Build and sign Mac app on CircleCI (#3107)

* try codesign on mac circle

* run mac code sign setup as sudo

* check env variables

* pass org context to command

* update shell command

* hmm does shell need to login

* add FASTLANE_LANE

* fix log messages in build

* DEBUG code sign

* try importing profile first

* use sign shell script inline

* exit if importing profile fails

* unlock keychain

* try creating custom keychain and using it

* more unlocking

* try using -T

* append new keychain to the list

* try mac executor 10.1.0

* skip node version check

* set keychain name to use for signing

* remove passing name of the keychain

* more comments

* use env variables directly to code sign on mac

* use electron-builder to sign mac app

* try disabling publishing by electron-builder

* try testing Mac binary against kitchensink

* wait on the right job

* run on mac-sign-2 branch

* remove buildkite pipeline

* remove old commands

* darwin platform

* workflows via templates

* inherit stdio when calling codesign

* build binary for this branch

* actually build an app, dah

* add note about code sign in PR

* remove FASTLANE env variable

* enable linux builds and remove current branch

scripts/binary.js

@@ -15,6 +15,8 @@ if (!fn) {
   console.error('Invalid deploy command %s 🚫', command)
 }
 
+// TODO allow passing CLI arguments to each command
+
 fn()
 .then(() => {
   return console.log('✅ %s completed', command)

scripts/binary/build.coffee

@@ -13,13 +13,12 @@ gulpTypeScript = require("gulp-typescript")
 pluralize = require("pluralize")
 vinylPaths = require("vinyl-paths")
 coffee = require("@packages/coffee")
+execa = require("execa")
 electron = require("@packages/electron")
-signOsxApp = require("electron-osx-sign")
 debug = require("debug")("cypress:binary")
 R = require("ramda")
 la = require("lazy-ass")
 check = require("check-more-types")
-execa = require("execa")
 
 meta = require("./meta")
 smoke = require("./smoke")
@@ -29,11 +28,12 @@ linkPackages = require('../link-packages')
 
 rootPackage = require("@packages/root")
 
-sign  = Promise.promisify(signOsxApp)
 fs = Promise.promisifyAll(fse)
 
 logger = (msg, platform) ->
-  console.log(chalk.yellow(msg), chalk.bgWhite(chalk.black(platform)))
+  time = new Date()
+  timeStamp = time.toLocaleTimeString()
+  console.log(timeStamp, chalk.yellow(msg), chalk.blue(platform))
 
 logBuiltAllPackages = () ->
   console.log("built all packages")
@@ -129,7 +129,7 @@ buildCypressApp = (platform, version, options = {}) ->
         packages.forceNpmInstall(serverFolder, "@ffmpeg-installer/win32-ia32")
 
   createRootPackage = ->
-    log("#createRootPackage", platform, version)
+    log("#createRootPackage #{platform} #{version}")
 
     fs.outputJsonAsync(distDir("package.json"), {
       name: "cypress"
@@ -257,18 +257,14 @@ buildCypressApp = (platform, version, options = {}) ->
       return Promise.resolve()
 
     appFolder = meta.zipDir(platform)
-    log("#codeSign", appFolder)
-    sign({
-      app: appFolder
-      platform
-      verbose: true
-    })
+    log("#codeSign #{appFolder}")
+    execa('build', ["--publish", "never", "--prepackaged", appFolder], {stdio: "inherit"})
 
   verifyAppCanOpen = ->
     if (platform != "darwin") then return Promise.resolve()
 
     appFolder = meta.zipDir(platform)
-    log("#verifyAppCanOpen", appFolder)
+    log("#verifyAppCanOpen #{appFolder}")
     new Promise (resolve, reject) =>
       args = ["-a", "-vvvv", appFolder]
       debug("cmd: spctl #{args.join(' ')}")

scripts/binary/bump.coffee

@@ -17,14 +17,6 @@ car = null
 
 # all the projects to trigger / run / change environment variables for
 _PROVIDERS = {
-  buildkite: {
-    main: "cypress-io/cypress"
-    others: [
-      "cypress-io/cypress-test-tiny"
-      "cypress-io/cypress-test-example-repos"
-    ]
-  }
-
   appVeyor: {
     main: "cypress-io/cypress"
     others: [

scripts/check-node-version.js

@@ -1,20 +1,34 @@
 // TODO make this check a 3rd party little tool
 
-// we want to ensure we are building using the same major version
-// as the one specified in ../.node-version file
-const read = require('fs').readFileSync
-const join = require('path').join
-
-const nodeVersionNeededString = read(join(__dirname, '..', '.node-version'), 'utf8')
-const nodeVersionNeeded = nodeVersionNeededString.split('.')
-
-const nodeVersion = process.versions.node.split('.')
-
-// check just major version for now
-if (nodeVersionNeeded[0] !== nodeVersion[0]) {
-  /* eslint-disable no-console */
-  console.error('🛑 .node-version specified %s', nodeVersionNeededString)
-  console.error('but current Node is %s', process.versions.node)
-  /* eslint-enable no-console */
-  process.exit(1)
+// on CircleCI Mac machine, we need to use on of the laer executors
+// that already has Node 10 / 11
+const isMac = () => {
+  return process.platform === 'darwin'
+}
+
+if (isMac()) {
+  // eslint-disable-next-line no-console
+  console.log('Skipping Node version check on Mac')
+} else {
+  // we want to ensure we are building using the same major version
+  // as the one specified in ../.node-version file
+  const read = require('fs').readFileSync
+  const join = require('path').join
+
+  const nodeVersionNeededString = read(
+    join(__dirname, '..', '.node-version'),
+    'utf8'
+  )
+  const nodeVersionNeeded = nodeVersionNeededString.split('.')
+
+  const nodeVersion = process.versions.node.split('.')
+
+  // check just major version for now
+  if (nodeVersionNeeded[0] !== nodeVersion[0]) {
+    /* eslint-disable no-console */
+    console.error('🛑 .node-version specified %s', nodeVersionNeededString)
+    console.error('but current Node is %s', process.versions.node)
+    /* eslint-enable no-console */
+    process.exit(1)
+  }
 }