Sign and notarize release DMG#14
Conversation
|
Note Gemini is unable to generate a review for this pull request due to the file types involved not being currently supported. |
📝 WalkthroughWalkthroughThe release workflow consolidates DMG creation, code signing, Apple notarization, ticket stapling, signature validation, image verification, and Gatekeeper assessment into one step. ChangesRelease packaging
Estimated code review effort: 2 (Simple) | ~10 minutes Suggested reviewers: 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
There was a problem hiding this comment.
Pull request overview
Updates the release workflow to ensure the distributed DMG artifact (not just the app bundle inside it) is codesigned, notarized, stapled, and validated prior to uploading to GitHub Releases and updating the Homebrew cask. This aligns the release pipeline with macOS Gatekeeper expectations for the outermost downloadable container.
Changes:
- Consolidates DMG creation and notarization into a single step and switches notarization target from an app ZIP to the final DMG.
- Adds DMG codesigning plus verification, stapling, and multiple validation checks (stapler, hdiutil, spctl) before upload.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
|
@codex review |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
🧹 Nitpick comments (1)
.github/workflows/build.yml (1)
133-137: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick winConsider capturing the notarization log on failure for easier CI debugging.
notarytool submit --waitreports a terminal status but the detailed rejection reason (ifInvalid) requires a separatexcrun notarytool log <submission-id>call. Without capturing the id/log, a failed release run gives little actionable detail beyond "non-zero exit."♻️ Example: capture submission id and fetch log on failure
- xcrun notarytool submit "${DMG}" \ - --apple-id "${APPLE_ID}" \ - --team-id "${APPLE_TEAM_ID}" \ - --password "${APPLE_APP_PASSWORD}" \ - --wait + SUBMISSION_ID=$(xcrun notarytool submit "${DMG}" \ + --apple-id "${APPLE_ID}" \ + --team-id "${APPLE_TEAM_ID}" \ + --password "${APPLE_APP_PASSWORD}" \ + --wait --output-format json | tee /tmp/notary-submit.json | jq -r .id) + xcrun notarytool log "${SUBMISSION_ID}" \ + --apple-id "${APPLE_ID}" \ + --team-id "${APPLE_TEAM_ID}" \ + --password "${APPLE_APP_PASSWORD}" || true🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/build.yml around lines 133 - 137, Update the notarization submission step around xcrun notarytool submit to capture its submission ID and, when the submission fails or returns Invalid, invoke xcrun notarytool log with that ID and print the detailed rejection log before exiting. Preserve the existing Apple credentials, DMG input, and --wait behavior.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Nitpick comments:
In @.github/workflows/build.yml:
- Around line 133-137: Update the notarization submission step around xcrun
notarytool submit to capture its submission ID and, when the submission fails or
returns Invalid, invoke xcrun notarytool log with that ID and print the detailed
rejection log before exiting. Preserve the existing Apple credentials, DMG
input, and --wait behavior.
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: cef5b8af-eebb-4587-b711-fab2e32554e9
📒 Files selected for processing (1)
.github/workflows/build.yml
|
CodeRabbit nitpick outcome: no change. |
|
Codex Review: Didn't find any major issues. Chef's kiss. Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
Summary
Why
The app bundle was signed and notarized before packaging, but the downloaded DMG itself was unsigned. Notarizing the outermost distribution artifact gives macOS a signed, stapled container to assess.
User impact
Future Vista release DMGs will carry their own Developer ID signature and notarization ticket. No release is created by this PR.
Validation
git diff --checkactionlint .github/workflows/build.yml(only existing Homebrew heredoc/backtick shellcheck warnings remain)Summary by CodeRabbit