From 16e7fa5b1ad8a68f11c92f577217fd52b4583ff9 Mon Sep 17 00:00:00 2001 From: YeonGyu-Kim Date: Sat, 11 Apr 2026 23:51:50 +0900 Subject: [PATCH] fix(ci): ad-hoc sign darwin binaries with plain codesign Bun on github macos-latest runners does not emit linker-signed signatures by default. Sign explicitly with 'codesign --sign -' without preserve-metadata since the binary has no prior signature. --- .github/workflows/publish-platform.yml | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/.github/workflows/publish-platform.yml b/.github/workflows/publish-platform.yml index 1a85c5d0c..5322030b1 100644 --- a/.github/workflows/publish-platform.yml +++ b/.github/workflows/publish-platform.yml @@ -213,10 +213,11 @@ jobs: echo "Built binary:" ls -lh "$OUTPUT" - - name: Verify darwin binary signature + - name: Ad-hoc sign darwin binary if: steps.check.outputs.skip != 'true' && startsWith(matrix.platform, 'darwin-') run: | BINARY="packages/${{ matrix.platform }}/bin/oh-my-opencode" + codesign --sign - --force "$BINARY" echo "Signature info:" codesign -dvvv "$BINARY" 2>&1 codesign -dvvv "$BINARY" 2>&1 | grep -q "Signature=adhoc" || { echo "ERROR: binary is not ad-hoc signed"; exit 1; }