chore: Update build workflow to build and notarize on pull requests

.github/workflows/build.yml

@@ -1,10 +1,11 @@
-# TBA
-name: Build
+name: Build & Notarize
 
-on: 
-    push:
-        tags:
-            - 'v*.*.*'
+# on: 
+#     push:
+#         tags:
+#             - 'v*.*.*'
+
+on: "pull_request" # only active during testing
 
 jobs:
     release:
@@ -38,8 +39,4 @@ jobs:
             # Install backend dependencies
             -   run: yarn install-deps
             -   run: yarn build:frontend
-            -   run: rm -rf /dist && GH_TOKEN=${{ secrets.github_token}} NODE_ENV=production npm exec --package=electron-builder -- electron-builder build --mac --arm64 --publish onTagOrDraft
-
-
-            # Run backend
-            # -   run: yarn dev:backend
+            -   run: rm -rf /dist && GH_TOKEN=${{ secrets.github_token}} NODE_ENV=production npm exec --package=electron-builder -- electron-builder build --mac --arm64 --publish always

electron/entitlements.mac.plist

@@ -0,0 +1,26 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+  <dict>
+    <key>com.apple.security.cs.allow-dyld-environment-variables</key>
+    <true/>
+    <key>com.apple.security.cs.disable-library-validation</key>
+    <true/>
+    <key>com.apple.security.cs.allow-jit</key>
+    <true/>
+    <key>com.apple.security.cs.allow-unsigned-executable-memory</key>
+    <true/>
+    <key>com.apple.security.cs.debugger</key>
+    <true/>
+    <key>com.apple.security.network.client</key>
+    <true/>
+    <key>com.apple.security.network.server</key>
+    <true/>
+    <key>com.apple.security.files.user-selected.read-only</key>
+    <true/>
+    <key>com.apple.security.inherit</key>
+    <true/>
+    <key>com.apple.security.automation.apple-events</key>
+    <true/>
+  </dict>
+</plist>

electron/notarize.js

@@ -0,0 +1,17 @@
+const { notarize } = require('@electron/notarize');
+
+exports.default = async function notarizing(context) {
+  const { electronPlatformName, appOutDir } = context;
+  if (electronPlatformName !== 'darwin') {
+    return;
+  }
+
+  const appName = context.packager.appInfo.productFilename;
+
+  return await notarize({
+    appBundleId: 'xyz.valory.olas-operate-app',
+    appPath: `${appOutDir}/${appName}.app`,
+    appleId: process.env.APPLEID,
+    appleIdPassword: process.env.APPLEIDPASS,
+  });
+};

package.json

@@ -23,22 +23,24 @@
     "usehooks-ts": "^2.14.0"
   },
   "devDependencies": {
+    "@electron/notarize": "^2.3.0",
     "concurrently": "^8.2.2",
+    "electron": "^30.0.2",
     "electron-builder": "^24.12.0",
     "eslint": "^8.56.0",
     "eslint-config-prettier": "^9.1.0",
     "eslint-plugin-prettier": "^5.1.3",
     "hardhat": "==2.17.1",
     "net": "^1.0.2",
-    "prettier": "^3.2.5",
-    "electron": "^30.0.2"
+    "prettier": "^3.2.5"
   },
   "main": "electron/main.js",
   "name": "olas-operate-app",
   "private": true,
   "build": {
-    "appId": "com.olas.operate",
+    "appId": "xyz.valory.olas-operate-app",
     "productName": "Olas Operate",
+    "afterSign": "scripts/notarize.js",   
     "directories": {
       "output": "dist"
     },
@@ -48,7 +50,11 @@
     },
     "mac": {
       "target": "dmg",
-      "icon": "electron/assets/icons/robot-head.png"
+      "icon": "electron/assets/icons/robot-head.png",
+      "hardenedRuntime": true,
+      "gatekeeperAssess": false,
+      "entitlements": "electron/entitlements.mac.plist",
+      "entitlementsInherit": "electron/entitlements.mac.plist"    
     },
     "linux": {
       "target": "AppImage",

yarn.lock

@@ -153,6 +153,15 @@
     fs-extra "^9.0.1"
     promise-retry "^2.0.1"
 
+"@electron/notarize@^2.3.0":
+  version "2.3.0"
+  resolved "https://registry.yarnpkg.com/@electron/notarize/-/notarize-2.3.0.tgz#9659cf6c92563dd69411afce229f52f9f7196227"
+  integrity sha512-EiTBU0BwE7HZZjAG1fFWQaiQpCuPrVGn7jPss1kUjD6eTTdXXd29RiZqEqkgN7xqt/Pgn4g3I7Saqovanrfj3w==
+  dependencies:
+    debug "^4.1.1"
+    fs-extra "^9.0.1"
+    promise-retry "^2.0.1"
+
 "@electron/[email protected]":
   version "1.0.5"
   resolved "https://registry.yarnpkg.com/@electron/osx-sign/-/osx-sign-1.0.5.tgz#0af7149f2fce44d1a8215660fd25a9fb610454d8"