From c7ba67a21c6b4e004c60ebaaa4e650a35835f68f Mon Sep 17 00:00:00 2001 From: Peter Jausovec Date: Thu, 22 Oct 2026 14:40:59 -0700 Subject: [PATCH] stop the macOS PKG step from hanging on Intel runners Signed-off-by: Peter Jausovec --- .github/scripts/import-macos-signing.sh | 9 +++++++-- .github/workflows/release-macos.yml | 1 + 2 files changed, 8 insertions(+), 2 deletions(-) diff --git a/.github/scripts/import-macos-signing.sh b/.github/scripts/import-macos-signing.sh index 6b46dda..e93589f 100644 --- a/.github/scripts/import-macos-signing.sh +++ b/.github/scripts/import-macos-signing.sh @@ -19,10 +19,15 @@ security unlock-keychain -p "$keychain_password" "$keychain" import_identity() { printf '%s' "$1" | base64 --decode > "$archive" - security import "$archive" -k "$keychain" -P "$2" -T "$3" + local trusted=() + for app in "${@:3}"; do + trusted+=(-T "$app") + done + security import "$archive" -k "$keychain" -P "$2" "${trusted[@]}" } import_identity "$APPLE_APPLICATION_CERTIFICATE" "$APPLE_CERTIFICATE_PASSWORD" /usr/bin/codesign -import_identity "$APPLE_INSTALLER_CERTIFICATE" "$APPLE_INSTALLER_CERTIFICATE_PASSWORD" /usr/bin/pkgbuild +# productbuild signs the final PKG; a key it isn't trusted for prompts and hangs headless runners. +import_identity "$APPLE_INSTALLER_CERTIFICATE" "$APPLE_INSTALLER_CERTIFICATE_PASSWORD" /usr/bin/pkgbuild /usr/bin/productbuild security set-key-partition-list -S apple-tool:,apple:,codesign: -s \ -k "$keychain_password" "$keychain" > /dev/null diff --git a/.github/workflows/release-macos.yml b/.github/workflows/release-macos.yml index fea684f..d7e8f14 100644 --- a/.github/workflows/release-macos.yml +++ b/.github/workflows/release-macos.yml @@ -170,6 +170,7 @@ jobs: run: bash .github/scripts/import-macos-signing.sh - name: Build PKG + timeout-minutes: 60 working-directory: frontend shell: bash run: pnpm --filter @agentdesktop/desktop-web dist:mac -- --target "${{ matrix.target }}"