From 88ae17c03e74260e00a55faf7b4c25920480eaa8 Mon Sep 17 00:00:00 2001 From: Facundo Farias Date: Sat, 11 Jul 2026 19:51:18 +0200 Subject: [PATCH 1/2] ci: wire Apple signing/notarization (disabled via APPLE_SIGNING_ENABLED) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Adds the APPLE_* env block to the tauri-action step, gated behind the repo variable APPLE_SIGNING_ENABLED. Until that variable is 'true' (and the six APPLE_* secrets are added), the vars resolve to empty and builds stay UNSIGNED — no behavior change. Flipping the variable + adding the secrets turns on signed + notarized .dmg builds with no further code changes. Co-Authored-By: Claude Opus 4.8 (1M context) --- .github/workflows/build.yml | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 88cd7ee..29fd069 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -61,6 +61,25 @@ jobs: uses: tauri-apps/tauri-action@v0 env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} + # ── Apple code signing + notarization (macOS) ── + # DISABLED until you flip it on. To enable a signed + notarized .dmg: + # 1. Add the repository variable APPLE_SIGNING_ENABLED = true + # (Settings → Secrets and variables → Actions → Variables) + # 2. Add the six APPLE_* repository secrets: + # APPLE_CERTIFICATE base64 of the Developer ID .p12 + # APPLE_CERTIFICATE_PASSWORD the .p12 export password + # APPLE_SIGNING_IDENTITY "Developer ID Application: Name (TEAMID)" + # APPLE_ID your Apple ID email + # APPLE_PASSWORD an app-specific password (for notarization) + # APPLE_TEAM_ID your 10-char Team ID + # Until the variable is 'true' these resolve to empty and tauri-action + # builds UNSIGNED exactly as today (no behavior change). + APPLE_CERTIFICATE: ${{ vars.APPLE_SIGNING_ENABLED == 'true' && secrets.APPLE_CERTIFICATE || '' }} + APPLE_CERTIFICATE_PASSWORD: ${{ vars.APPLE_SIGNING_ENABLED == 'true' && secrets.APPLE_CERTIFICATE_PASSWORD || '' }} + APPLE_SIGNING_IDENTITY: ${{ vars.APPLE_SIGNING_ENABLED == 'true' && secrets.APPLE_SIGNING_IDENTITY || '' }} + APPLE_ID: ${{ vars.APPLE_SIGNING_ENABLED == 'true' && secrets.APPLE_ID || '' }} + APPLE_PASSWORD: ${{ vars.APPLE_SIGNING_ENABLED == 'true' && secrets.APPLE_PASSWORD || '' }} + APPLE_TEAM_ID: ${{ vars.APPLE_SIGNING_ENABLED == 'true' && secrets.APPLE_TEAM_ID || '' }} with: args: ${{ matrix.args }} tagName: ${{ startsWith(github.ref, 'refs/tags/v') && github.ref_name || '' }} From 85cbbd7e86d4c4097ed62d0a0f33a2d3d5b3a814 Mon Sep 17 00:00:00 2001 From: Facundo Farias Date: Sat, 11 Jul 2026 20:00:37 +0200 Subject: [PATCH 2/2] ci: only set APPLE_* when signing enabled (absent, not empty) An empty APPLE_CERTIFICATE env var makes the Tauri bundler attempt security import and fail the macOS build. Move the APPLE_* vars into a conditional 'Configure Apple signing' step gated on APPLE_SIGNING_ENABLED == 'true' + macOS, so when disabled the vars are absent entirely and the build stays unsigned. Co-Authored-By: Claude Opus 4.8 (1M context) --- .github/workflows/build.yml | 49 ++++++++++++++++++++++--------------- 1 file changed, 29 insertions(+), 20 deletions(-) diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 29fd069..941597b 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -55,31 +55,40 @@ jobs: - run: npm ci + # ── Apple code signing + notarization (macOS) — DISABLED until enabled ── + # This step ONLY runs (and only sets the APPLE_* vars) when the repo variable + # APPLE_SIGNING_ENABLED == 'true'. When off, the vars are absent entirely and + # Tauri builds UNSIGNED exactly as today. (They must be ABSENT, not empty — an + # empty APPLE_CERTIFICATE makes the Tauri bundler attempt `security import` + # and fail.) To turn signing on: + # 1. Actions → Variables: add APPLE_SIGNING_ENABLED = true + # 2. Actions → Secrets: add + # APPLE_CERTIFICATE base64 of the Developer ID .p12 + # APPLE_CERTIFICATE_PASSWORD the .p12 export password + # APPLE_SIGNING_IDENTITY "Developer ID Application: Name (TEAMID)" + # APPLE_ID your Apple ID email + # APPLE_PASSWORD an app-specific password (notarization) + # APPLE_TEAM_ID your 10-char Team ID + # 3. Cut the next v* tag → signed + notarized .dmg. + - name: Configure Apple signing + if: ${{ matrix.platform == 'macos-latest' && vars.APPLE_SIGNING_ENABLED == 'true' }} + run: | + { + echo "APPLE_CERTIFICATE=${{ secrets.APPLE_CERTIFICATE }}" + echo "APPLE_CERTIFICATE_PASSWORD=${{ secrets.APPLE_CERTIFICATE_PASSWORD }}" + echo "APPLE_SIGNING_IDENTITY=${{ secrets.APPLE_SIGNING_IDENTITY }}" + echo "APPLE_ID=${{ secrets.APPLE_ID }}" + echo "APPLE_PASSWORD=${{ secrets.APPLE_PASSWORD }}" + echo "APPLE_TEAM_ID=${{ secrets.APPLE_TEAM_ID }}" + } >> "$GITHUB_ENV" + # Builds the app on both platforms. On a `v*` tag it also creates/updates a - # draft GitHub Release with the bundles attached. + # draft GitHub Release with the bundles attached. Signing (above) is picked + # up from the job env when enabled. - name: Build (and release on tags) uses: tauri-apps/tauri-action@v0 env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} - # ── Apple code signing + notarization (macOS) ── - # DISABLED until you flip it on. To enable a signed + notarized .dmg: - # 1. Add the repository variable APPLE_SIGNING_ENABLED = true - # (Settings → Secrets and variables → Actions → Variables) - # 2. Add the six APPLE_* repository secrets: - # APPLE_CERTIFICATE base64 of the Developer ID .p12 - # APPLE_CERTIFICATE_PASSWORD the .p12 export password - # APPLE_SIGNING_IDENTITY "Developer ID Application: Name (TEAMID)" - # APPLE_ID your Apple ID email - # APPLE_PASSWORD an app-specific password (for notarization) - # APPLE_TEAM_ID your 10-char Team ID - # Until the variable is 'true' these resolve to empty and tauri-action - # builds UNSIGNED exactly as today (no behavior change). - APPLE_CERTIFICATE: ${{ vars.APPLE_SIGNING_ENABLED == 'true' && secrets.APPLE_CERTIFICATE || '' }} - APPLE_CERTIFICATE_PASSWORD: ${{ vars.APPLE_SIGNING_ENABLED == 'true' && secrets.APPLE_CERTIFICATE_PASSWORD || '' }} - APPLE_SIGNING_IDENTITY: ${{ vars.APPLE_SIGNING_ENABLED == 'true' && secrets.APPLE_SIGNING_IDENTITY || '' }} - APPLE_ID: ${{ vars.APPLE_SIGNING_ENABLED == 'true' && secrets.APPLE_ID || '' }} - APPLE_PASSWORD: ${{ vars.APPLE_SIGNING_ENABLED == 'true' && secrets.APPLE_PASSWORD || '' }} - APPLE_TEAM_ID: ${{ vars.APPLE_SIGNING_ENABLED == 'true' && secrets.APPLE_TEAM_ID || '' }} with: args: ${{ matrix.args }} tagName: ${{ startsWith(github.ref, 'refs/tags/v') && github.ref_name || '' }}