From 71b5ab67f6130ddc265e293cf7b4506f67f2b4a1 Mon Sep 17 00:00:00 2001 From: YeonGyu-Kim Date: Sat, 11 Apr 2026 23:47:54 +0900 Subject: [PATCH] fix(ci): replace breaking codesign step with signature verification The previous ad-hoc codesign step failed with 'invalid or unsupported format for signature' because it tried to preserve the 'linker-signed' flag which cannot be re-signed. The native macOS build already produces a valid ad-hoc signature via Bun's linker, so we only need to verify the signature exists rather than re-sign it. --- .github/workflows/publish-platform.yml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/.github/workflows/publish-platform.yml b/.github/workflows/publish-platform.yml index 6fca187b0..1a85c5d0c 100644 --- a/.github/workflows/publish-platform.yml +++ b/.github/workflows/publish-platform.yml @@ -213,13 +213,13 @@ jobs: echo "Built binary:" ls -lh "$OUTPUT" - - name: Ad-hoc codesign darwin binary + - name: Verify darwin binary signature if: steps.check.outputs.skip != 'true' && startsWith(matrix.platform, 'darwin-') run: | BINARY="packages/${{ matrix.platform }}/bin/oh-my-opencode" - codesign --force --sign - --preserve-metadata=entitlements,requirements,flags,runtime "$BINARY" - echo "Verifying signature:" + echo "Signature info:" codesign -dvvv "$BINARY" 2>&1 + codesign -dvvv "$BINARY" 2>&1 | grep -q "Signature=adhoc" || { echo "ERROR: binary is not ad-hoc signed"; exit 1; } - name: Compress binary if: steps.check.outputs.skip != 'true'