fix(release): sign the packaged macOS keyring addons before notarization

[lidge-jun]

Summary

The 2.73.0 preview release failed before publishing: Apple notarization rejected OpenCodex.app because Contents/Resources/keyring/keyring.darwin-arm64.node and keyring.darwin-x64.node (bundled since #6161) were not signed with the Developer ID certificate and had no secure timestamp (release.yml run 36648529039, job package-desktop (macos-latest …), notary id e5216fb0). Tauri signs the app, sidecar and widget, but not files under Resources.

This adds a macOS step after the certificate import and before tauri build that signs each desktop/src-tauri/resources/keyring/*.darwin-*.node in place with codesign --force --timestamp --options runtime and the release identity, then verifies the TeamIdentifier, hardened-runtime flag and timestamp. A real release without signing material fails instead of shipping unsigned addons; a dry run keeps them as prepared. Nothing was published by the failed run (npm latest 2.72.0, preview 2.72.0-preview.20260930; the publish job was skipped).

Verification

• tests/ci-workflows/release-desktop-scripts.test.ts gains a contract case for the step's platform, glob, codesign flags, verification, real-release refusal and order (after the keychain import and sidecar preparation, before Build desktop bundles); release workflow tests 68 pass, 0 fail.
• actionlint .github/workflows/release.yml: the same 3 pre-existing findings with and without this change, none in the new step. bun run privacy:scan passes.
• Real proof is the notarized preview release, which is retried from preview/main once this lands.

Checklist

• Scope stays focused and avoids unrelated cleanup.
• Docs or release notes were updated when needed.
• Security-sensitive changes were reviewed for secrets, auth, and unsafe defaults.

[github-actions]

✅ Deterministic PR hygiene checks passed.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-30T00:26:58.436730Z	70d0173	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[coderabbitai]

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

Note

Currently processing new changes in this PR. This may take a few minutes, please wait...

⚙️ Run configuration

Configuration used: Repository: lidge-jun/opencodex/.coderabbit.yaml

Review profile: ASSERTIVE

Plan: Advanced

Run ID: 75f1cef0-66f4-4ae0-a86e-669fe0c31eb4

📥 Commits

Reviewing files that changed from the base of the PR and between a30e67f and 70d0173.

📒 Files selected for processing (2)

• .github/workflows/release.yml
• tests/ci-workflows/release-desktop-scripts.test.ts

 ______________________________________________________
< Review complete: I laughed, I cried, I filed issues. >
 ------------------------------------------------------
  \
   \   (\__/)
       (•ㅅ•)
       / 　 づ

✨ Finishing Touches

📝 Generate docstrings

• Commit to this branch
• Create a new PR

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[lidge-jun]

Security review (read-only, independent reviewer) at 60bcf01431: PASS. Secrets reach the step only through env (no ${{ }} in run:); codesign -dvvv prints public signature fields and secret values stay masked; here-strings avoid the pipefail SIGPIPE; the addons get the same team as the hardened-runtime sidecar, so library validation holds and verify-macos-runtime.sh probes the load; a real release without signing material fails.

[lidge-jun]

리뷰 · 우선순위 73 / 80

2.73.0 미리보기 배포가 막혔어요. 앱 안의 keyring.darwin-*.node 파일이 개발자 인증서로 서명되지 않았고, 안전한 시간 도장도 없었어요. Tauri는 앱·사이드카·위젯만 서명하고, Resources 아래 파일은 안 건드려요. 그래서 공증(notarization)이 앱 전체를 거절했어요.

이 PR은 인증서를 키체인에 넣은 뒤, Tauri가 묶기 전에 desktop/src-tauri/resources/keyring/*.darwin-*.node를 하나씩 codesign으로 서명해요. 강제 서명, 하드닝 런타임, 시간 도장을 넣고, 팀 ID·런타임·시간 도장이 있는지 바로 확인해요. 진짜 배포인데 서명 재료가 없으면 실패해요. dry-run만 그대로 두고 넘어가요. base는 dev이고, 워크플로 계약 테스트도 같이 늘렸어요. 미리보기 배포 얘기는 여기서 더 안 해요.

.github/workflows/release.yml Sign the packaged keyring addons - 서명할지 말지는 DESKTOP_SIGNING_CONFIGURED만 봐요. 이 값은 인증서 시크릿이 있는지만 봐요. 서명 이름(APPLE_SIGNING_IDENTITY)이나 팀 ID가 비어 있어도 “서명해야 한다” 분기로 들어가요. 그때는 친절한 거절 문구 대신 codesign 원본 에러로 끝나요. 위젯 쪽도 같은 문을 쓰지만, 이번 스텝도 그대로 물려받았어요.

.github/workflows/release.yml Verify every Mach-O in the bundle carries the release identity - 묶은 뒤에는 팀 ID만 다시 봐요. 시간 도장과 하드닝 런타임은 묶기 전 원본에서만 확인해요. 복사·묶는 과정에서 서명이 약해져도, 그 스윕은 팀 ID만 맞으면 통과해요. 다음 방어선은 공증이에요.

메인테이너의 판단이 필요한 지점

서명 문을 인증서만 볼지, 서명 이름·팀 ID까지 “한 세트”로 볼지 정해 주세요. 묶은 뒤 스윕에 시간 도장·런타임 검사까지 넣을지도 정해 주세요. 위젯 확인 스텝은 아직 echo | grep 파이프라, 이번 키링 수정(here-string)과 결이 달라요. 같이 맞출지는 선택이에요.

너의 추천

합쳐도 됩니다. 원인·순서·실패 조건이 맞아요. 사이드카 준비 뒤·번들 빌드 앞이라는 순서도 테스트가 잠가요. 다만 머지 전에 서명 이름·팀 ID가 비었을 때도 지금처럼 원본 codesign 에러로 둘지, 아니면 “진짜 배포는 키링도 서명해야 한다”처럼 짧게 거절할지 한 줄만 정해 주세요. 묶은 뒤 스윕 강화는 이번 PR에 굳이 넣지 말고, 공증 재시도로 증명해도 충분해요.

이 댓글은 grok-bot이 작성했습니다

[lidge-jun]

Maintainer integration on the owner-authorized 2.73.0 release: merging at exact head 60bcf01431. Service lifecycle, React Doctor, enforce-target and labeler green; release workflow contract tests 37 pass locally; security review PASS above. Cross-platform CI gates the preview/main promotion SHAs before the release retry.