feat(CLI): Add macOS binary signing using Apple Distribution certificate [SCD-129] #1002
Conversation
There was a problem hiding this comment.
Pull request overview
This PR adds macOS binary signing and notarization capabilities to the CLI release pipeline, addressing the need for distributing signed binaries through Apple's ecosystem.
Changes:
- Implements a new bash script to automate certificate setup, binary signing, and Apple notarization
- Refactors release.sh to remove manual GitHub release creation in favor of GitHub Actions workflows
- Updates the release workflow to include a dedicated macOS signing job with artifact management
Reviewed changes
Copilot reviewed 3 out of 3 changed files in this pull request and generated 4 comments.
| File | Description |
|---|---|
| clients/cli/build/sign_and_notarize.sh | New script handling certificate management, binary signing, and Apple notarization workflow |
| clients/cli/build/release.sh | Removed manual GitHub release creation code, delegating to GitHub Actions |
| clients/cli/.github/workflows/release.yml | Added permissions, artifact uploads, and new sign_and_notarize job orchestrating the signing pipeline |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
|
@bikmazefe can this be tried with a branch push with some parts (publishing, releasing) commented out? |
@jablan Yeah, that's the best possible way I can also think of. I guess it wouldn't hurt having a draft release, right? |
|
Tested and adjusted the workflow and the script as required, it's working now. See here Big thanks to @theSoenke for the help with the credentials! |
Add macOS binary signing and notarization using Apple Distribution certificate.