stacklok / toolhive-studio / 24826863670 / 1

70%

main: 70%

push

github

ci: skip macOS code signing on PR validation builds (#2084)

The PR validation matrix (on-pr.yml → _build-matrix.yml) ran the macOS
codesign setup on every PR. Forked PRs don't have access to the APPLE_*
secrets, so `base64 --decode` produced an empty file and `security
import` failed with `SecKeychainItemImport: One or more parameters
passed to a function were not valid`, breaking CI for external
contributors.

Signing belongs in release builds (on-release.yml) and the opt-in
/build-test flow, not in per-PR sanity checks. Drop the codesign setup
from the PR matrix and guard `osxSign` in forge.config.ts so the build
skips signing when no credentials are present instead of asking
electron-osx-sign to auto-detect an identity that doesn't exist.

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

3922 of 6421 branches covered (61.08%)

6096 of 9140 relevant lines covered (66.7%)

119.92 hits per line