Let electron-builder find the signing identity in signed Mac builds (#5 )

CSC_IDENTITY_AUTO_DISCOVERY=false was set for every Mac build. With it, electron-builder imports CSC_LINK into its keychain but won't look the identity up, so the v0.0.3 build skipped signing and failed the signature check. It's now set only for unsigned builds. Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Pin electron-builder to ^26.17 to fix macOS signing on macos-26 runners (#4 )
2026-10-17 16:02:31 +02:00 · 2026-10-07 23:01:44 +01:00 · 2026-10-07 22:42:56 +01:00 · 2026-10-07 22:20:32 +01:00 · 2026-10-07 22:12:19 +01:00 · 2026-10-07 22:09:24 +01:00
12 changed files with 244 additions and 122 deletions
@@ -1,12 +1,13 @@
 name: Build

-# Every push and pull request: check the code, then build installers for each
+# Every push to main and every pull request: check the code, then build installers for each
 # platform and attach them to the run as artifacts. The release workflow calls
 # this same file with a version to stamp into the app.
 on:
+  # Pushes to main, plus pull requests. Branch pushes aren't built separately, so a
+  # pull request's commits run once (as pull_request), not twice.
  push:
-    branches: ["**"]
-    tags-ignore: ["**"]
+    branches: [main]
  pull_request:
  workflow_call:
    inputs:
@@ -18,6 +19,10 @@ on:
        description: Commit to build.
        type: string
        default: ""
+      sign_mac:
+        description: Sign and notarize the macOS build (needs the release-signing environment).
+        type: boolean
+        default: false

 concurrency:
  group: build-${{ github.workflow }}-${{ inputs.ref || github.ref }}
@@ -56,9 +61,6 @@ jobs:
      fail-fast: false
      matrix:
        include:
-          - name: macOS
-            os: macos-latest
-            args: --mac --arm64 --x64
          - name: Windows
            os: windows-latest
            args: --win --x64
@@ -98,7 +100,7 @@ jobs:
          CSC_IDENTITY_AUTO_DISCOVERY: "false"
        run: |
          pnpm build
-          pnpm exec electron-builder ${{ matrix.args }} --publish never
+          pnpm exec electron-builder --config electron-builder.config.cjs ${{ matrix.args }} --publish never
      - uses: actions/upload-artifact@v4
        with:
          name: frameloader-${{ matrix.os }}
@@ -109,3 +111,75 @@ jobs:
            apps/desktop/release/*.AppImage
            apps/desktop/release/*.deb
          if-no-files-found: error
+
+  # macOS is its own job so release builds can run inside the protected
+  # release-signing environment (approval required, v* tags only), which holds
+  # the Developer ID certificate and the notarization key. Pushes and pull
+  # requests never touch it and produce ad-hoc signed builds.
+  package-mac:
+    name: Package (macOS${{ inputs.sign_mac && ', signed' || '' }})
+    needs: check
+    runs-on: macos-latest
+    environment: ${{ inputs.sign_mac && 'release-signing' || '' }}
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          ref: ${{ inputs.ref || github.sha }}
+      - uses: pnpm/action-setup@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 24
+          cache: pnpm
+      - run: pnpm install --frozen-lockfile
+      - name: Stamp version
+        if: inputs.version != ''
+        run: node scripts/version.mjs set "${{ inputs.version }}"
+      # Signing secrets live only in this step's environment, never in GITHUB_ENV, so no
+      # later step or action (artifact upload, post steps) can read them. They're exported
+      # only for signed builds: electron-builder treats an empty CSC_LINK as a file path.
+      - name: Build installers
+        working-directory: apps/desktop
+        env:
+          SIGN_MAC: ${{ inputs.sign_mac }}
+          SIGN_CSC_LINK: ${{ secrets.CSC_LINK }}
+          SIGN_CSC_KEY_PASSWORD: ${{ secrets.CSC_KEY_PASSWORD }}
+          SIGN_APPLE_API_KEY: ${{ secrets.APPLE_API_KEY }}
+          SIGN_APPLE_API_KEY_ID: ${{ secrets.APPLE_API_KEY_ID }}
+          SIGN_APPLE_API_ISSUER: ${{ secrets.APPLE_API_ISSUER }}
+        run: |
+          if [ "$SIGN_MAC" = "true" ]; then
+            for name in SIGN_CSC_LINK SIGN_CSC_KEY_PASSWORD SIGN_APPLE_API_KEY SIGN_APPLE_API_KEY_ID SIGN_APPLE_API_ISSUER; do
+              if [ -z "${!name}" ]; then
+                echo "::error::release-signing secret ${name#SIGN_} is missing. See README → Signing."
+                exit 1
+              fi
+            done
+            key_file="$RUNNER_TEMP/notary.p8"
+            printf '%s' "$SIGN_APPLE_API_KEY" > "$key_file"
+            trap 'rm -f "$key_file"' EXIT
+            export CSC_LINK="$SIGN_CSC_LINK" CSC_KEY_PASSWORD="$SIGN_CSC_KEY_PASSWORD"
+            export APPLE_API_KEY="$key_file" APPLE_API_KEY_ID="$SIGN_APPLE_API_KEY_ID" APPLE_API_ISSUER="$SIGN_APPLE_API_ISSUER"
+          else
+            # Unsigned (ad-hoc) build: don't let electron-builder look for a certificate.
+            # Not set for signed builds: with it, electron-builder imports CSC_LINK but then
+            # won't look the identity up, and silently skips signing.
+            export CSC_IDENTITY_AUTO_DISCOVERY=false
+          fi
+          unset SIGN_CSC_LINK SIGN_CSC_KEY_PASSWORD SIGN_APPLE_API_KEY SIGN_APPLE_API_KEY_ID SIGN_APPLE_API_ISSUER
+          pnpm build
+          pnpm exec electron-builder --config electron-builder.config.cjs --mac --arm64 --x64 --publish never
+      - name: Check signature
+        if: inputs.sign_mac
+        working-directory: apps/desktop
+        run: |
+          app="release/mac-arm64/Frameloader.app"
+          codesign --verify --deep --strict --verbose=2 "$app"
+          spctl --assess --type execute --verbose=2 "$app"
+          xcrun stapler validate "$app"
+      - uses: actions/upload-artifact@v4
+        with:
+          name: frameloader-macos
+          path: |
+            apps/desktop/release/*.dmg
+            apps/desktop/release/*.zip
+          if-no-files-found: error
@@ -37,9 +37,11 @@ jobs:
    name: Build
    needs: prepare
    uses: ./.github/workflows/build.yml
+    secrets: inherit
    with:
      version: ${{ needs.prepare.outputs.version }}
      ref: refs/tags/${{ github.event.release.tag_name }}
+      sign_mac: true

