From 843f878dbeefeb33fbf7b137956cdafd67141587 Mon Sep 17 00:00:00 2001
From: Bram de Jong <805269+bdejong@users.noreply.github.com>
Date: Wed, 15 Apr 2026 12:07:03 +0200
Subject: [PATCH 1/2] ci: add verbose notarization logging to diagnose macOS
 build failure

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
---
 .github/workflows/build.yml | 16 +++++++++++-----
 1 file changed, 11 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 9cd97a1..f559470 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -84,7 +84,8 @@ jobs:
             --apple-id "$APPLE_ID" \
             --password "$APPLE_PASSWORD" \
             --team-id "$APPLE_TEAM_ID" \
-            --wait 2>&1)
+            --verbose \
+            --wait 2>&1) || true
           echo "$SUBMIT_OUTPUT"
 
           # Extract submission ID
@@ -95,10 +96,15 @@ jobs:
             echo "Notarization succeeded"
           else
             echo "Notarization failed — fetching log..."
-            xcrun notarytool log "$SUBMISSION_ID" \
-              --apple-id "$APPLE_ID" \
-              --password "$APPLE_PASSWORD" \
-              --team-id "$APPLE_TEAM_ID"
+            if [ -n "$SUBMISSION_ID" ]; then
+              xcrun notarytool log "$SUBMISSION_ID" \
+                --apple-id "$APPLE_ID" \
+                --password "$APPLE_PASSWORD" \
+                --team-id "$APPLE_TEAM_ID" \
+                --verbose || echo "Failed to fetch notarization log"
+            else
+              echo "No submission ID found — submit itself likely failed"
+            fi
             exit 1
           fi
 

From 875b88fe7c757d88e9bfde41fff7f59e3d78b430 Mon Sep 17 00:00:00 2001
From: Bram de Jong <805269+bdejong@users.noreply.github.com>
Date: Wed, 15 Apr 2026 12:59:38 +0200
Subject: [PATCH 2/2] ci: detect expired Apple Developer agreement with
 actionable error message

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
---
 .github/workflows/build.yml | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index f559470..cdf2847 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -91,6 +91,12 @@ jobs:
           # Extract submission ID
           SUBMISSION_ID=$(echo "$SUBMIT_OUTPUT" | grep "id:" | head -1 | awk '{print $2}')
 
+          # Check for known errors
+          if echo "$SUBMIT_OUTPUT" | grep -qi "agreement.*missing\|agreement.*expired"; then
+            echo "::error::Apple Developer agreement has expired or is missing. Visit https://appstoreconnect.apple.com/ and accept the pending agreements."
+            exit 1
+          fi
+
           # Check for success
           if echo "$SUBMIT_OUTPUT" | grep -q "status: Accepted"; then
             echo "Notarization succeeded"