From 719745c51c85f80be28dc317cee17a54f0d7627c Mon Sep 17 00:00:00 2001
From: ZhuchkaTriplesix <mrlololoshka94@gmail.com>
Date: Sat, 11 Jul 2026 16:18:11 +0300
Subject: [PATCH] ci(release): avoid secrets context in step if condition

GitHub rejects workflow parse when secrets are referenced in if:,
which blocked all Release runs (including tag 0.4.10). Gate signing
inside the step script instead.
---
 .github/workflows/release.yml | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index ff80357d..57e05ec2 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -157,7 +157,6 @@ jobs:
         run: flutter build macos --release
 
       - name: Sign and notarize macOS app
-        if: ${{ secrets.MACOS_SIGN_IDENTITY != '' && secrets.MACOS_NOTARY_KEY != '' }}
         env:
           MACOS_CERTIFICATE_P12: ${{ secrets.MACOS_CERTIFICATE_P12 }}
           MACOS_CERTIFICATE_PASSWORD: ${{ secrets.MACOS_CERTIFICATE_PASSWORD }}
@@ -168,6 +167,10 @@ jobs:
           MACOS_KEYCHAIN_PASSWORD: ${{ secrets.MACOS_KEYCHAIN_PASSWORD }}
         run: |
           set -euo pipefail
+          if [ -z "${MACOS_SIGN_IDENTITY:-}" ] || [ -z "${MACOS_NOTARY_KEY:-}" ]; then
+            echo "Skipping macOS signing/notarization — secrets not configured."
+            exit 0
+          fi
           APP="build/macos/Build/Products/Release/querya_desktop.app"
           test -d "$APP"