  attach:
    name: Attach installers to the release
@@ -1,3 +1,7 @@
+<p align="center">
+  <img src="apps/desktop/build/icon.png" alt="Frameloader logo" width="160" />
+</p>
+
 # Frameloader

 [www.frameloader.com](https://www.frameloader.com)
@@ -64,7 +68,7 @@ Frameloader has no analytics, telemetry, crash reporting or accounts. It connect

 ## Builds and releases

-Every push and pull request runs `.github/workflows/build.yml`: typecheck, tests, the website build, then installers for macOS (arm64 and x64), Windows x64, and Linux x64 and arm64. The installers are attached to the run as artifacts.
+Every push to `main` and every pull request runs `.github/workflows/build.yml`: typecheck, tests, the website build, then installers for macOS (arm64 and x64), Windows x64, and Linux x64 and arm64. The installers are attached to the run as artifacts.

 To ship a release:

@@ -74,7 +78,7 @@ To ship a release:

 Nothing is pushed to `main`, so this works with branch protection. The version in `apps/desktop/package.json` is only what local and CI builds report; releases take their version from the tag.

-Builds are not code-signed yet. On macOS the app is ad-hoc signed, so the first launch needs right-click → Open (or `xattr -dr com.apple.quarantine /Applications/Frameloader.app`). Windows SmartScreen will warn until the installer is signed.
+**Signing.** Release builds of the Mac app are signed with a Developer ID certificate and notarized, so they open normally. The certificate and the App Store Connect notarization key live only in the `release-signing` GitHub environment as `CSC_LINK`, `CSC_KEY_PASSWORD`, `APPLE_API_KEY`, `APPLE_API_KEY_ID` and `APPLE_API_ISSUER`. That environment only accepts `v*` tags and needs approval, so the release run pauses until you approve it. Push and pull-request builds are ad-hoc signed; to open one on macOS 15 or later, use System Settings → Privacy & Security → Open Anyway, or run `xattr -dr com.apple.quarantine /Applications/Frameloader.app`. Windows builds are unsigned, so SmartScreen warns before the installer runs.

