tari-project / tari / 28587625216
61%

DEFAULT BRANCH: development
Ran
Jobs 1
Files 702
Run time 3min
Badge
Embed ▾
README BADGES
x

If you need to use a raster PNG badge, change the '.svg' to '.png' in the link

Markdown

Textile

RDoc

HTML

Rst
coverage: 61.861% (+1.0%) from 60.9%
28587625216

push

github

web-flow 
ci: use App Store Connect API key for macOS notarization (#7913)

## Problem

macOS builds fail at **Sign macOS Artifacts → notarization**, e.g. [this
rc.2
run](https://github.com/tari-project/tari/actions/runs/28578155619/job/84731624027):

```
/notary/v2/asp          -> 200  (Apple ID + app-specific password valid)
/notary/v2/submissions  -> 403  forbidden
Error: HTTP status code: 403. Invalid or inaccessible developer team ID
for the provided Apple ID. Ensure the Team ID is correct and that you are
a member of that team.
```

Code-signing (team-level `Developer ID Application` cert) still succeeds
— only notarization fails. Root cause: notarization authenticated as an
**individual team member's Apple ID**
(`--apple-id`/`--password`/`--team-id`). Those secrets were set in Dec
2023; that member was since removed from the Apple developer team, so
the notary service rejects the submission. The Apple ID still logs in
(personal account → `/asp` 200) but is no longer a team member.

## Fix

Switch both `notarytool submit` calls to a **team-scoped App Store
Connect API key** (`--key`/`--key-id`/`--issuer`). The key belongs to
the team, not a person, so it survives member changes.

## Required repo secrets (new)

| Secret | Value |
|---|---|
| `MACOS_NOTARY_KEY` | contents of the `.p8` API key |
| `MACOS_NOTARY_KEY_ID` | Key ID |
| `MACOS_NOTARY_ISSUER` | Issuer ID (also the new signing gate) |

The old `MACOS_NOTARIZE_USERNAME` / `MACOS_NOTARIZE_PASSWORD` /
`MACOS_ASC_PROVIDER` can be deleted once this merges. Code-signing
secrets (`MACOS_APPLICATION_*`) are unchanged.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

72294 of 116866 relevant lines covered (61.86%)

223705.83 hits per line

Coverage Regressions

Lines Coverage ∆ File
24
53.2
 7.83% base_layer/core/src/chain_storage/lmdb_db/lmdb_db.rs
7
67.76
 -3.27% comms/core/src/protocol/messaging/protocol.rs
7
93.42
 -0.21% comms/dht/src/outbound/broadcast.rs
6
53.93
 6.4% base_layer/core/src/chain_storage/blockchain_database.rs
4
94.34
 -2.52% comms/core/src/protocol/messaging/outbound.rs
3
79.11
 -0.7% base_layer/transaction_components/src/validation/aggregate_body/aggregate_body_internal_validator.rs
2
60.39
 0.0% comms/core/src/connectivity/manager.rs
2
78.37
 -0.82% comms/dht/src/discovery/service.rs
1
56.77
 -0.32% base_layer/core/src/base_node/state_machine_service/states/listening.rs
1
46.97
 25.76% base_layer/core/src/chain_storage/block_add_result.rs
1
25.29
 -1.15% base_layer/core/src/chain_storage/error.rs
1
66.67
 -0.28% base_layer/core/src/mempool/sync_protocol/mod.rs
1
75.34
 -1.37% base_layer/node_components/src/blocks/chain_block.rs
1
94.79
 -1.04% base_layer/transaction_components/src/consensus/consensus_encoding/hashing.rs
1
38.53
 -0.04% base_layer/wallet/src/transaction_service/storage/sqlite_db.rs
1
90.56
 -0.29% comms/core/src/multiplexing/yamux.rs
1
84.86
 -0.17% comms/core/src/peer_manager/manager.rs
1
88.87
 -0.19% comms/core/src/peer_manager/peer_storage_sql.rs
Jobs
ID Job ID Ran Files Coverage
1 28587625216.1 702
61.86
 GitHub Action Run
Source Files on build 28587625216