fix: unify release workflows and fix code signing#64
Merged
Conversation
- Create reusable build-and-sign.yml workflow for common build/sign logic - Fix release-dev.yml keychain setup (add list-keychains and default-keychain) - Update release-stable.yml signing to match main branch implementation - Add proper debug logging for certificate issues - Improve error handling in signing process
❌ Version Update RequiredThis PR is merging to Current version: Please update the version number in How to update:
Or use the update script: ./scripts/update-version.sh patch # or minor/majorThe version should follow semantic versioning (x.y.z format). |
There was a problem hiding this comment.
Pull Request Overview
This PR refactors the release workflows to use a shared build-and-sign workflow and fixes missing code-signing keychain steps.
- Introduces a reusable
build-and-sign.ymlfor building, signing, DMG creation, and notarization - Updates
release-dev.ymlto call the new reusable workflow and adds proper keychain setup - Enhances
release-stable.ymlwith dynamic certificate lookup, debug logging, and improved error handling
Reviewed Changes
Copilot reviewed 3 out of 3 changed files in this pull request and generated no comments.
| File | Description |
|---|---|
| .github/workflows/build-and-sign.yml | New reusable workflow handling build, signing, DMG, notarization |
| .github/workflows/release-dev.yml | Switched to reusable workflow, added missing keychain steps and outputs |
| .github/workflows/release-stable.yml | Updated signing logic to dynamically find certificates, added debug logs and error checks |
Comments suppressed due to low confidence (4)
.github/workflows/release-dev.yml:46
- The indentation for CERTIFICATES_PASSWORD under
secrets:is misaligned; this can cause YAML parsing errors and prevent the password from being set. Align it with CERTIFICATES_P12.
CERTIFICATES_PASSWORD: ${{ secrets.CERTIFICATES_PASSWORD }}
.github/workflows/release-stable.yml:147
- [nitpick] Consider removing or gating these extensive debug logging steps once the signing process is stable to reduce CI log noise or extracting them behind a verbose flag.
# Debug: Check certificate availability
.github/workflows/build-and-sign.yml:145
- [nitpick] This debug log is duplicated with similar steps in the stable workflow; consider consolidating debug logic into a single reusable step or enabling it via an input flag.
echo "=== Available certificates in keychain ==="
.github/workflows/build-and-sign.yml:40
- [nitpick] Pinning to
Xcode_15.2.appmay require updates when new Xcode versions are released; consider making the Xcode version configurable via a workflow input.
run: sudo xcode-select -s /Applications/Xcode_15.2.app
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Changes
Created
.github/workflows/build-and-sign.ymlFixed
release-dev.ymlUpdated
release-stable.ymlProblem
The release-dev workflow was failing with "The specified item could not be found in the keychain" error because the keychain wasn't properly added to the search list.
Solution
Added the missing keychain configuration steps that exist in the main branch's release.yml:
Test Plan
🤖 Generated with Claude Code