
- name: Sign Production Binary
        run: codesign --sign <yada yada> prod-app

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by reviewing the action's input handling and signing setup, then reproduce the provided workflow with two action invocations. Determine how multiple files or repeated runs should be represented while avoiding the duplicate keychain error. Done means both staging-app and prod-app can be signed through the action in one job.

Written by the indexing model from the issue text.

Assessment

Tech stack
github-actions, powershell
Domain
ci-cd, security
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.