From 426c7d8fa7d4cdff354c920cb695dc3dec2ec7be Mon Sep 17 00:00:00 2001
From: Dax <mail@thdxr.com>
Date: Tue, 27 Oct 2026 18:55:37 -0400
Subject: [PATCH] fix(ci): sign macOS builds with release environment
 credentials (#59760)

---
 .github/release/sign-desktop-macos.sh |  6 +++---
 .github/workflows/release-dry-run.yml | 11 ++++++-----
 .github/workflows/release.yml         | 11 ++++++-----
 3 files changed, 15 insertions(+), 13 deletions(-)

diff --git a/.github/release/sign-desktop-macos.sh b/.github/release/sign-desktop-macos.sh
index 86b9a64cfa4..0742b888271 100755
--- a/.github/release/sign-desktop-macos.sh
+++ b/.github/release/sign-desktop-macos.sh
@@ -3,7 +3,7 @@
 # notarizes them in one submission, staples them, and only then builds opencode-desktop-mac-<arch>.{zip,dmg,app.tar.gz}
 # from the stapled apps. Dry runs sign ad-hoc and skip notarization. Dev and beta trade larger files for faster
 # packaging (zip and dmg at zlib level 1) and skip the .app.tar.gz, which only the retired Tauri updater feed read.
-# Notarization reads APPLE_API_KEY_CONTENT, APPLE_API_KEY_ID and APPLE_API_ISSUER.
+# Notarization reads APPLE_NOTARY_KEY (the .p8 contents), APPLE_NOTARY_KEY_ID and APPLE_NOTARY_ISSUER_ID.
 . "$(dirname "$0")/lib.sh"
 
 out=$1
@@ -60,9 +60,9 @@ done
 
 if ! dry_run; then
   key=$(mktemp)
-  printf '%s\n' "$APPLE_API_KEY_CONTENT" > "$key"
+  printf '%s\n' "$APPLE_NOTARY_KEY" > "$key"
   ditto -c -k --sequesterRsrc "$apps" "$apps.zip"
-  xcrun notarytool submit "$apps.zip" --key "$key" --key-id "$APPLE_API_KEY_ID" --issuer "$APPLE_API_ISSUER" \
+  xcrun notarytool submit "$apps.zip" --key "$key" --key-id "$APPLE_NOTARY_KEY_ID" --issuer "$APPLE_NOTARY_ISSUER_ID" \
     --wait --timeout 60m --output-format json > "$apps.json"
   rm -f "$key"
   cat "$apps.json"
diff --git a/.github/workflows/release-dry-run.yml b/.github/workflows/release-dry-run.yml
index 63bd5fc652c..57d9f969755 100644
--- a/.github/workflows/release-dry-run.yml
+++ b/.github/workflows/release-dry-run.yml
@@ -385,8 +385,9 @@ jobs:
         uses: apple-actions/import-codesign-certs@8f3fb608891dd2244cdab3d69cd68c0d37a7fe93 # v2.0.0
         with:
           keychain: build
-          p12-file-base64: ${{ secrets.APPLE_CERTIFICATE }}
-          p12-password: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
+          p12-file-base64: ${{ secrets.APPLE_SIGNING_CERTIFICATE }}
+          # The certificate has no password; the action passes this to `security import -P`.
+          p12-password: ""
       - name: Sign CLI
         if: needs.plan.outputs.cli == 'true'
         run: bash .github/release/sign-cli-macos.sh "$RUNNER_TEMP/in/build-npm" "$RUNNER_TEMP/out"
@@ -396,9 +397,9 @@ jobs:
           bash .github/release/sign-desktop-macos.sh "$RUNNER_TEMP/out" \
             "$RUNNER_TEMP"/in/build-desktop-darwin-*/opencode-desktop-mac-*.app.tar
         env:
-          APPLE_API_KEY_CONTENT: ${{ secrets.APPLE_API_KEY_PATH }}
-          APPLE_API_KEY_ID: ${{ secrets.APPLE_API_KEY }}
-          APPLE_API_ISSUER: ${{ secrets.APPLE_API_ISSUER }}
+          APPLE_NOTARY_KEY: ${{ secrets.APPLE_NOTARY_KEY }}
+          APPLE_NOTARY_KEY_ID: ${{ vars.APPLE_NOTARY_KEY_ID }}
+          APPLE_NOTARY_ISSUER_ID: ${{ vars.APPLE_NOTARY_ISSUER_ID }}
       - id: upload
         name: Upload
         uses: ./.github/release/upload
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 00594ed3002..de0080a8daa 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -404,8 +404,9 @@ jobs:
         uses: apple-actions/import-codesign-certs@8f3fb608891dd2244cdab3d69cd68c0d37a7fe93 # v2.0.0
         with:
           keychain: build
-          p12-file-base64: ${{ secrets.APPLE_CERTIFICATE }}
-          p12-password: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
+          p12-file-base64: ${{ secrets.APPLE_SIGNING_CERTIFICATE }}
+          # The certificate has no password; the action passes this to `security import -P`.
+          p12-password: ""
       - name: Sign CLI
         if: needs.plan.outputs.cli == 'true'
         run: bash .github/release/sign-cli-macos.sh "$RUNNER_TEMP/in/build-npm" "$RUNNER_TEMP/out"
@@ -415,9 +416,9 @@ jobs:
           bash .github/release/sign-desktop-macos.sh "$RUNNER_TEMP/out" \
             "$RUNNER_TEMP"/in/build-desktop-darwin-*/opencode-desktop-mac-*.app.tar
         env:
-          APPLE_API_KEY_CONTENT: ${{ secrets.APPLE_API_KEY_PATH }}
-          APPLE_API_KEY_ID: ${{ secrets.APPLE_API_KEY }}
-          APPLE_API_ISSUER: ${{ secrets.APPLE_API_ISSUER }}
+          APPLE_NOTARY_KEY: ${{ secrets.APPLE_NOTARY_KEY }}
+          APPLE_NOTARY_KEY_ID: ${{ vars.APPLE_NOTARY_KEY_ID }}
+          APPLE_NOTARY_ISSUER_ID: ${{ vars.APPLE_NOTARY_ISSUER_ID }}
       - id: upload
         name: Upload
         uses: ./.github/release/upload