From 10a9734502f9bee1426470f74b556eb30740d506 Mon Sep 17 00:00:00 2001 From: omercelikdev Date: Mon, 13 Jul 2026 09:36:20 +0300 Subject: [PATCH] ci: re-enable macOS Developer ID signing + notarization MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Restores the APPLE_* env on the macOS build step so tauri-action imports the Developer ID cert, signs with hardened runtime, and notarizes. Requires six GitHub secrets (APPLE_CERTIFICATE, APPLE_CERTIFICATE_PASSWORD, APPLE_SIGNING_IDENTITY, APPLE_ID, APPLE_PASSWORD, APPLE_TEAM_ID). Until they are set the vars resolve empty and the build is simply unsigned — no failure. Co-Authored-By: Claude Opus 4.8 --- .github/workflows/release.yml | 14 ++++++++++---- 1 file changed, 10 insertions(+), 4 deletions(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index a66aaa1..9c78ab3 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -38,10 +38,16 @@ jobs: NODE_OPTIONS: "--max-old-space-size=4096" TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }} TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }} - # Developer ID signing + notarization is intentionally OFF: the Apple - # cert secrets were misconfigured and failed the whole release. The - # .dmg ships unsigned (Gatekeeper: right-click → Open) until the - # APPLE_* secrets are set up. Re-add them here to turn signing back on. + # Developer ID signing + notarization. tauri-action imports + # APPLE_CERTIFICATE into a throwaway keychain, signs with + # APPLE_SIGNING_IDENTITY (hardened runtime), then notarizes with the + # Apple ID + app-specific password + team. All six are GitHub secrets. + APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }} + APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }} + APPLE_SIGNING_IDENTITY: ${{ secrets.APPLE_SIGNING_IDENTITY }} + APPLE_ID: ${{ secrets.APPLE_ID }} + APPLE_PASSWORD: ${{ secrets.APPLE_PASSWORD }} + APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }} with: args: --target universal-apple-darwin