Title: ci(desktop): mac code-signing + App Store Connect API-key notarization by LaZzyMan · Pull Request #30 · modelstudioai/openwork · GitHub
Open Graph Title: ci(desktop): mac code-signing + App Store Connect API-key notarization by LaZzyMan · Pull Request #30 · modelstudioai/openwork
X Title: ci(desktop): mac code-signing + App Store Connect API-key notarization by LaZzyMan · Pull Request #30 · modelstudioai/openwork
Description: What this PR does Switches the macOS desktop release notarization path from Apple ID + app-specific password to the App Store Connect API key method. The Configure optional signing secrets step now reads APPLE_NOTARY_API_KEY_P8_BASE64, APPLE_NOTARY_KEY_ID, and APPLE_NOTARY_ISSUER_ID, materializes the .p8 to a temp file, and exports APPLE_API_KEY / APPLE_API_KEY_ID / APPLE_API_ISSUER — which electron-builder (>=24) consumes to notarize via notarytool. The existing unsigned-draft fallback (allow_unsigned_artifacts for dry-run / draft) is preserved. Why it's needed The App Store Connect API key method is more robust than Apple ID + app-specific password (no 2FA prompts, no password expiry) and is what electron-builder >=24 natively consumes. It reuses the notary key already provisioned for the org's Apple Developer account (team NF4574S59H). The same change has been validated end-to-end on the upstream qwen-code desktop pipeline (sign + notarize green on a dry-run). Secrets (configured in repo) MAC_CSC_LINK, MAC_CSC_KEY_PASSWORD, APPLE_TEAM_ID, APPLE_NOTARY_API_KEY_P8_BASE64, APPLE_NOTARY_KEY_ID, APPLE_NOTARY_ISSUER_ID (same Apple team / Developer ID cert / notary key as qwen-code). Scope Workflow-only. The build helpers build-dmg.sh / scripts/build/darwin.ts are intentionally left untouched here — their NOTARIZE dead-code cleanup flows in via the upstream qwen-code desktop sync to avoid sync conflicts; neither runs in CI (the build job calls electron-builder directly via dist:mac:no-publish). Verification End-to-end signing + notarization to be validated via a dry_run=true Desktop Release run on this branch once MAC_CSC_KEY_PASSWORD is set.
Open Graph Description: What this PR does Switches the macOS desktop release notarization path from Apple ID + app-specific password to the App Store Connect API key method. The Configure optional signing secrets step now...
X Description: What this PR does Switches the macOS desktop release notarization path from Apple ID + app-specific password to the App Store Connect API key method. The Configure optional signing secrets step now...
Opengraph URL: https://github.com/modelstudioai/openwork/pull/30
X: @github
Domain: github.com
| route-pattern | /:user_id/:repository/pull/:id/files(.:format) |
| route-controller | pull_requests |
| route-action | files |
| fetch-nonce | v2:8f613804-2b5c-9c18-cb9b-bf7d64b8823d |
| current-catalog-service-hash | ae870bc5e265a340912cde392f23dad3671a0a881730ffdadd82f2f57d81641b |
| request-id | 9E12:1AF501:143EA9C:1AB0BE6:6A51B6C6 |
| html-safe-nonce | 4f1b56e95347fcb5f33b637883a19e090a6198d671105f814a9a864c986989d6 |
| visitor-payload | eyJyZWZlcnJlciI6IiIsInJlcXVlc3RfaWQiOiI5RTEyOjFBRjUwMToxNDNFQTlDOjFBQjBCRTY6NkE1MUI2QzYiLCJ2aXNpdG9yX2lkIjoiMzQ4OTIzMTcwNzkzMjA0NzA0NyIsInJlZ2lvbl9lZGdlIjoiaWFkIiwicmVnaW9uX3JlbmRlciI6ImlhZCJ9 |
| visitor-hmac | d0953f8d6c5723d15345511ddc031e8a670b5f45cff65fe4645b23b41c10f582 |
| hovercard-subject-tag | pull_request:3872405693 |
| github-keyboard-shortcuts | repository,pull-request-list,pull-request-conversation,pull-request-files-changed,copilot |
| google-site-verification | Apib7-x98H0j5cPqHWwSMm6dNU4GmODRoqxLiDzdx9I |
| octolytics-url | https://collector.github.com/github/collect |
| analytics-location | / |
| fb:app_id | 1401488693436528 |
| apple-itunes-app | app-id=1477376905, app-argument=https://github.com/modelstudioai/openwork/pull/30/files |
| twitter:image | https://avatars.githubusercontent.com/u/23273105?s=400&v=4 |
| twitter:card | summary_large_image |
| og:image | https://avatars.githubusercontent.com/u/23273105?s=400&v=4 |
| og:image:alt | What this PR does Switches the macOS desktop release notarization path from Apple ID + app-specific password to the App Store Connect API key method. The Configure optional signing secrets step now... |
| og:site_name | GitHub |
| og:type | object |
| hostname | github.com |
| expected-hostname | github.com |
| None | b9a586c06a05a7a86fc7e3f4dbd03e42f6869085879aa184aa6369456dbd50fb |
| turbo-cache-control | no-preview |
| diff-view | unified |
| go-import | github.com/modelstudioai/openwork git https://github.com/modelstudioai/openwork.git |
| octolytics-dimension-user_id | 283556804 |
| octolytics-dimension-user_login | modelstudioai |
| octolytics-dimension-repository_id | 1256697754 |
| octolytics-dimension-repository_nwo | modelstudioai/openwork |
| octolytics-dimension-repository_public | true |
| octolytics-dimension-repository_is_fork | false |
| octolytics-dimension-repository_network_root_id | 1256697754 |
| octolytics-dimension-repository_network_root_nwo | modelstudioai/openwork |
| turbo-body-classes | logged-out env-production page-responsive |
| disable-turbo | true |
| browser-stats-url | https://api.github.com/_private/browser/stats |
| browser-errors-url | https://api.github.com/_private/browser/errors |
| release | 7aed05249554b889eb33d002851a973eebcc7e91 |
| ui-target | full |
| theme-color | #1e2327 |
| color-scheme | light dark |
Links:
Viewport: width=device-width