From 63fa08798c38fa7604223eeb0565271ceb468dc1 Mon Sep 17 00:00:00 2001
From: edde746 <86283021+edde746@users.noreply.github.com>
Date: Tue, 4 Nov 2025 12:15:39 +0100
Subject: [PATCH] ci: notarization

---
 .github/workflows/build.yml | 28 ++++++++++++++++++++++++++++
 1 file changed, 28 insertions(+)

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index ca3b0861..181ccce3 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -226,6 +226,34 @@ jobs:
           codesign -dvvv "$APP_PATH"
           codesign --verify --deep --strict --verbose=2 "$APP_PATH"
 
+      - name: Notarize Application
+        env:
+          APPLE_ID: ${{ secrets.APPLE_ID }}
+          APPLE_APP_SPECIFIC_PASSWORD: ${{ secrets.APPLE_APP_SPECIFIC_PASSWORD }}
+          APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
+        run: |
+          APP_PATH="build/macos/Build/Products/Release/plezy.app"
+
+          # Create a temporary ZIP for notarization submission
+          echo "Creating ZIP for notarization..."
+          ditto -c -k --keepParent "$APP_PATH" notarization.zip
+
+          # Submit for notarization
+          echo "Submitting to Apple's notary service..."
+          xcrun notarytool submit notarization.zip \
+            --apple-id "$APPLE_ID" \
+            --password "$APPLE_APP_SPECIFIC_PASSWORD" \
+            --team-id "$APPLE_TEAM_ID" \
+            --wait
+
+          # Staple the notarization ticket to the app
+          echo "Stapling notarization ticket..."
+          xcrun stapler staple "$APP_PATH"
+
+          # Verify stapling
+          echo "Verifying notarization..."
+          xcrun stapler validate "$APP_PATH"
+
       - name: Create ZIP
         run: |
           cd build/macos/Build/Products/Release