[CI] macOS: prepare secret files

.github/workflows/build.yaml

@@ -20,6 +20,9 @@ jobs:
     - name: Setup
       run: |
         ci/${{ matrix.platform }}/setup.sh
+      env:
+        MACOS_ASC_API_KEY: ${{ secrets.MACOS_ASC_API_KEY }}
+        MACOS_CODE_SIGN_KEY_BASE64: ${{ secrets.MACOS_CODE_SIGN_KEY_BASE64 }}
     - name: Configure
       run: |
         cmake --preset ${{ matrix.preset || 'release' }}
@@ -31,11 +34,9 @@ jobs:
       run: |
         cpack --preset release
       env:
-        ASC_API_KEY: ${{ secrets.MACOS_ASC_API_KEY }}
         ASC_API_KEY_ID: ${{ secrets.MACOS_ASC_API_KEY_ID }}
         ASC_API_KEY_ISSUER: ${{ secrets.MACOS_ASC_API_KEY_ISSUER }}
         ASC_TEAM_ID: ${{ secrets.MACOS_ASC_TEAM_ID }}
-        CODE_SIGN_IDENTITY: ${{ secrets.MACOS_CODE_SIGN_IDENTITY }}
     - name: Artifact
       if: ${{ matrix.artifact }}
       uses: actions/upload-artifact@v4

ci/macos/setup.sh

@@ -9,3 +9,16 @@ for module in base tools ; do
   7z x "$archive" '-xr!*.dSYM'
 done
 echo "CMAKE_PREFIX_PATH=$PWD/$(ls -1 | fgrep 6.)/macos" >> $GITHUB_ENV
+
+if [ "$MACOS_ASC_API_KEY" ]; then
+  ascApiKey='ascApiKey.p8'
+  echo "$MACOS_ASC_API_KEY" > "$ascApiKey"
+  echo "ASC_API_KEY_PATH=$PWD/$ascApiKey" >> $GITHUB_ENV
+fi
+
+if [ "$MACOS_CODE_SIGN_KEY_BASE64" ]; then
+  codesignKey='codesign.p12'
+  echo "$MACOS_CODE_SIGN_KEY_BASE64" | base64 --decode > "$codesignKey"
+  security import "$codesignKey" -f pkcs12 -P "" -T "$(which codesign)"
+  echo "CODE_SIGN_IDENTITY=Developer ID Application: Kodi Foundation" >> $GITHUB_ENV
+fi

dmg_osx/notarize.sh

@@ -16,7 +16,7 @@ fi
 echo 'notarize dmg'
 xcrun notarytool submit \
   --verbose \
-  --key "$ASC_API_KEY" \
+  --key "$ASC_API_KEY_PATH" \
   --key-id "$ASC_API_KEY_ID" \
   --issuer "$ASC_API_KEY_ISSUER" \
   --team-id "$ASC_TEAM_ID" \