Repository navigation
ci: manual sign-and-notarize check for Plannotator Snapshots - #1799
Merged
Merged
Conversation
A workflow_dispatch job that builds Plannotator Snapshots.app from a chosen ref, signs it with the Developer ID from the Apple secrets, notarizes and staples it, and verifies the signature, Gatekeeper's notarized assessment and the staple. It uploads the zip and makes no release, so the secrets can be proven before a tag depends on them (release tags are immutable). It needs all six Apple secrets and fails naming any that are missing. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
… from a protected environment The ref is passed to scripts through env (never pasted into a script), a first step with no secrets accepts only a branch or tag of this repository by exact name and resolves it to a commit, and checkout uses that commit. The Apple secrets come from the protected GitHub Environment apple-signing. Decoded key files are removed by a trap even when a step fails. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
git ls-remote matches patterns against the end of ref names, so a tag named x/refs/tags/main matched an input of main. Keep only exact names, and refuse a name that is both a branch and a tag. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
1 task
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
A
workflow_dispatchworkflow (Actions → Snapshots sign check → Run workflow) that builds Plannotator Snapshots.app from a chosen ref (defaultfeat/shots-macos), signs it with the Developer ID from the Apple secrets, notarizes and staples it, then verifies three things:codesign --verify --deep --strict, Gatekeeper's assessment says "Notarized Developer ID", andstapler validate. It uploads the signed zip as an artifact (7 days) and makes no release.Why: release.yml signs only on tag pushes, and release tags are immutable, so the secrets need proving before a release depends on them.
APPLE_DEVELOPER_ID_P12,_P12_PASSWORD,_IDENTITY,APPLE_NOTARY_KEY_P8,_KEY_ID,_ISSUER_ID) and fails naming any that are missing.permissions: contents: read, SHA-pinned actions as in release.yml, a temporary keychain removed at the end, decoded key files deleted after use.🤖 Generated with Claude Code