 Installed apps notice new releases on their own: they check GitHub's releases API and show a banner with a link once a release has its installers attached. Nothing is downloaded or installed automatically, and Settings → Updates turns the check off.

@@ -0,0 +1,11 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+  <!-- V8's JIT needs these under the hardened runtime. -->
+  <key>com.apple.security.cs.allow-jit</key>
+  <true/>
+  <key>com.apple.security.cs.allow-unsigned-executable-memory</key>
+  <true/>
+</dict>
+</plist>
@@ -0,0 +1,85 @@
+// electron-builder config. Pass with: electron-builder --config electron-builder.config.cjs
+//
+// macOS signing depends on the environment:
+// - Release builds (the release-signing GitHub environment) set CSC_LINK, so the app is
+//   signed with the Developer ID certificate, uses the hardened runtime, and is notarized
+//   with the App Store Connect key (APPLE_API_KEY / APPLE_API_KEY_ID / APPLE_API_ISSUER).
+// - Everything else (local builds, pushes, pull requests) is ad-hoc signed.
+const signed = Boolean(process.env.CSC_LINK);
+
+const base = {
+  "appId": "dev.traveler.frameloader",
+  "productName": "Frameloader",
+  "directories": {
+    "output": "release",
+    "buildResources": "build"
+  },
+  "files": [
+    "dist/**/*",
+    "package.json",
+    "!dist/test/**",
+    "!dist/**/*.map"
+  ],
+  "extraResources": [
+    {
+      "from": "vendor/devkit-utils",
+      "to": "devkit-utils",
+      "filter": [
+        "**/*",
+        "!**/__pycache__/**"
+      ]
+    }
+  ],
+  "mac": {
+    "category": "public.app-category.utilities",
+    "target": [
+      "dmg",
+      "zip"
+    ],
+    "artifactName": "Frameloader-mac-${arch}.${ext}",
+    "extendInfo": {
+      "NSLocalNetworkUsageDescription": "Frameloader connects to your Steam Frame on your local network to install and launch apps.",
+      "NSBonjourServices": [
+        "_steamos-devkit._tcp",
+        "_ssh._tcp"
+      ]
+    }
+  },
+  "win": {
+    "target": [
+      "nsis",
+      "zip"
+    ],
+    "artifactName": "Frameloader-win-${arch}.${ext}"
+  },
+  "nsis": {
+    "oneClick": false,
+    "perMachine": false,
+    "allowToChangeInstallationDirectory": true
+  },
+  "linux": {
+    "target": [
+      "AppImage",
+      "deb"
+    ],
+    "category": "Utility",
+    "artifactName": "Frameloader-linux-${arch}.${ext}",
+    "executableName": "frameloader"
+  },
+  "electronVersion": "44.5.1"
+};
+
+module.exports = {
+  ...base,
+  mac: {
+    ...base.mac,
+    ...(signed
+      ? {
+          hardenedRuntime: true,
+          entitlements: "build/entitlements.mac.plist",
+          entitlementsInherit: "build/entitlements.mac.plist",
+          notarize: true,
+        }
+      : { identity: "-", hardenedRuntime: false }),
+  },
+};
@@ -4,7 +4,10 @@
  "version": "0.0.1",
  "description": "Drop an APK, Windows app, or Linux build onto your Steam Frame and it shows up in your Steam library.",
  "license": "MIT",
-  "author": "Zack <zack@traveler.dev>",
+  "author": {
+    "name": "Traveler Dev Ltd",
+    "email": "hi@traveler.dev"
+  },
  "private": true,
  "main": "dist/main.cjs",
  "type": "module",
@@ -14,88 +17,31 @@
    "start": "pnpm build && electron .",
    "typecheck": "tsc -p tsconfig.main.json --noEmit && tsc -p tsconfig.renderer.json --noEmit",
    "test": "pnpm build && node --test dist/test/*.test.cjs",
-    "dist": "pnpm build && electron-builder --publish never",
-    "dist:mac": "pnpm build && electron-builder --mac --arm64 --publish never",
-    "dist:win": "pnpm build && electron-builder --win --x64 --publish never",
-    "dist:linux": "pnpm build && electron-builder --linux --x64 --arm64 --publish never",
+    "dist": "pnpm build && electron-builder --config electron-builder.config.cjs --publish never",
