ci: create notarytool profile in CI temp keychain

Fix: the previous release workflow assumed 'xcrun notarytool
submit --keychain-profile' could read the profile from any
keychain, but notarytool looks for the profile in the keychain
search list. The CI temp keychain doesn't have the profile
(it lives in the developer's local login keychain).

Solution: CI now uses 3 additional secrets to recreate the
profile in the temp keychain after importing the .p12:

  MACOS_KEYCHAIN_PROFILE    profile name (e.g. 'ado-notary')
  MACOS_NOTARY_APPLE_ID     Apple ID used for the profile
  MACOS_NOTARY_TEAM_ID      Team ID (defaults to 87R27UKGSF in CI)
  MACOS_NOTARY_PASSWORD     app-specific password from appleid.apple.com

Updated:
- ci.yml: Notarize step now does 'xcrun notarytool
  store-credentials' to recreate the profile in the temp
  keychain, then uses --keychain-profile to submit.
- SIGNING.md: documents all 7 secrets
- bin/setup-gh-secrets.sh: prompts for the 3 new notarytool
  secrets interactively (4/7, 5/7, 6/7, 7/7)

Author: gilbertwong96

.github/workflows/ci.yml

@@ -417,20 +417,38 @@ jobs:
       - name: Notarize macOS binary
         if: matrix.sign == 'true'
         env:
+          # Profile name + the underlying Apple ID + app-specific password
+          # needed to recreate the profile in the temp keychain.
+          # (The profile itself only lives in the developer's local
+          # keychain; the CI runner has its own fresh keychain.)
           MACOS_KEYCHAIN_PROFILE: ${{ secrets.MACOS_KEYCHAIN_PROFILE }}
+          MACOS_NOTARY_APPLE_ID: ${{ secrets.MACOS_NOTARY_APPLE_ID }}
+          MACOS_NOTARY_TEAM_ID: ${{ secrets.MACOS_NOTARY_TEAM_ID || '87R27UKGSF' }}
+          MACOS_NOTARY_PASSWORD: ${{ secrets.MACOS_NOTARY_PASSWORD }}
         run: |
           set -euo pipefail
-          if [[ -z "${MACOS_KEYCHAIN_PROFILE}" ]]; then
-            echo "::warning::MACOS_KEYCHAIN_PROFILE secret not set; skipping notarization."
+          BINARY=$(ls release_bin/ado-*)
+          if [[ -z "${MACOS_KEYCHAIN_PROFILE}" || -z "${MACOS_NOTARY_APPLE_ID}" || -z "${MACOS_NOTARY_PASSWORD}" ]]; then
+            echo "::warning::MACOS_KEYCHAIN_PROFILE / MACOS_NOTARY_APPLE_ID / MACOS_NOTARY_PASSWORD secrets not set; skipping notarization."
             echo "::warning::Signed binary is OK for local use but Gatekeeper will warn on first run."
             exit 0
           fi
-          BINARY=$(ls release_bin/ado-*)
+          if [[ ! -f "$MACOS_KEYCHAIN_PATH" ]]; then
+            echo "::warning::No keychain (cert secrets not set); skipping notarization."
+            exit 0
+          fi
+          echo "Recreating notarytool profile '$MACOS_KEYCHAIN_PROFILE' in temp keychain"
+          xcrun notarytool store-credentials "$MACOS_KEYCHAIN_PROFILE" \
+            --apple-id "$MACOS_NOTARY_APPLE_ID" \
+            --team-id "$MACOS_NOTARY_TEAM_ID" \
+            --password "$MACOS_NOTARY_PASSWORD" \
+            --keychain "$MACOS_KEYCHAIN_PATH" \
+            --keychain-password "$MACOS_KEYCHAIN_PASSWORD"
           echo "Submitting for notarization (profile: $MACOS_KEYCHAIN_PROFILE)"
           xcrun notarytool submit "$BINARY" \
             --keychain-profile "$MACOS_KEYCHAIN_PROFILE" \
             --keychain "$MACOS_KEYCHAIN_PATH" \
-            --keychain-profile-password "$MACOS_KEYCHAIN_PASSWORD" \
+            --keychain-password "$MACOS_KEYCHAIN_PASSWORD" \
             --wait
           echo "Stapling notarization ticket"
           xcrun stapler staple "$BINARY"

SIGNING.md

@@ -99,6 +99,15 @@ Go to
 | `MACOS_CERT_P12_BASE64` | Base64-encoded `.p12` export of the Developer ID cert (see below) |
 | `MACOS_CERT_P12_PASSWORD` | The password you set when exporting the `.p12` |
 | `MACOS_KEYCHAIN_PROFILE` | The name of the notarytool profile (e.g. `ado-notary`) |
+| `MACOS_NOTARY_APPLE_ID` | The Apple ID used to create the profile (e.g. `you@example.com`) |
+| `MACOS_NOTARY_TEAM_ID` | (Optional) Team ID. Defaults to `87R27UKGSF` if unset. Override if your team ID differs. |
+| `MACOS_NOTARY_PASSWORD` | The app-specific password from <https://appleid.apple.com> used by the notarytool profile |
+
+> **Why 3 notarytool secrets?** The profile you create locally lives in
+> your login keychain. CI runs on a fresh macOS runner with an empty
+> keychain, so the workflow recreates the profile in its temp keychain
+> using the Apple ID + app-specific password. The profile name
+> (`ado-notary`) is the same on both sides.
 
 ### One-time: export the .p12 for CI
 

bin/setup-gh-secrets.sh

@@ -11,6 +11,9 @@
 #   MACOS_CERT_P12_PASSWORD   the .p12's export password
 #   MACOS_KEYCHAIN_PROFILE    name of a notarytool keychain profile
 #                             (set up with `xcrun notarytool store-credentials`)
+#   MACOS_NOTARY_APPLE_ID     Apple ID used by the notarytool profile
+#   MACOS_NOTARY_TEAM_ID      Team ID (10-char alphanumeric; defaults in CI)
+#   MACOS_NOTARY_PASSWORD     App-specific password for the Apple ID
 #
 # USAGE:
 #   bin/setup-gh-secrets.sh                              # interactive
@@ -20,6 +23,7 @@
 #   - gh CLI authenticated with repo:admin scope
 #   - A Developer ID Application certificate in your keychain
 #     (for the .p12 export)
+#   - A notarytool keychain profile (for the profile name)
 set -euo pipefail
 
 # ── Resolve repo ─────────────────────────────────────────────────────────
@@ -100,7 +104,7 @@ echo
 
 # ── MACOS_KEYCHAIN_PROFILE ──────────────────────────────────────────────
 
-echo "==> 4/4 MACOS_KEYCHAIN_PROFILE"
+echo "==> 4/7 MACOS_KEYCHAIN_PROFILE"
 if [[ -n "${MACOS_KEYCHAIN_PROFILE:-}" ]]; then
   echo "  using env var (value hidden)"
 else
@@ -115,6 +119,46 @@ fi
 set_secret MACOS_KEYCHAIN_PROFILE "notarytool keychain profile name (e.g. 'ado-notary')"
 echo
 
+# ── MACOS_NOTARY_APPLE_ID ──────────────────────────────────────────────
+
+echo "==> 5/7 MACOS_NOTARY_APPLE_ID"
+if [[ -n "${MACOS_NOTARY_APPLE_ID:-}" ]]; then
+  echo "  using env var (value hidden)"
+else
+  echo "  The Apple ID used to create the notarytool profile above."
+  echo "  (Same email you passed to 'xcrun notarytool store-credentials')"
+fi
+set_secret MACOS_NOTARY_APPLE_ID "Apple ID (e.g. you@example.com)"
+echo
+
+# ── MACOS_NOTARY_TEAM_ID ───────────────────────────────────────────────
+
+echo "==> 6/7 MACOS_NOTARY_TEAM_ID"
+if [[ -n "${MACOS_NOTARY_TEAM_ID:-}" ]]; then
+  echo "  using env var (value hidden)"
+else
+  echo "  Your Apple Developer Team ID (10-char alphanumeric)."
+  echo "  Find yours at https://developer.apple.com/account under Membership,"
+  echo "  or use the 10-char suffix of your signing identity, e.g."
+  echo "  'Developer ID Application: Your Name (ABCDE12345)' → ABCDE12345"
+fi
+set_secret MACOS_NOTARY_TEAM_ID "Team ID (10-char alphanumeric, e.g. ABCDE12345)"
+echo
+
+# ── MACOS_NOTARY_PASSWORD ──────────────────────────────────────────────
+
+echo "==> 7/7 MACOS_NOTARY_PASSWORD"
+if [[ -n "${MACOS_NOTARY_PASSWORD:-}" ]]; then
+  echo "  using env var (value hidden)"
+else
+  echo "  The app-specific password from https://appleid.apple.com"
+  echo "  that you used when creating the notarytool profile."
+  echo "  (NOT your Apple ID password — must be a generated"
+  echo "   app-specific password, e.g. 'abcd-efgh-ijkl-mnop')"
+fi
+set_secret MACOS_NOTARY_PASSWORD "app-specific password (e.g. abcd-efgh-ijkl-mnop)"
+echo
+
 # ── Summary ──────────────────────────────────────────────────────────────
 
 echo "==> All secrets set for $REPO"