Fix macOS notarization: APPLE_API_ISSUER + drop redundant afterSign hook (#6)

The v0.2.0 retry run got further (linux OK, windows OK, macOS signing OK)
but macOS notarization failed with:

  ⨯ Env vars APPLE_API_KEY, APPLE_API_KEY_ID and APPLE_API_ISSUER need to be set

Two misconceptions in Phase 5:

1. The env var is `APPLE_API_ISSUER`, not `APPLE_API_KEY_ISSUER`.
   electron-builder rejects the `_KEY_` variant. Secret renamed out-of-band
   in the GitHub repo; workflow updated here.

2. Since electron-builder 26 notarizes natively whenever those env vars are
   present, our `afterSign: scripts/notarize.mjs` hook was redundant and
   actually fired after the built-in notarization had already failed. Drop
   the hook, drop `scripts/notarize.mjs`, drop `@electron/notarize` from
   devDependencies (electron-builder includes its own copy transitively).

Docs + CLAUDE.md pick up the rename and the simplified flow.

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: beautyfree

.github/workflows/release.yml

@@ -142,9 +142,11 @@ jobs:
           # via softprops below instead but the var being set also unlocks
           # electron-builder's release-draft verification.
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          # macOS signing + notarization (renamed from ELECTROBUN_* in Phase 5).
+          # macOS signing + notarization. Env-var names follow electron-builder's
+          # conventions (NB: `APPLE_API_ISSUER`, not `APPLE_API_KEY_ISSUER` —
+          # electron-builder rejects the "_KEY_" variant).
           CSC_NAME: ${{ secrets.CSC_NAME }}
-          APPLE_API_KEY_ISSUER: ${{ secrets.APPLE_API_KEY_ISSUER }}
+          APPLE_API_ISSUER: ${{ secrets.APPLE_API_ISSUER }}
           APPLE_API_KEY_ID: ${{ secrets.APPLE_API_KEY_ID }}
         run: bun run ${{ matrix.script }}
 

CLAUDE.md

@@ -25,7 +25,7 @@ Skiller is a **cross-platform desktop app** (Electron) for installing, syncing,
 | `assets/icons/` | **Runtime icons**: `AppIcon.iconset/`, `app.icns`, `app.ico`, `app/icon-512.png` |
 | `assets/icons/Skiller.icon/` | **Source only** (Icon Composer): `scripts/build-app-icons.py` reads `Assets/Image.png` via `icon.json` |
 | `build-resources/` | `entitlements.mac.plist` for Hardened Runtime |
-| `scripts/` | `build-app-icons.py`, `normalize-skiller-icon-layer.py`, `repack-dmg.sh`, `notarize.mjs` |
+| `scripts/` | `build-app-icons.py`, `normalize-skiller-icon-layer.py`, `repack-dmg.sh` |
 | `docs/DEVELOPMENT.md` | Setup, HMR, signing, CI, DMG repack — **read before changing release/signing** |
 | `DESIGN.md` | UI tokens and product design notes |
 
@@ -81,7 +81,7 @@ See `docs/DEVELOPMENT.md` for signing env vars and artifact locations.
 | `AGENTSKILLS_TRPC_PORT` | tRPC HTTP port (default `17888`; falls through to +48 on conflict) |
 | `AGENTSKILLS_DEVTOOLS` | Auto-open renderer DevTools on launch (dev only) |
 | `AGENTSKILLS_DISABLE_WINDOW_BLUR` | `1` → force vibrancy off on macOS even if settings say on |
-| `CSC_NAME`, `APPLE_API_KEY_*`, `APPLE_ID`, `APPLE_APP_SPECIFIC_PASSWORD`, `APPLE_TEAM_ID` | macOS signing + notarization. See `docs/DEVELOPMENT.md`. |
+| `CSC_NAME`, `APPLE_API_KEY`, `APPLE_API_KEY_ID`, `APPLE_API_ISSUER`, `APPLE_ID`, `APPLE_APP_SPECIFIC_PASSWORD`, `APPLE_TEAM_ID` | macOS signing + notarization. See `docs/DEVELOPMENT.md`. |
 
 ## Further reading
 

bun.lock

@@ -76,7 +76,7 @@ macOS signing + notarization:
 - `MACOS_CERT_P12_PASSWORD` — password used to export the `.p12`
 - `MACOS_KEYCHAIN_PASSWORD` — arbitrary temp-keychain password (generate any string)
 - `CSC_NAME` — full identity string (e.g. `Developer ID Application: Your Name (XXXXXXXXXX)`)
-- `APPLE_API_KEY_ISSUER` — App Store Connect → Users and Access → Integrations → App Store Connect API → Issuer ID
+- `APPLE_API_ISSUER` — App Store Connect → Users and Access → Integrations → App Store Connect API → Issuer ID
 - `APPLE_API_KEY_ID` — 10-char Key ID
 - `APPLE_API_KEY_P8` — full contents of the `AuthKey_XXXXXXXXXX.p8` file (multi-line secret)
 
@@ -109,7 +109,7 @@ Electron-builder reads these from `.env` or the shell when you run `bun run dist
 | --- | --- |
 | `CSC_NAME` | Full Developer ID identity string |
 | `APPLE_API_KEY_ID` | 10-char Key ID from App Store Connect |
-| `APPLE_API_KEY_ISSUER` | Issuer UUID |
+| `APPLE_API_ISSUER` | Issuer UUID |
 | `APPLE_API_KEY` | Absolute path to the `.p8` file (preferred for CI) |
 | — or Apple ID fallback — |
 | `APPLE_ID` | Developer Apple ID email |
@@ -119,7 +119,7 @@ Electron-builder reads these from `.env` or the shell when you run `bun run dist
 ### Flow
 
 1. `electron-vite build` — emits main + preload + renderer into `out/`.
-2. `electron-builder --mac` — creates a signed `.app` in `artifacts/mac-arm64/` and runs `scripts/notarize.mjs` as `afterSign` (notarizes + staples the app bundle).
+2. `electron-builder --mac` — creates a signed `.app` in `artifacts/mac-arm64/`, then notarizes + staples it using the API-key env vars (handled natively by electron-builder 26+; no custom afterSign hook needed).
 3. `scripts/repack-dmg.sh` — wraps the signed app in a styled drag-to-Applications DMG, re-signs the DMG wrapper, notarizes + staples the DMG.
 
 ### Verify locally
@@ -143,7 +143,7 @@ Relevant config:
 Apple returns a JSON log listing unsigned binaries or missing secure timestamps when notarization fails. Common causes:
 
 - A native addon (e.g. `better-sqlite3.node`) wasn't codesigned with `--timestamp`. `electron-builder` handles this automatically; if you add new native modules, `bunx electron-builder install-app-deps` on the target OS before dist.
-- Missing one of the three API-key vars. All three (`APPLE_API_KEY_ISSUER`, `APPLE_API_KEY_ID`, `APPLE_API_KEY`) must be present, and the `.p8` file must exist at the path in `APPLE_API_KEY`.
+- Missing one of the three API-key vars. All three (`APPLE_API_ISSUER`, `APPLE_API_KEY_ID`, `APPLE_API_KEY`) must be present, and the `.p8` file must exist at the path in `APPLE_API_KEY`.
 
 ## Renderer DevTools / blank screen debugging
 

docs/DEVELOPMENT.md

@@ -26,9 +26,11 @@ extraResources:
 asarUnpack:
   - "**/*.node"
 
-# After electron-builder signs the .app, we notarize and staple it ourselves
-# via the hook below.
-afterSign: scripts/notarize.mjs
+# Notarization: electron-builder 26+ handles it natively when the expected env
+# vars are present (APPLE_API_KEY, APPLE_API_KEY_ID, APPLE_API_ISSUER for the
+# API-key flow; APPLE_ID + APPLE_APP_SPECIFIC_PASSWORD + APPLE_TEAM_ID as
+# fallback). No afterSign hook needed — running our own notarize.mjs on top
+# would just re-submit the already-notarized bundle.
 
 mac:
   category: public.app-category.developer-tools

electron-builder.yml

@@ -62,7 +62,6 @@
   "devDependencies": {
     "@electron-toolkit/preload": "^3.0.2",
     "@electron-toolkit/utils": "^4.0.0",
-    "@electron/notarize": "^3.1.1",
     "@tailwindcss/vite": "^4.2.1",
     "@trpc/react-query": "^11.0.0",
     "@types/better-sqlite3": "^7.6.13",