+    "dist:mac": "pnpm build && electron-builder --config electron-builder.config.cjs --mac --arm64 --publish never",
+    "dist:win": "pnpm build && electron-builder --config electron-builder.config.cjs --win --x64 --publish never",
+    "dist:linux": "pnpm build && electron-builder --config electron-builder.config.cjs --linux --x64 --arm64 --publish never",
    "screenshots": "pnpm build && electron scripts/screenshot.cjs"
  },
  "devDependencies": {
-    "frameloader-tokens": "workspace:*",
    "@types/multicast-dns": "^7.2.4",
    "@types/node": "^24.0.0",
    "@types/ssh2": "^1.15.6",
    "@types/yauzl": "^2.10.3",
    "app-info-parser": "^1.1.6",
    "electron": "44.5.1",
-    "electron-builder": "^26.15.3",
+    "electron-builder": "^26.17.0",
    "esbuild": "^0.28.2",
+    "frameloader-tokens": "workspace:*",
    "multicast-dns": "^7.2.5",
    "ssh2": "^1.17.0",
    "typescript": "^7.0.2",
    "yauzl": "^3.2.0"
  },
-  "build": {
-    "appId": "dev.traveler.frameloader",
-    "productName": "Frameloader",
-    "directories": {
-      "output": "release",
-      "buildResources": "build"
-    },
-    "files": [
-      "dist/**/*",
-      "package.json",
-      "!dist/test/**",
-      "!dist/**/*.map"
-    ],
-    "extraResources": [
-      {
-        "from": "vendor/devkit-utils",
-        "to": "devkit-utils",
-        "filter": [
-          "**/*",
-          "!**/__pycache__/**"
-        ]
-      }
-    ],
-    "mac": {
-      "category": "public.app-category.utilities",
-      "target": [
-        "dmg",
-        "zip"
-      ],
-      "artifactName": "Frameloader-mac-${arch}.${ext}",
-      "identity": "-",
-      "hardenedRuntime": false
-    },
-    "win": {
-      "target": [
-        "nsis",
-        "zip"
-      ],
-      "artifactName": "Frameloader-win-${arch}.${ext}"
-    },
-    "nsis": {
-      "oneClick": false,
-      "perMachine": false,
-      "allowToChangeInstallationDirectory": true
-    },
-    "linux": {
-      "target": [
-        "AppImage",
-        "deb"
-      ],
-      "category": "Utility",
-      "artifactName": "Frameloader-linux-${arch}.${ext}",
-      "executableName": "frameloader"
-    },
-    "electronVersion": "44.5.1"
-  },
  "homepage": "https://www.frameloader.com",
  "repository": {
    "type": "git",
    "url": "https://github.com/travelerdev/frameloader.git",
    "directory": "apps/desktop"
-  },
-  "dependencies": {}
+  }
 }
@@ -4,6 +4,10 @@
  "private": true,
  "description": "The Frameloader website.",
  "license": "MIT",
+  "author": {
+    "name": "Traveler Dev Ltd",
+    "email": "hi@traveler.dev"
+  },
  "type": "module",
  "scripts": {
    "dev": "vite",
@@ -2,6 +2,10 @@
  "name": "frameloader-monorepo",
  "private": true,
  "license": "MIT",
+  "author": {
+    "name": "Traveler Dev Ltd",
+    "email": "hi@traveler.dev"
+  },
  "packageManager": "pnpm@11.24.0",
  "scripts": {
    "build": "pnpm -r build",
@@ -4,6 +4,10 @@
  "private": true,
  "description": "Shared color, type and shape tokens for the Frameloader app and website.",
  "license": "MIT",
+  "author": {
+    "name": "Traveler Dev Ltd",
+    "email": "hi@traveler.dev"
+  },
  "exports": {
    "./tokens.css": "./tokens.css"
  },
@@ -33,8 +33,8 @@ importers:
        specifier: 44.5.1
        version: 44.5.1(supports-color@10.2.2)
      electron-builder:
-        specifier: ^26.15.3
-        version: 26.15.3(electron-builder-squirrel-windows@26.15.3)(supports-color@10.2.2)
+        specifier: ^26.17.0
+        version: 26.17.0(electron-builder-squirrel-windows@26.17.0)(supports-color@10.2.2)
      esbuild:
        specifier: ^0.28.2
        version: 0.28.2
@@ -665,10 +665,6 @@ packages:
    resolution: {integrity: sha512-jCs9ldd7NwzpgXDIf6P3+NrHh9/sD6CQdxHyjQI+h/6rDNo88ypBxxz45UDuZHz9r3tNz7N/VInSVoVdtXEI4A==}
    engines: {node: ^14.21.3 || >=16}

