31692859738
70%

Ran 13 Aug 2026 10:56AM UTC

Jobs 1

Files 875

Run time 2min

Badge

Embed ▾

Committed 13 Aug 2026 10:50AM UTC coverage: 70.265% (+0.006%) from 70.259%

Build # 31692859738

Build Type

push

github

Committed by

web-flow

Commit Message

Sign the macOS thv binary with a Developer ID certificate (#6156)

Sign macOS thv binaries with Developer ID

The macOS thv binary ships with only the ad-hoc signature Go's linker
emits, so it carries no Team ID. Organizations that enforce binary
allowlisting (Santa and similar) trust binaries by code-signing
identity, leaving them to approve each release by CDHash or allow
execution from a user-writable path. Both are fragile, so thv tends to
get blocked in managed macOS environments.

ToolHive Studio already signs with Developer ID Application: Stacklok,
Inc, and the same certificate covers any binary from the team. Wire it
into the CLI release.

GoReleaser embeds anchore/quill, so signing happens on the existing
Linux runner rather than requiring a macOS one. This is sign-only:
omitting the notarize sub-block keeps Apple's notary service off the
release critical path, and a Developer ID signature is all that Team ID
allowlisting needs. Notarization can follow separately.

Signing stays inert until the secrets are configured. Releases without
them keep producing ad-hoc binaries and log a warning rather than
failing, so this is safe to merge ahead of the credentials.

Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>

Coverage Stats

84482 of 120233 relevant lines covered (70.27%)

98.75 hits per line

Coverage Regressions

Lines	Coverage	∆	File
2	75.5	-0.24%	pkg/transport/proxy/streamable/streamable_proxy.go

Jobs

ID	Job ID	Ran	Files	Coverage
1	31692859738.1	13 Aug 2026 10:56AM UTC	875	70.27	GitHub Action Run

stacklok / toolhive / 31692859738
70%

README BADGES
x

Markdown

Textile

RDoc

HTML

Rst

Coverage Regressions

Jobs

Source Files on build 31692859738

stacklok / toolhive / 31692859738 70%

README BADGES x

Markdown

Textile

RDoc

HTML

Rst

Coverage Regressions

Jobs

Source Files on build 31692859738

stacklok / toolhive / 31692859738
70%

README BADGES
x