Skip to content

bugfix-ci - Fix PR builds from failing for MacOS #930

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
RadicalMuffinMan merged 2 commits into from
Jul 26, 2026
Merged

bugfix-ci - Fix PR builds from failing for MacOS #930

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
7aa2fbe
fix(ci): remove CODE_SIGNING_REQUIRED=NO from unsigned macOS builds
mattsigal Jul 25, 2026
4b2b79a
updated macOS build scripts comments
RadicalMuffinMan Jul 26, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 4 additions & 4 deletions .github/workflows/build.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -168,11 +168,11 @@ jobs:
MACOS_CERTIFICATE_BASE64: ${{ secrets.MACOS_CERTIFICATE_BASE64 }}
MACOS_CERTIFICATE_PASSWORD: ${{ secrets.MACOS_CERTIFICATE_PASSWORD }}
run: |
# On PRs from forks the certificate secret is not available. Skip the
# signing setup; build-macos.sh produces an unsigned build when no
# identity is present.
# On PRs from forks the certificate secret isn't available, so skip
# the signing setup. build-macos.sh falls back to an ad-hoc signature
# when no identity is present.
if [ -z "$MACOS_CERTIFICATE_BASE64" ]; then
echo "No macOS certificate secret; skipping signing setup (unsigned build)."
echo "No macOS certificate secret, skipping signing setup (ad-hoc signed build)."
exit 0
fi

Expand Down
9 changes: 7 additions & 2 deletions build-macos.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -97,7 +97,7 @@ fi
UNSIGNED=0
if [ -z "$APP_SIGN_ID" ] && [ -z "$TEAM_ID" ]; then
UNSIGNED=1
echo "No signing identity available, building unsigned so PR builds still run."
echo "No signing identity available, ad-hoc signing so PR builds still run."
PBXPROJ="$REPO_ROOT/macos/Runner.xcodeproj/project.pbxproj"
cp "$PBXPROJ" "$PBXPROJ.signing.bak"
trap 'mv -f "$PBXPROJ.signing.bak" "$PBXPROJ" 2>/dev/null || true' EXIT
Expand Down Expand Up @@ -130,7 +130,12 @@ ARCHIVE_CMD=(
archive
)
if [ "$UNSIGNED" = "1" ]; then
ARCHIVE_CMD+=( CODE_SIGN_STYLE=Manual CODE_SIGN_IDENTITY="-" CODE_SIGNING_REQUIRED=NO )
# Ad-hoc sign rather than skipping signing. Don't add CODE_SIGNING_REQUIRED=NO
# here, because the CocoaPods framework script and the embedded emulator cores
# both check it and leave their bundles unsigned, which then fails the final
# CodeSign of the app. Arm64 binaries also need at least an ad-hoc signature
# to launch at all.
ARCHIVE_CMD+=( CODE_SIGN_STYLE=Manual CODE_SIGN_IDENTITY="-" )
else
ARCHIVE_CMD+=( CODE_SIGN_STYLE=Automatic )
if [ -n "$TEAM_ID" ]; then
Expand Down
Loading