chore: sign and notarize the binary file for the macOS

.github/workflows/build.yaml

@@ -1,23 +0,0 @@
-name: build
-
-on:
-  release:
-    types: [created] # 表示在创建新的 Release 时触发
-
-jobs:
-  build-go-binary:
-    runs-on: ubuntu-latest
-    strategy:
-      matrix:
-        goos: [windows, darwin] # 需要打包的系统
-        goarch: [amd64, arm64] # 需要打包的架构
-    steps:
-      - uses: actions/checkout@v3
-      - uses: wangyoucao577/go-release-action@v1.30
-        with:
-          github_token: ${{ secrets.GITHUB_TOKEN }} # 一个默认的变量，用来实现往 Release 中添加文件
-          goos: ${{ matrix.goos }}
-          goarch: ${{ matrix.goarch }}
-          goversion: 1.18 # 可以指定编译使用的 Golang 版本
-          binary_name: "wx_video_download" # 可以指定二进制文件的名称
-          extra_files: README.md # 需要包含的额外文件

.github/workflows/docs.yml

@@ -1,8 +1,6 @@
 name: Deploy Docs (VitePress)
 
 on:
-  push:
-    branches: [ main ]
   workflow_dispatch:
 
 permissions:

.github/workflows/release.yml

@@ -12,6 +12,12 @@ jobs:
   goreleaser:
     name: Release
     runs-on: ubuntu-latest
+    env:
+      MAC_CERT_P12: ${{ secrets.MAC_CERT_P12 }}
+      MAC_CERT_PASSWORD: ${{ secrets.MAC_CERT_PASSWORD }}
+      NOTARY_PRIVATE_KEY: ${{ secrets.NOTARY_PRIVATE_KEY }}
+      NOTARY_KEY_ID: ${{ secrets.NOTARY_KEY_ID }}
+      NOTARY_ISSUER_ID: ${{ secrets.NOTARY_ISSUER_ID }}
     steps:
       - name: Checkout
         uses: actions/checkout@v4
@@ -22,18 +28,65 @@ jobs:
         uses: actions/setup-go@v5
         with:
           go-version: '1.24'
-      
+
+
       - name: Generate Windows resources (.syso)
         run: |
           set -e
           go run github.com/tc-hib/go-winres@latest make --in ./winres/winres.json --arch amd64
           go run github.com/tc-hib/go-winres@latest make --in ./winres/winres.json --arch arm64
 
-      - name: Run GoReleaser
+      - name: Install rcodesign
+        run: |
+          set -e
+          curl -L -o rcodesign.tar.gz https://github.com/indygreg/apple-platform-rs/releases/download/apple-codesign%2F0.22.0/apple-codesign-0.22.0-x86_64-unknown-linux-musl.tar.gz
+          tar -xvf rcodesign.tar.gz
+          mv apple-codesign-0.22.0-x86_64-unknown-linux-musl/rcodesign /usr/local/bin/
+          rm -rf rcodesign.tar.gz apple-codesign-0.22.0-x86_64-unknown-linux-musl
+
+      - name: Prepare secrets
+        run: |
+          set -e
+          echo "${{ secrets.MAC_CERT_P12 }}" | base64 --decode > cert.p12
+          echo "${{ secrets.NOTARY_PRIVATE_KEY }}" | base64 --decode > AuthKey.p8
+
+      - name: Build with GoReleaser (skip publish & validate)
         uses: goreleaser/goreleaser-action@v6
         with:
           distribution: goreleaser
           version: latest
-          args: release --clean --draft
+          args: release --skip=publish,validate --clean
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          MAC_CERT_P12_FILE: cert.p12
+          MAC_CERT_PASSWORD: ${{ secrets.MAC_CERT_PASSWORD }}
+
+      - name: Create API key JSON for notarization
+        run: |
+          rcodesign encode-app-store-connect-api-key \
+            "${{ secrets.NOTARY_ISSUER_ID }}" \
+            "${{ secrets.NOTARY_KEY_ID }}" \
+            AuthKey.p8 \
+            > api-key.json
+
+      - name: Notarize macOS archives
+        run: |
+          set -e
+          for file in dist/*darwin*.zip; do
+            if [ -f "$file" ]; then
+              echo "Notarizing $file..."
+              rcodesign notary-submit \
+                --api-key-path api-key.json \
+                --wait \
+                "$file"
+            fi
+          done
+
+      - name: Create GitHub Release and upload assets
+        uses: softprops/action-gh-release@v2
+        with:
+          draft: true
+          files: |
+            dist/*.tar.gz
+            dist/*.zip
+            dist/*checksums.txt

.gitignore

@@ -2,6 +2,8 @@
 *.exe
 *.exe~
 *.syso
+*.p8
+*.p12
 dist/
 
 wx_video_download*

.goreleaser.yaml

@@ -16,11 +16,11 @@ before:
     - go generate ./...
 
 builds:
-  - env:
+  - id: cross
+    env:
       - CGO_ENABLED=0
     goos:
       - windows
-      - darwin
       - linux
     main: .
     binary: wx_video_download
@@ -32,20 +32,41 @@ builds:
       - goos: windows
         goarch: "386"
 
+  - id: macos
+    env:
+      - CGO_ENABLED=0
+    goos:
+      - darwin
+    goarch:
+      - amd64
+      - arm64
+    main: .
+    binary: wx_video_download
+    ldflags:
+      - -s -w
+    hooks:
+      post:
+        - rcodesign sign --p12-file {{ .Env.MAC_CERT_P12_FILE }} --p12-password {{ .Env.MAC_CERT_PASSWORD }} --code-signature-flags runtime "{{ .Path }}"
+
 archives:
-  - format: tar.gz
+  - id: default
+    format: tar.gz
     name_template: "wx_video_download_{{ .Tag }}_{{ .Os }}_{{ if eq .Arch \"amd64\" }}x86_64{{ else if eq .Arch \"386\" }}x86{{ else }}{{ .Arch }}{{ end }}"
     files:
       - src: config/config.template.yaml
         dst: config.yaml
+      - src: LICENSE
       - src: '!README*.md'
-    # use zip for windows archives
     format_overrides:
       - goos: windows
         format: zip
+      - goos: darwin
+        format: zip
 
 upx:
   - enabled: true
+    ids:
+      - cross
     compress: best
     lzma: true
 
@@ -60,6 +81,7 @@ changelog:
       - "^test:"
 
 release:
+  draft: true
   footer: >-
 
     ---

main.go

@@ -21,7 +21,7 @@ var server_cert = &interceptor.ServerCert{
 	CertFile:       cert_file,
 	PrivateKeyFile: private_key_file,
 }
-var AppVer = "251211_18"
+var AppVer = "251212_01"
 
 func main() {
 	cfg, err := config.LoadConfig()