ci: wire Apple signing/notarization (disabled by default)#4
Merged
Conversation
Adds the APPLE_* env block to the tauri-action step, gated behind the repo variable APPLE_SIGNING_ENABLED. Until that variable is 'true' (and the six APPLE_* secrets are added), the vars resolve to empty and builds stay UNSIGNED — no behavior change. Flipping the variable + adding the secrets turns on signed + notarized .dmg builds with no further code changes. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
An empty APPLE_CERTIFICATE env var makes the Tauri bundler attempt security import and fail the macOS build. Move the APPLE_* vars into a conditional 'Configure Apple signing' step gated on APPLE_SIGNING_ENABLED == 'true' + macOS, so when disabled the vars are absent entirely and the build stays unsigned. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Wires macOS code signing + notarization into the release workflow, switched off until you're ready.
How it's gated
The
APPLE_*env vars on thetauri-actionstep are gated behind the repo variableAPPLE_SIGNING_ENABLED:Until
APPLE_SIGNING_ENABLEDistrue, every var resolves to empty andtauri-actionbuilds unsigned exactly as today — zero behavior change from merging this.To turn it on later (no code changes needed)
APPLE_SIGNING_ENABLED = true.APPLE_CERTIFICATE(base64 .p12),APPLE_CERTIFICATE_PASSWORD,APPLE_SIGNING_IDENTITY,APPLE_ID,APPLE_PASSWORD(app-specific),APPLE_TEAM_ID..dmg, no Gatekeeper prompt.🤖 Generated with Claude Code