ci: replace gon with rcodesign, switch to ubuntu runner

.github/workflows/build.yml

@@ -7,7 +7,7 @@ on:
 
 jobs:
   build:
-    runs-on: macos-latest
+    runs-on: ubuntu-latest
     steps:
       - name: Checkout
         uses: actions/checkout@v4

.github/workflows/release.yml

@@ -7,7 +7,7 @@ on:
 
 jobs:
   release:
-    runs-on: macos-latest
+    runs-on: ubuntu-latest
     steps:
       - name: Checkout
         uses: actions/checkout@v4
@@ -17,8 +17,8 @@ jobs:
         with:
           go-version-file: go.mod
 
-      - name: Set up gon
-        run: brew install mitchellh/gon/gon
+      - name: Setup rcodesign
+        uses: indygreg/apple-code-sign-action@v1
 
       - name: Import GPG key
         id: import_gpg
@@ -30,7 +30,9 @@ jobs:
       - name: Decrypt Secrets
         env:
           SECRETS_PASSWORD: ${{ secrets.SECRETS_PASSWORD }}
-        run: bash script/decrypt_secrets.sh
+        run: |
+          gpg --quiet --batch --yes --decrypt --passphrase="$SECRETS_PASSWORD" \
+              --output .github/secrets/hcloud_cli.p12 .github/secrets/hcloud_cli.p12.gpg
 
       - name: Run GoReleaser
         uses: goreleaser/goreleaser-action@v5
@@ -39,6 +41,4 @@ jobs:
           args: release --clean --skip=validate
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          HC_APPLE_DEVELOPER_USER: ${{ secrets.HC_APPLE_DEVELOPER_USER }}
-          HC_APPLE_DEVELOPER_PASSWORD: ${{ secrets.HC_APPLE_DEVELOPER_PASSWORD }}
-          HC_APPLE_IDENTITY: ${{ secrets.HC_APPLE_IDENTITY }}
+          APPLE_P12_PASSWORD: ${{ secrets.APPLE_P12_PASSWORD }}

.goreleaser.yml

@@ -41,7 +41,12 @@ builds:
       - arm64
     hooks:
       post:
-        - cmd: bash script/gon.sh "{{ .Path }}"
+        - cmd: >
+            rcodesign sign
+              --p12-file .github/secrets/hcloud_cli.p12
+              --p12-password "$APPLE_P12_PASSWORD"
+              --code-signature-flags runtime
+              "{{ .Path }}"
           output: true
 
 snapshot: