macos app bundle (#585)

* test signed app bundle

* fix vars

* fix condition

* typo

* fix quoting

* use recursive signing script

* fix release cleanup

* restore proper ci action

.github/workflows/ci.yml

@@ -71,6 +71,13 @@ jobs:
 
       - name: Install dependencies
         run: dotnet restore
+        
+      - name: Import Code-Signing Certificates
+        uses: Apple-Actions/import-codesign-certs@v1
+        if: matrix.kind == 'macOS'
+        with:
+          p12-file-base64: ${{ secrets.APPLE_DEVELOPER_CERTIFICATE_P12_BASE64 }}
+          p12-password: ${{ secrets.APPLE_DEVELOPER_CERTIFICATE_PASSWORD }}        
 
       - name: Build
         shell: bash
@@ -82,19 +89,34 @@ jobs:
           final="${tag2/alpha/$short}"
           release_name="ErsatzTV-$final-${{ matrix.target }}"
           echo "RELEASE_NAME=${release_name}" >> $GITHUB_ENV
-          
+                  
           # Build everything
-          dotnet publish ErsatzTV/ErsatzTV.csproj --framework net6.0 --runtime "${{ matrix.target }}" -c Release -o "$release_name" /property:InformationalVersion="$final-${{ matrix.target }}" /property:EnableCompressionInSingleFile=true /property:DebugType=Embedded /property:PublishSingleFile=true --self-contained true
-          
-          # Pack files
-          if [ "${{ matrix.target }}" == "win-x64" ]; then
-            7z a -tzip "${release_name}.zip" "./${release_name}/*"
+          if [ "${{ matrix.kind }}" == "macOS" ]; then
+            brew tap mitchellh/gon
+            brew install mitchellh/gon/gon
+            dotnet msbuild ErsatzTV/ErsatzTV.csproj -t:BundleApp -p:RuntimeIdentifier="${{ matrix.target }}" -p:CFBundleVersion="${tag2}" -p:Configuration=Release -p:CFBundleShortVersionString="${tag2}" -p:InformationalVersion="$final-${{ matrix.target }}" -p:EnableCompressionInSingleFile=true -p:DebugType=Embedded -p:PublishSingleFile=true -p:PublishDir=$(pwd)/release
+            cp scripts/macOS/launcher.sh release/ErsatzTV.app/Contents/MacOS/
+            scripts/macOS/sign.sh
+            gon -log-level=debug -log-json ./gon.json
+            mv release/ErsatzTV.dmg "${release_name}.dmg"
+            rm -r release
           else
-            tar czvf "${release_name}.tar.gz" "$release_name"
+            dotnet publish ErsatzTV/ErsatzTV.csproj --framework net6.0 --runtime "${{ matrix.target }}" -c Release -o "$release_name" /property:InformationalVersion="$final-${{ matrix.target }}" /property:EnableCompressionInSingleFile=true /property:DebugType=Embedded /property:PublishSingleFile=true --self-contained true
+  
+            # Pack files
+            if [ "${{ matrix.target }}" == "win-x64" ]; then
+              7z a -tzip "${release_name}.zip" "./${release_name}/*"
+            else
+              tar czvf "${release_name}.tar.gz" "$release_name"
+            fi
+
+            # Delete output directory
+            rm -r "$release_name"
           fi
-          
-          # Delete output directory
-          rm -r "$release_name"
+        env:
+          AC_USERNAME: ${{ secrets.AC_USERNAME }}
+          AC_PASSWORD: ${{ secrets.AC_PASSWORD }}
+
       - name: Delete old release assets
         uses: mknejp/delete-release-assets@v1
         with:
@@ -104,6 +126,7 @@ jobs:
           assets: |
             *${{ matrix.target }}.zip
             *${{ matrix.target }}.tar.gz
+            *${{ matrix.target }}.dmg
       - name: Publish
         uses: softprops/action-gh-release@v1
         with:
@@ -112,6 +135,7 @@ jobs:
           files: |
             ${{ env.RELEASE_NAME }}.zip
             ${{ env.RELEASE_NAME }}.tar.gz
+            ${{ env.RELEASE_NAME }}.dmg
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
   build_and_push: