From 6b5ec813e8dc96a9de14eb8fe28bfdeef2c2389f Mon Sep 17 00:00:00 2001
From: Bob <bob@superuserlabs.org>
Date: Sat, 4 Jul 2026 22:15:20 +0000
Subject: [PATCH] fix(ci): sign macOS artifacts only on release tags

---
 .github/workflows/release.yml | 30 ++++++++++++++++++++++++++----
 1 file changed, 26 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index be3e22958..8a6a9d237 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -368,7 +368,18 @@ jobs:
       - name: Package dmg
         if: runner.os == 'macOS'
         run: |
-          if [ -n "$APPLE_EMAIL" ]; then
+          SIGN_MACOS=false
+          if [[ "${GITHUB_REF:-}" == refs/tags/v* ]]; then
+            SIGN_MACOS=true
+          fi
+
+          if [ "$SIGN_MACOS" = true ]; then
+            for var in APPLE_EMAIL APPLE_PASSWORD APPLE_TEAMID CERTIFICATE_MACOS_P12_BASE64 CERTIFICATE_MACOS_P12_PASSWORD; do
+              if [ -z "${!var:-}" ]; then
+                echo "ERROR: $var is required to sign macOS release artifacts" >&2
+                exit 1
+              fi
+            done
             ./scripts/ci/import-macos-p12.sh
             APPLE_PERSONALID=$(security find-identity -v -p codesigning "${KEY_CHAIN:-build.keychain-db}" | sed -n 's/.*"\(.*\)"/\1/p' | head -1)
             if [ -z "$APPLE_PERSONALID" ]; then
@@ -381,7 +392,7 @@ jobs:
           source venv/bin/activate
           make dist/ActivityWatch.dmg
 
-          if [ -n "$APPLE_EMAIL" ]; then
+          if [ "$SIGN_MACOS" = true ]; then
             codesign --force --verbose --timestamp -s "${APPLE_PERSONALID}" dist/ActivityWatch.dmg
 
             brew install akeru-inc/tap/xcnotary
@@ -592,7 +603,18 @@ jobs:
       - name: Package dmg
         if: runner.os == 'macOS'
         run: |
-          if [ -n "$APPLE_EMAIL" ]; then
+          SIGN_MACOS=false
+          if [[ "${GITHUB_REF:-}" == refs/tags/v* ]]; then
+            SIGN_MACOS=true
+          fi
+
+          if [ "$SIGN_MACOS" = true ]; then
+            for var in APPLE_EMAIL APPLE_PASSWORD APPLE_TEAMID CERTIFICATE_MACOS_P12_BASE64 CERTIFICATE_MACOS_P12_PASSWORD; do
+              if [ -z "${!var:-}" ]; then
+                echo "ERROR: $var is required to sign macOS release artifacts" >&2
+                exit 1
+              fi
+            done
             ./scripts/ci/import-macos-p12.sh
             APPLE_PERSONALID=$(security find-identity -v -p codesigning "${KEY_CHAIN:-build.keychain-db}" | sed -n 's/.*"\(.*\)"/\1/p' | head -1)
             if [ -z "$APPLE_PERSONALID" ]; then
@@ -605,7 +627,7 @@ jobs:
           source venv/bin/activate
           make dist/ActivityWatch.dmg
 
-          if [ -n "$APPLE_EMAIL" ]; then
+          if [ "$SIGN_MACOS" = true ]; then
             codesign --force --verbose --timestamp -s "${APPLE_PERSONALID}" dist/ActivityWatch.dmg
 
             brew install akeru-inc/tap/xcnotary