Merge nucleic/vivid-glass-urchin-xoym into main

2026-08-07 15:41:01 -07:00
parent 6b0c01b74b
commit 902bea5091
11 changed files with 450 additions and 91 deletions
@@ -44,10 +44,13 @@ jobs:
      - name: unit tests
        run: swift test

-      # Release build, .app assembly, ad-hoc signature. `codesign --sign -`
-      # needs no signing identity and no keychain, so it works unattended in a
-      # throwaway guest — which is the same property that makes it the
-      # project's shipping signature.
+      # Release build, .app assembly, signature. `make sign` looks for a
+      # Developer ID identity and falls back to ad-hoc when there is none — which
+      # is always the case here, since this runs in a throwaway guest with no
+      # keychain and no certificate. That fallback is why this step works
+      # unattended, and it is deliberately not treated as a failure: the point of
+      # the CI signature is to prove the entitlement survives, not to produce a
+      # distributable artifact. Release builds are signed on a real host.
      - name: build and sign the app bundle
        run: make all