Conversation
Sign all xcframeworks with a self-signed certificate during the release build. The signing identity defaults to "OpenSwiftUI" and can be overridden via OPENSWIFTUI_SIGNING_IDENTITY. Gracefully skips if no certificate is found (e.g. external contributor PRs).
github-actions
bot
added
enhancement
🤖 Augment PR SummarySummary: This PR adds optional code-signing for the generated XCFramework artifacts during the release build. Changes:
🤖 Was this summary useful? React with 👍 or 👎 |
![augmentcode[bot]](https://avatars.githubusercontent.com/in/1027498?s=60&v=4){kind=small}
| with: | ||
| xcode-version: ${{ inputs.xcode-version }} | ||
| - name: Import signing certificate | ||
| if: ${{ inputs.signing-certificate-base64 != '' }} |
There was a problem hiding this comment.
The import step is gated only on signing-certificate-base64, so a missing/empty signing-certificate-password (or an import failure due to other issues) will be silently ignored due to continue-on-error, potentially producing unsigned release artifacts without a clear signal.
Severity: medium
🤖 Was this useful? React with 👍 or 👎, or 🚀 if it prevented an incident/outage.
Scripts/build_xcframework.sh
Outdated
| # Code sign xcframeworks if signing certificate is available | ||
| SIGNING_IDENTITY="${OPENSWIFTUI_SIGNING_IDENTITY:-OpenSwiftUI}" | ||
| echo "Checking if signing certificate '$SIGNING_IDENTITY' is installed..." | ||
| if security find-certificate -c "$SIGNING_IDENTITY" > /dev/null 2>&1; then |
There was a problem hiding this comment.
security find-certificate -c only verifies that a certificate exists, not that a usable code-signing identity (with private key) is available; if the cert imports without a key, the subsequent codesign call will fail unexpectedly.
Severity: medium
🤖 Was this useful? React with 👍 or 👎, or 🚀 if it prevented an incident/outage.
Manual inputs fall back to repo secrets when left empty.
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #844 +/- ##
=======================================
Coverage 26.85% 26.85%
=======================================
Files 671 671
Lines 43470 43470
=======================================
Hits 11675 11675
Misses 31795 31795 ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
Search all user keychains to find the signing certificate and pass --keychain to codesign, fixing the case where apple-actions/import-codesign-certs imports into a temporary keychain.
1 participant
Summary
apple-actions/import-codesign-certs@v3Changes
Scripts/build_xcframework.sh— added signing step after xcframework creation.github/actions/build-xcframework/action.yml— added certificate import step and new inputs.github/workflows/release.yml— pass signing secrets to the composite actionSetup required
Add these GitHub repo secrets:
SIGNING_CERTIFICATE_BASE_64— base64-encoded.p12certificateSIGNING_CERTIFICATE_PASSWORD— password for the.p12fileTest plan
codesign -dv --verbose=4 OpenSwiftUI.xcframework