From 7df8d9f0216fecc890c7eddb96194a7c2d4108ca Mon Sep 17 00:00:00 2001 From: jt Date: Sat, 22 Aug 2026 01:14:22 -0700 Subject: [PATCH] Sign and notarize macOS release builds Pass Developer ID signing + notarization credentials to tauri-action so macOS builds are no longer ad-hoc signed (Gatekeeper rejected them as "damaged" on download). Co-Authored-By: Claude Fable 5 --- .github/workflows/release.yml | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 4b4294a..f979898 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -74,6 +74,14 @@ jobs: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} # vite build OOMs under Node's default heap cap on the 7GB macOS runners NODE_OPTIONS: --max-old-space-size=4096 + # macOS Developer ID signing + notarization (ignored on other platforms). + # Secrets are shared with the Stability Matrix release pipeline. + APPLE_CERTIFICATE: ${{ secrets.PROD_MACOS_CERTIFICATE }} + APPLE_CERTIFICATE_PASSWORD: ${{ secrets.PROD_MACOS_CERTIFICATE_PWD }} + APPLE_SIGNING_IDENTITY: ${{ secrets.PROD_MACOS_CERTIFICATE_NAME }} + APPLE_ID: ${{ secrets.PROD_MACOS_NOTARIZATION_APPLE_ID }} + APPLE_PASSWORD: ${{ secrets.PROD_MACOS_NOTARIZATION_PWD }} + APPLE_TEAM_ID: ${{ secrets.PROD_MACOS_NOTARIZATION_TEAM_ID }} with: tagName: ${{ github.ref_name }} releaseName: 'LitePost ${{ github.ref_name }}'