coder/meetingnotes
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 34 Wiki Activity

fix: isolate CI Keychain access from the production app
Build / macos (push) Successful in 27s
Details

Browse Source
This commit is contained in:
coder
2026-09-10 00:33:30 +02:00
parent 31584792e6
commit 7584863392
3 changed files with 30 additions and 35 deletions
Download Patch File Download Diff File Expand all files Collapse all files
README.md
+3 -2
View File
@@ -88,8 +88,9 @@ identity keeps the same sandbox container across updates.
`.gitea/workflows/build.yml` builds universal macOS artifacts for pushes and pull
requests to `main`. The repository-scoped `mac-mini-meetingnotes` runner uses the
`macos-arm64` label. Smoke tests use a separate CI bundle identifier and temporary
launch preferences, an internal-volume staging directory, and Launch Services
so the GUI app runs in the logged-in Mac session. Release jobs import the original Developer ID certificate
launch preferences and an internal-volume staging directory. Keychain services
follow the bundle identifier, so CI never reads production credentials; the smoke
test removes its isolated API token before and after each launch. Release jobs import the original Developer ID certificate
into a temporary keychain and keep the original Sparkle signing key in Gitea
Actions secrets. They never publish from a development branch.