astronomer / astro-cli / 42914023615
45%

DEFAULT BRANCH: main
Ran
Jobs 1
Files 220
Run time 1min
Badge
Embed ▾
README BADGES
x

If you need to use a raster PNG badge, change the '.svg' to '.png' in the link

Markdown

Textile

RDoc

HTML

Rst
coverage: 45.473%. Remained the same
42914023615

push

github

web-flow 
Sign and notarize macOS release binaries (#2474)

* Sign and notarize macOS release binaries

Sign the darwin builds with a Developer ID Application certificate and
notarize them through goreleaser's notarize.macos (quill), so releases
are accepted by Gatekeeper and by endpoint tools that trust by Team ID
instead of needing to be allowlisted each version. The step is skipped
when the certificate secret is unset or empty.

Co-Authored-By: Claude <noreply@anthropic.com>

* Fail official releases that would ship unsigned macOS binaries

goreleaser skips signing when the certificate is empty so snapshots and
forks still build, which also meant a missing or misnamed secret would
publish unsigned binaries with a green run. In astronomer/astro-cli the
release now refuses to start without every signing secret, and checks
after the build that both darwin binaries verify and carry our Team ID.

Co-Authored-By: Claude <noreply@anthropic.com>

* Read macOS signing secrets from a protected environment

Repository secrets are readable by any workflow a writer pushes to any
branch. Running the release job in a macos-signing environment lets the
Apple credentials live as environment secrets, limited by that
environment's deployment policy to release tags.

Co-Authored-By: Claude <noreply@anthropic.com>

* Name the release signing environment for both platforms

The environment will also carry the Azure login for Windows signing, so
call it release-signing rather than macos-signing.

Co-Authored-By: Claude <noreply@anthropic.com>

* Check the signing certificate before publishing, and hold back announcements on failure

- Before goreleaser runs, import the .p12 into a throwaway keychain and
  require a valid, in-date Developer ID Application identity for our
  team. A wrong password, another team's certificate or an expired one
  now fails the release before anything is published. Warn when the
  certificate expires within 30 days.
- The post-build check also requires... (continued)

27622 of 60744 relevant lines covered (45.47%)

10.3 hits per line

Jobs
ID Job ID Ran Files Coverage
1 42914023615.1 220
45.47
GitHub Action Run
Source Files on build 42914023615