Add macOS code signing and notarization to release workflow#338
Open
forketyfork wants to merge 2 commits into
Open
Add macOS code signing and notarization to release workflow#338forketyfork wants to merge 2 commits into
forketyfork wants to merge 2 commits into
Conversation
Co-Authored-By: Claude <claude@air.dev>
There was a problem hiding this comment.
Pull request overview
Adds Developer ID code signing and Apple notarization to the macOS release pipeline so published release archives should pass Gatekeeper by default.
Changes:
- Introduces a
scripts/notarize-macos.shhelper to submit, wait, staple, and validate notarization forArchitect.app. - Updates
scripts/bundle-macos.shto support real Developer ID signing viaAPPLE_SIGNING_IDENTITY(while keeping ad-hoc signing as the local default). - Extends the GitHub Actions release workflow to import signing certs, notarize per-arch artifacts, and updates documentation accordingly.
Reviewed changes
Copilot reviewed 6 out of 6 changed files in this pull request and generated 2 comments.
Show a summary per file
| File | Description |
|---|---|
| scripts/notarize-macos.sh | New script to zip, submit, staple, and validate notarization for the app bundle. |
| scripts/bundle-macos.sh | Adds support for Developer ID signing (runtime + timestamp) and centralizes signing logic. |
| README.md | Updates macOS install notes to reflect notarized release artifacts; clarifies Homebrew/source behavior. |
| docs/development.md | Documents required APPLE_* secrets and one-time setup steps for signing/notarization. |
| CLAUDE.md | Adds a repo note capturing the new release workflow signing/notarization requirements. |
| .github/workflows/release.yaml | Imports signing certs, notarizes the app, and adjusts timeouts and release packaging flow. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 7819de4406
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Pass secrets via env: instead of interpolating ${{ secrets.* }} directly
into the shell script (Copilot/Codex flagged the secrets-verification step
as vulnerable to metacharacter breakage). Also harden temp key material
handling with umask-restricted writes and EXIT traps so the .p12/.p8 files
are cleaned up even if a step fails partway through.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.