Repository navigation
Unlock the signing keychain inside the package job - #72
Merged
Merged
Conversation
The macOS runner was replaced on 2026-10-05 (MacMiniM6_01). It keeps GitHub's default SessionCreate = true, so each job runs in its own security session and finds the login keychain locked: v1.9.2's package job failed with "no identity found". package.yml now unlocks the keychain with the MACOS_KEYCHAIN_PASSWORD org secret and locks it again at the end; release.yml passes the secret through. A manual run of package.yml now takes a tag, so a release whose package job failed can get its files. The notary profile is now made from the App Store Connect API key; the app-specific password failed with 401.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
On 2026-10-05 an Apple M6 Mac mini (
MacMiniM6_01) replaced the macOS runner. Its LaunchAgent keeps GitHub's defaultSessionCreate = true, so every job runs in its own security session and finds the login keychain locked. The old runner usedSessionCreate = false.A comment-only commit pushed straight to
mainthat day (2e4f73c) cut v1.9.2. Its package job then failed in Build monitor.app:So v1.9.2 is published with no files attached.
Change
package.yml: unlocks the login keychain with theMACOS_KEYCHAIN_PASSWORDorg secret before it builds, whenSIGN_IDENTITYis set, and locks it again in analways()last step. It declares the secret forworkflow_call.release.yml: passes the secret topackage.yml. A called workflow sees no secrets otherwise.package.ymlmanual runs take an optionaltag, so a release whose package job failed can get its files. After merge:gh workflow run package.yml -R evanwtf/monitor -f tag=v1.9.2.AGENTS.mdanddocs/signing.md: describe the in-job unlock in place ofSessionCreate = false. The notary profile is now made from the App Store Connect API key; the app-specific password failed with HTTP 401.The same unlock landed in fancontrol's
release.yml(39433e3). The secret is an org secret, visible only to fancontrol and monitor.Test plan
gh workflow run package.yml -R evanwtf/monitor -f tag=v1.9.2. It unlocks, signs, notarizes, attaches the files to v1.9.2, and locks the keychain again.