Skip to content

ci: add macOS code signing and notarization to release workflow#71

Merged
feloy merged 1 commit into
openkaiden:mainfrom
feloy:sign-macos-bin
Jun 11, 2026
Merged

ci: add macOS code signing and notarization to release workflow#71
feloy merged 1 commit into
openkaiden:mainfrom
feloy:sign-macos-bin

Conversation

@feloy

@feloy feloy commented Jun 4, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Secrets to add (Settings → Secrets and variables → Actions):

  ┌────────────────────────────────────┬─────────────────────────────────────────┐
  │               Secret               │                  Value                  │                                                                     
  ├────────────────────────────────────┼─────────────────────────────────────────┤
  │ APPLE_SIGNING_CERTIFICATE          │ base64 < YourCert.p12 output            │
  ├────────────────────────────────────┼─────────────────────────────────────────┤
  │ APPLE_SIGNING_CERTIFICATE_PASSWORD │ Password used when exporting the .p12   │
  ├────────────────────────────────────┼─────────────────────────────────────────┤
  │ APPLE_ID                           │ Your Apple ID email                     │
  ├────────────────────────────────────┼─────────────────────────────────────────┤
  │ APPLE_ID_PASSWORD                  │ App-specific password for that Apple ID │
  ├────────────────────────────────────┼─────────────────────────────────────────┤
  │ APPLE_TEAM_ID                      │ Your 10-character Team ID               │
  └────────────────────────────────────┴─────────────────────────────────────────┘

Fixes #67

@coderabbitai

coderabbitai Bot commented Jun 4, 2026 •
edited
Loading

Copy link
Copy Markdown

Review Change Stack

Caution

Review failed

Pull request was closed or merged during review

📝 Walkthrough

Walkthrough

The release workflow now includes macOS-specific code signing and notarization. After building the binary, it imports a developer signing certificate, codesigns the binary with Developer ID Application identity, notarizes it through Apple's notarytool service, and removes the temporary keychain.

Changes

macOS Code Signing and Notarization

Layer / File(s) Summary
macOS code signing and notarization workflow steps
.github/workflows/release.yml		 Release workflow adds conditional steps for macOS that import a base64-encoded signing certificate into a temporary keychain, codesign the binary with Developer ID Application identity, notarize the binary zip via xcrun notarytool using Apple credentials, and clean up the temporary keychain.

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~20 minutes

🚥 Pre-merge checks | ✅ 5
✅ Passed checks (5 passed)
Check name Status Explanation
Title check ✅ Passed The title clearly and specifically describes the main change: adding macOS code signing and notarization to the release workflow.
Description check ✅ Passed The description is directly related to the changeset, providing context about required GitHub Actions secrets needed for the code signing and notarization implementation.
Linked Issues check ✅ Passed The PR addresses the linked issue #67 (sign macOS binaries) by implementing macOS code signing and notarization steps in the release workflow.
Out of Scope Changes check ✅ Passed All changes are focused on the release workflow and directly support the objective of signing and notarizing macOS binaries; no out-of-scope modifications detected.
Docstring Coverage ✅ Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

✏️ Tip: You can configure your own custom pre-merge checks in the settings.

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands and usage tips.

@feloy feloy requested a review from benoitf June 4, 2026 17:01
@codecov

codecov Bot commented Jun 4, 2026

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

@feloy feloy force-pushed the sign-macos-bin branch from 5d47260 to 2cd96d9 Compare June 4, 2026 17:08
@feloy @claude
ci: add macOS code signing and notarization to release workflow
3d2f3bd 
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Signed-off-by: Philippe Martin <phmartin@redhat.com>
@feloy feloy merged commit 792e996 into openkaiden:main Jun 11, 2026
7 of 8 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@benoitf benoitf benoitf approved these changes

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

sign macOS binaries

2 participants

@feloy @benoitf