-  '@noble/hashes@2.4.0':
-    resolution: {integrity: sha512-X5XaVWZIBCT7HHZGm5I7ZQXDwLG+bGXuSrMQAW+7Zvl87h1kmc1ZB1VSRJcpUfoUrGQp4Fkoxm5kZ+Ms+aW+eA==}
-    engines: {node: '>= 20.19.0'}
-
  '@oxc-project/types@0.152.0':
    resolution: {integrity: sha512-oM/5rLBm2tPkg0iBgkH/FOeR3PCDpY19GTgAZjMFM8h9WI9VW7cLgzp6nwtarYKmovavIQZ+Fe/RKX/8C8O/Rw==}

@@ -992,12 +988,12 @@ packages:
    resolution: {integrity: sha512-zbB9rCJAT1rbjiVDb2hqKFHNYLxgtk8NURxZ3IZwD3F6NtxbXZQCnnSi1Lkx+IDohdPlFp222wVALIheZJQSEg==}
    engines: {node: '>=8'}

-  app-builder-lib@26.15.3:
-    resolution: {integrity: sha512-2VnyWkqsP5v5XbBhL3tD5Syx8iNPBYsoU7kY4S2fz7wg8Rj/nztWKCUzGKaFRTv0Xwf3/H058CR1Kvtd/3lRow==}
+  app-builder-lib@26.17.0:
+    resolution: {integrity: sha512-wfL7EhujuODDW3uMSD8RPcr/MLzmT0dmpVfWV0wFUWXI0rIdaukzAJ7EFUSyHXOpxuBZqaIGlQt6VeQhtHhetw==}
    engines: {node: '>=14.0.0'}
    peerDependencies:
-      dmg-builder: 26.15.3
-      electron-builder-squirrel-windows: 26.15.3
+      dmg-builder: 26.17.0
+      electron-builder-squirrel-windows: 26.17.0

  app-info-parser@1.1.6:
    resolution: {integrity: sha512-ZAFCM0bN88cbpsMoRhL/JfdX3b+nb5iBEXcu30xABvbaqtw6tXfHujDnuKSpNmA3P0uwpkIxTV/Wun5HfEch8A==}
@@ -1091,8 +1087,8 @@ packages:
    resolution: {integrity: sha512-g/kR520giAFYkSXTzcmF3kqQq7wi8F6N6SzeDgZrqTBN+VHdmgWOyTdD1yD7AATDId/yXLvuP34CxW46/BwCdw==}
    engines: {node: '>=12.0.0'}

-  builder-util@26.15.3:
-    resolution: {integrity: sha512-q2hn7Mbo2nFNkVekPiHFx6Nfo3hURmES3tfBn+k5Pqxl2RkmP3QGqZUhH/q9Pch/4G05NRhPjDlVj1O8q4Txvw==}
+  builder-util@26.16.0:
+    resolution: {integrity: sha512-RLyJhB7Si3YkzKR9ubQslWuXW3Vhs3CGe1i+SeixBZ0qTd1mk3XBmssvY22TlB6CS5blyko8Gu1JzpYk8UkYAg==}
    engines: {node: '>=14.0.0'}

  bytebuffer@5.0.1:
@@ -1234,8 +1230,8 @@ packages:
  dir-compare@4.2.0:
    resolution: {integrity: sha512-2xMCmOoMrdQIPHdsTawECdNPwlVFB9zGcz3kuhmBO6U3oU+UQjsue0i8ayLKpgBcm+hcXPMVSGUN9d+pvJ6+VQ==}

-  dmg-builder@26.15.3:
-    resolution: {integrity: sha512-O3zJUFUYHJKgzPqioHxfxzBzlSC1eXCSr79gMSBKBP5AgjjpmrydMsMLotEg9fAJF36vdUncb+4ndRNxoPdlSQ==}
+  dmg-builder@26.17.0:
+    resolution: {integrity: sha512-EAw1f2iGkICmUvAVBOjm7v5mxJdB7/+OZSycHFhKBimiTkCXtvkCC6wBKzHo7ZQYi58C2MmwIleRbgRnROlK2Q==}

  dns-packet@5.6.1:
    resolution: {integrity: sha512-l4gcSouhcgIKRvyy99RNVOgxXiicE+2jZoNmaNmZ6JXiGajBOJAesk1OBlJuM5k2c+eudGdLxDqXuPCKIj6kpw==}
@@ -1261,16 +1257,16 @@ packages:
    engines: {node: '>=0.10.0'}
    hasBin: true

-  electron-builder-squirrel-windows@26.15.3:
-    resolution: {integrity: sha512-Jc19XPV9y9+2bAdZPkXuVNGNIEFBq9poHC61l8Kv6FdK7DRG3+Ic0rerC0DXOaeHNz8yW0fg/JnF8GQROOF5MA==}
+  electron-builder-squirrel-windows@26.17.0:
+    resolution: {integrity: sha512-uyh+D+B0m12qCRp9c/7dwBirHTh7JcvAzj5eTEbb4dXPPGAhYPx1nozzbu1fC6AdULfat6ZNqgWhipTFpb82lQ==}

-  electron-builder@26.15.3:
-    resolution: {integrity: sha512-a1KM5heqS3gQCZzizXEI8RjJy3QVogULPdeSknt76uLDpBIW/HDGsMg/XgP0riP6PI9COsRvFITKKGDqA8fJxA==}
+  electron-builder@26.17.0:
+    resolution: {integrity: sha512-iYHBRiagS9sDIbZx1ZD113f5rEGQvtpvTvHf70ovHKJ8mRvxwIkWX7JCwfmVQmVS4eX735p7TZmoxHnBPwF3vA==}
    engines: {node: '>=14.0.0'}
    hasBin: true

-  electron-publish@26.15.3:
-    resolution: {integrity: sha512-g/2bn8YTavY4cuS5F+jOS7zmZbXXBV8KZ8yHKfJjFPoKtzBqrpCdNPxBd3tqdBwP7BVd0lGzf7Bk2s0KesWZ4Q==}
+  electron-publish@26.16.0:
+    resolution: {integrity: sha512-Vt3KzQIiw9BImvNOYtndg9Mjki+tl4+1sQiC/+G5j8khWaENOJFWodiB+sUl6yyHwtd37avehskdtPw7f8y/+Q==}

  electron-winstaller@5.4.0:
    resolution: {integrity: sha512-bO3y10YikuUwUuDUQRM4KfwNkKhnpVO7IPdbsrejwN9/AABJzzTQ4GeHwyzNSrVO+tEH3/Np255a3sVZpZDjvg==}
@@ -2283,7 +2279,7 @@ snapshots:

  '@electron/get@5.1.0(supports-color@10.2.2)':
    dependencies:
-      debug: 4.4.3(supports-color@7.2.0)
+      debug: 4.4.3(supports-color@10.2.2)
      env-paths: 3.0.0
      graceful-fs: 4.2.11
      progress: 2.0.3
@@ -2644,8 +2640,6 @@ snapshots:

  '@noble/hashes@1.8.0': {}

-  '@noble/hashes@2.4.0': {}
-
  '@oxc-project/types@0.152.0': {}

  '@peculiar/asn1-schema@2.10.0':
@@ -2870,7 +2864,7 @@ snapshots:
    dependencies:
      color-convert: 2.0.1

-  app-builder-lib@26.15.3(dmg-builder@26.15.3)(electron-builder-squirrel-windows@26.15.3)(supports-color@10.2.2):
+  app-builder-lib@26.17.0(dmg-builder@26.17.0)(electron-builder-squirrel-windows@26.17.0)(supports-color@10.2.2):
    dependencies:
      '@electron/asar': 3.4.1
      '@electron/fuses': 1.8.0
@@ -2880,23 +2874,23 @@ snapshots:
      '@electron/rebuild': 4.2.0(supports-color@10.2.2)
      '@electron/universal': 2.0.3(supports-color@10.2.2)
      '@malept/flatpak-bundler': 0.4.0(supports-color@10.2.2)
-      '@noble/hashes': 2.4.0
+      '@noble/hashes': 1.8.0
      '@peculiar/webcrypto': 1.7.1
      '@types/fs-extra': 9.0.13
      ajv: 8.20.0
      asn1js: 3.0.10
      async-exit-hook: 2.0.1
-      builder-util: 26.15.3(supports-color@10.2.2)
+      builder-util: 26.16.0(supports-color@10.2.2)
      builder-util-runtime: 9.7.0(supports-color@10.2.2)
      chromium-pickle-js: 0.2.0
      ci-info: 4.3.1
      debug: 4.4.3(supports-color@10.2.2)
-      dmg-builder: 26.15.3(electron-builder-squirrel-windows@26.15.3)(supports-color@10.2.2)
+      dmg-builder: 26.17.0(electron-builder-squirrel-windows@26.17.0)(supports-color@10.2.2)
      dotenv: 16.6.1
      dotenv-expand: 11.0.7
      ejs: 3.1.10
-      electron-builder-squirrel-windows: 26.15.3(dmg-builder@26.15.3)(supports-color@10.2.2)
-      electron-publish: 26.15.3(supports-color@10.2.2)
+      electron-builder-squirrel-windows: 26.17.0(dmg-builder@26.17.0)(supports-color@10.2.2)
+      electron-publish: 26.16.0(supports-color@10.2.2)
      fs-extra: 10.1.0
      hosted-git-info: 4.1.0
      isbinaryfile: 5.0.7
@@ -3006,7 +3000,7 @@ snapshots:
    transitivePeerDependencies:
      - supports-color

-  builder-util@26.15.3(supports-color@10.2.2):
+  builder-util@26.16.0(supports-color@10.2.2):
    dependencies:
      '@types/debug': 4.1.13
      builder-util-runtime: 9.7.0(supports-color@10.2.2)
@@ -3128,12 +3122,6 @@ snapshots:
    optionalDependencies:
      supports-color: 10.2.2

-  debug@4.4.3(supports-color@7.2.0):
-    dependencies:
-      ms: 2.1.3
-    optionalDependencies:
-      supports-color: 7.2.0
-
  decompress-response@6.0.0:
    dependencies:
      mimic-response: 3.1.0
@@ -3166,10 +3154,10 @@ snapshots:
      minimatch: 3.1.5
      p-limit: 3.1.0

-  dmg-builder@26.15.3(electron-builder-squirrel-windows@26.15.3)(supports-color@10.2.2):
+  dmg-builder@26.17.0(electron-builder-squirrel-windows@26.17.0)(supports-color@10.2.2):
    dependencies:
-      app-builder-lib: 26.15.3(dmg-builder@26.15.3)(electron-builder-squirrel-windows@26.15.3)(supports-color@10.2.2)
-      builder-util: 26.15.3(supports-color@10.2.2)
+      app-builder-lib: 26.17.0(dmg-builder@26.17.0)(electron-builder-squirrel-windows@26.17.0)(supports-color@10.2.2)
+      builder-util: 26.16.0(supports-color@10.2.2)
      fs-extra: 10.1.0
      js-yaml: 4.3.2
    transitivePeerDependencies:
@@ -3200,23 +3188,23 @@ snapshots:
    dependencies:
      jake: 10.9.4

-  electron-builder-squirrel-windows@26.15.3(dmg-builder@26.15.3)(supports-color@10.2.2):
+  electron-builder-squirrel-windows@26.17.0(dmg-builder@26.17.0)(supports-color@10.2.2):
    dependencies:
-      app-builder-lib: 26.15.3(dmg-builder@26.15.3)(electron-builder-squirrel-windows@26.15.3)(supports-color@10.2.2)
-      builder-util: 26.15.3(supports-color@10.2.2)
+      app-builder-lib: 26.17.0(dmg-builder@26.17.0)(electron-builder-squirrel-windows@26.17.0)(supports-color@10.2.2)
+      builder-util: 26.16.0(supports-color@10.2.2)
      electron-winstaller: 5.4.0(supports-color@10.2.2)
    transitivePeerDependencies:
      - dmg-builder
      - supports-color

