Skip to content

ci: sign and notarize macOS releases - #2

Open
freelw wants to merge 1 commit into
mainfrom
wangli_dev_20260811_webfetch_2
Open

ci: sign and notarize macOS releases#2
freelw wants to merge 1 commit into
mainfrom
wangli_dev_20260811_webfetch_2

Conversation

@freelw

@freelw freelw commented Aug 11, 2026

Copy link
Copy Markdown
Contributor

Summary

  • split macOS and Windows release builds so signing secrets are isolated to macOS
  • sign the macOS ARM64 CLI with Developer ID Application and hardened runtime
  • submit the signed binary to Apple's notary service and gate publishing on Accepted
  • preserve the two-platform release contract and document the required environment secrets

Validation

  • bash -n scripts/sign_and_notarize_macos.sh
  • release/CI workflow YAML parse
  • release target and SkillHub ZIP contract checks
  • python3 -m zipfile --test dist/lexmount-webfetch.zip
  • cargo test --all-targets --locked
  • cargo clippy --all-targets --locked -- -D warnings
  • GitHub Actions CI passed

A live notarization run requires the five documented secrets in the macos-release GitHub environment.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant