luna/oh-my-opencode
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

fix(ci): ad-hoc sign darwin binaries with plain codesign

Browse Source 
Bun on github macos-latest runners does not emit linker-signed
signatures by default. Sign explicitly with 'codesign --sign -'
without preserve-metadata since the binary has no prior signature.
This commit is contained in:
YeonGyu-Kim
2026-04-11 23:51:50 +09:00
parent 71b5ab67f6
commit 16e7fa5b1a
1 changed files with 2 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.github/workflows/publish-platform.yml
+2 -1
View File
@@ -213,10 +213,11 @@ jobs:
echo "Built binary:" echo "Built binary:"
ls -lh "$OUTPUT" ls -lh "$OUTPUT"
- name: Verify darwin binary signature - name: Ad-hoc sign darwin binary
if: steps.check.outputs.skip != 'true' && startsWith(matrix.platform, 'darwin-') if: steps.check.outputs.skip != 'true' && startsWith(matrix.platform, 'darwin-')
run: | run: |
BINARY="packages/${{ matrix.platform }}/bin/oh-my-opencode" BINARY="packages/${{ matrix.platform }}/bin/oh-my-opencode"
codesign --sign - --force "$BINARY"
echo "Signature info:" echo "Signature info:"
codesign -dvvv "$BINARY" 2>&1 codesign -dvvv "$BINARY" 2>&1
codesign -dvvv "$BINARY" 2>&1 | grep -q "Signature=adhoc" || { echo "ERROR: binary is not ad-hoc signed"; exit 1; } codesign -dvvv "$BINARY" 2>&1 | grep -q "Signature=adhoc" || { echo "ERROR: binary is not ad-hoc signed"; exit 1; }