From 470ed8b13ac75296d4f8123d92576419691dbc44 Mon Sep 17 00:00:00 2001
From: YeonGyu-Kim <code.yeon.gyu@gmail.com>
Date: Sat, 11 Apr 2026 23:55:02 +0900
Subject: [PATCH] fix(ci): remove existing signature before ad-hoc signing
 darwin binary

Bun-compiled binaries contain a malformed LC_CODE_SIGNATURE load
command that prevents codesign from directly replacing it. Remove
the existing signature first, then apply a fresh ad-hoc signature.
---
 .github/workflows/publish-platform.yml | 11 ++++++++---
 1 file changed, 8 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/publish-platform.yml b/.github/workflows/publish-platform.yml
index 5322030b1..5f7235e5f 100644
--- a/.github/workflows/publish-platform.yml
+++ b/.github/workflows/publish-platform.yml
@@ -217,10 +217,15 @@ jobs:
         if: steps.check.outputs.skip != 'true' && startsWith(matrix.platform, 'darwin-')
         run: |
           BINARY="packages/${{ matrix.platform }}/bin/oh-my-opencode"
-          codesign --sign - --force "$BINARY"
-          echo "Signature info:"
+          echo "Initial state:"
+          codesign -dvvv "$BINARY" 2>&1 || true
+          echo "Removing any existing signature:"
+          codesign --remove-signature "$BINARY" 2>&1 || true
+          echo "Applying ad-hoc signature:"
+          codesign --sign - --force --timestamp=none "$BINARY"
+          echo "Final state:"
           codesign -dvvv "$BINARY" 2>&1
-          codesign -dvvv "$BINARY" 2>&1 | grep -q "Signature=adhoc" || { echo "ERROR: binary is not ad-hoc signed"; exit 1; }
+          codesign --verify --verbose "$BINARY"
 
       - name: Compress binary
         if: steps.check.outputs.skip != 'true'