feat: add codesign for macos

Author: hiento09

.github/workflows/python-package.yml

@@ -2,7 +2,7 @@ name: Build and Package Python Library
 
 on:
   push:
-    branches: [ feat/python-package-ci ]
+    branches: [ feat/codesign-python-package ]
   workflow_dispatch:
     inputs:
       model_dir:
@@ -25,9 +25,9 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - os: "linux"
-            name: "amd64"
-            runs-on: "ubuntu-20-04-cuda-12-0"
+          # - os: "linux"
+          #   name: "amd64"
+          #   runs-on: "ubuntu-20-04-cuda-12-0"
           - os: "mac"
             name: "amd64"
             runs-on: "macos-selfhosted-12"
@@ -53,20 +53,20 @@ jobs:
     #         bash miniconda.sh -b -p $HOME/miniconda
     #         echo "$HOME/miniconda/bin" >> $GITHUB_PATH
 
-    #   - name: Install Miniconda on macOS
-    #     if: runner.os == 'macOS'
-    #     run: |
-    #         if [ "$(uname -m)" = "arm64" ]; then
-    #           echo "Running on macOS ARM"
-    #           MINICONDA_URL="https://repo.anaconda.com/miniconda/Miniconda3-latest-MacOSX-arm64.sh"
-    #         else
-    #           echo "Running on macOS Intel"
-    #           MINICONDA_URL="https://repo.anaconda.com/miniconda/Miniconda3-latest-MacOSX-x86_64.sh"
-    #         fi
-    #         echo "Downloading Miniconda from $MINICONDA_URL"
-    #         curl -L $MINICONDA_URL -o miniconda.sh
-    #         bash miniconda.sh -b -p $HOME/miniconda
-    #         echo "$HOME/miniconda/bin" >> $GITHUB_PATH
+      - name: Install Miniconda on macOS
+        if: runner.os == 'macOS'
+        run: |
+            if [ "$(uname -m)" = "arm64" ]; then
+              echo "Running on macOS ARM"
+              MINICONDA_URL="https://repo.anaconda.com/miniconda/Miniconda3-latest-MacOSX-arm64.sh"
+            else
+              echo "Running on macOS Intel"
+              MINICONDA_URL="https://repo.anaconda.com/miniconda/Miniconda3-latest-MacOSX-x86_64.sh"
+            fi
+            echo "Downloading Miniconda from $MINICONDA_URL"
+            curl -L $MINICONDA_URL -o miniconda.sh
+            bash miniconda.sh -b -p $HOME/miniconda
+            echo "$HOME/miniconda/bin" >> $GITHUB_PATH
     
     #   - name: Install Miniconda on Windows
     #     if: runner.os == 'Windows'
@@ -133,4 +133,41 @@ jobs:
         uses: actions/upload-artifact@v4
         with:
             name: ${{env.MODEL_NAME}}-${{ matrix.os }}-${{ matrix.name }}
-            path: ${{env.PYTHON_FOLDER}}
+            path: ${{env.PYTHON_FOLDER}}
+
+  codesign:
+    runs-on: macos-latest
+    needs: build-and-test
+    steps:
+      - name: checkout
+        uses: actions/checkout@v3
+      - uses: apple-actions/import-codesign-certs@v2
+        continue-on-error: true
+        with:
+          p12-file-base64: ${{ secrets.CODE_SIGN_P12_BASE64 }}
+          p12-password: ${{ secrets.CODE_SIGN_P12_PASSWORD }}
+      - name: Download Artifact
+        uses: actions/download-artifact@v4
+        with:
+          name: ${{env.MODEL_NAME}}-mac-amd64
+          path: ${{env.MODEL_NAME}}-mac-amd64
+      - name: Download Artifact
+        uses: actions/download-artifact@v4
+        with:
+          name: ${{env.MODEL_NAME}}-mac-arm64
+          path: ${{env.MODEL_NAME}}-mac-arm64
+
+      - run: |
+          find "${{env.MODEL_NAME}}-mac-amd64" \( -type f \) -exec codesign --force --entitlements="./engine/templates/macos/entitlements.plist" -s "${{ secrets.DEVELOPER_ID }}" --options=runtime {} \;
+          find "${{env.MODEL_NAME}}-mac-arm64" \( -type f \) -exec codesign --force --entitlements="./engine/templates/macos/entitlements.plist" -s "${{ secrets.DEVELOPER_ID }}" --options=runtime {} \;
+      
+      - name: Upload Artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: ${{env.MODEL_NAME}}-mac-amd64-signed
+          path: ${{env.MODEL_NAME}}-mac-amd64
+      - name: Upload Artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: ${{env.MODEL_NAME}}-mac-arm64-signed
+          path: ${{env.MODEL_NAME}}-mac-arm64