[banstack]

Requested by Banstack · project thread

Prepares the release workflow for the Developer ID secrets from #4.

Changes

• Signing identity is auto-detected. The workflow reads the Developer ID Application: … identity from the imported MACOS_CERTIFICATE, so MACOS_SIGN_IDENTITY is now optional. If the .p12 has no Developer ID identity (for example, it was exported without its private key), the job fails with a clear message.
• No accidental half-signed releases. If a certificate is set but APPLE_ID, APPLE_TEAM_ID or APPLE_APP_PASSWORD is missing, the job fails early. A signed DMG that hasn't been notarized is still blocked by Gatekeeper.
• Clear notarization failures. make-dmg.sh checks the notarization status. If Apple rejects the submission, it prints Apple's log before failing.
• README. The Install section now says releases are notarized, and the secrets table marks MACOS_SIGN_IDENTITY as optional.

With no secrets set, nothing changes: the build is unsigned as before.

Testing

The YAML parses and the shell scripts pass bash -n. The signed path can only be tested with real credentials, so it will be exercised by the first tag pushed after the secrets are added. Issue #4 can be closed once that release is confirmed to be notarized.

🤖 Generated with Claude Code

https://claude.ai/code/session_01Pqz2pCwcBrWAn7nD7KkoKi

[banstack]

The dmg check failure on this test run is a secrets problem, not a code problem. The workflow found and decoded the certificate, but security import rejected MACOS_CERTIFICATE_PASSWORD, with the error "The user name or passphrase you entered is not correct". I'll re-run the test once the password secret matches the .p12 export password.

---

Generated by Claude Code

[banstack]

Update: the certificate password is fixed. The re-run imported the certificate, auto-detected the Developer ID identity and signed the app, so the signing half of this PR works.

Notarization still fails, again because of an account problem rather than the code. Apple returned HTTP 401: Your Apple ID has been locked. The account has to be unlocked at iforgot.apple.com and given a new app-specific password before the next run.

---

Generated by Claude Code