-  electron-builder@26.15.3(electron-builder-squirrel-windows@26.15.3)(supports-color@10.2.2):
+  electron-builder@26.17.0(electron-builder-squirrel-windows@26.17.0)(supports-color@10.2.2):
    dependencies:
-      app-builder-lib: 26.15.3(dmg-builder@26.15.3)(electron-builder-squirrel-windows@26.15.3)(supports-color@10.2.2)
-      builder-util: 26.15.3(supports-color@10.2.2)
+      app-builder-lib: 26.17.0(dmg-builder@26.17.0)(electron-builder-squirrel-windows@26.17.0)(supports-color@10.2.2)
+      builder-util: 26.16.0(supports-color@10.2.2)
      builder-util-runtime: 9.7.0(supports-color@10.2.2)
      chalk: 4.1.2
      ci-info: 4.4.0
-      dmg-builder: 26.15.3(electron-builder-squirrel-windows@26.15.3)(supports-color@10.2.2)
+      dmg-builder: 26.17.0(electron-builder-squirrel-windows@26.17.0)(supports-color@10.2.2)
      fs-extra: 10.1.0
      lazy-val: 1.0.5
      simple-update-notifier: 2.0.0
@@ -3225,11 +3213,11 @@ snapshots:
      - electron-builder-squirrel-windows
      - supports-color

-  electron-publish@26.15.3(supports-color@10.2.2):
+  electron-publish@26.16.0(supports-color@10.2.2):
    dependencies:
      '@types/fs-extra': 9.0.13
      aws4: 1.13.2
-      builder-util: 26.15.3(supports-color@10.2.2)
+      builder-util: 26.16.0(supports-color@10.2.2)
      builder-util-runtime: 9.7.0(supports-color@10.2.2)
      chalk: 4.1.2
      form-data: 4.0.6
Author	SHA1	Message	Date
Zack SheppardandClaude Opus 5.5	4a300ed5fa	Let electron-builder find the signing identity in signed Mac builds (#5 ) CSC_IDENTITY_AUTO_DISCOVERY=false was set for every Mac build. With it, electron-builder imports CSC_LINK into its keychain but won't look the identity up, so the v0.0.3 build skipped signing and failed the signature check. It's now set only for unsigned builds. Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-07 23:01:44 +01:00
Zack SheppardandClaude Opus 5.5	cd8f3b7671	Pin electron-builder to ^26.17 to fix macOS signing on macos-26 runners (#4 ) electron-builder before 26.16.1 passes the .p12 password to `security set-key-partition-list -k`, which expects its temporary keychain's password. macOS 26 runners enforce that check, so signed release builds failed with "SecKeychainUnlock: The user name or passphrase you entered is not correct" (electron-builder#10066). 26.17.0 passes the keychain password. npm's `latest` tag still points at 26.15.3, so the range is pinned explicitly. Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-07 22:42:56 +01:00
Zack SheppardandClaude Opus 5.5	0693668b08	Set the author to Traveler Dev Ltd <hi@traveler.dev> in every package.json (#3 ) Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-07 22:20:32 +01:00
Zack SheppardandClaude Opus 5.5	26872c7396	Sign and notarize macOS release builds (#1 ) * Sign and notarize macOS release builds Release builds of the Mac app now run in the protected release-signing environment (approval required, v* tags only), are signed with the Developer ID certificate, notarized with the App Store Connect key, and checked with codesign, spctl and stapler before upload. Push and PR builds stay ad-hoc signed and never see the secrets. - electron-builder config moved to electron-builder.config.cjs, which switches between ad-hoc and Developer ID signing based on CSC_LINK - Hardened runtime entitlements for Electron - Local network usage description and Bonjour services in Info.plist for the macOS 15+ local network prompt - README: signing setup and current "Open Anyway" steps Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * Only export signing variables for signed Mac builds electron-builder treats an empty CSC_LINK as a certificate path, so PR builds failed with "apps/desktop not a file". The variables are now exported only by the signing step, which also checks every secret is present. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * Keep Mac signing secrets inside the build step They were exported through GITHUB_ENV, which makes them visible to every later step and action in the job (artifact upload, post steps). They now live only in the build step's environment, and the notarization key file is deleted when the step exits. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * Build pull requests once, not once per push and once per PR Push builds now run only for main; branch commits are built through their pull request. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-07 22:12:19 +01:00
Zack SheppardandClaude Opus 5.5	c6f1c8b203	Add the app icon and put the logo at the top of the README (#2 ) build/icon.icns is the macOS version (Apple's rounded-square grid with padding and shadow); build/icon.png is the full-bleed square electron-builder uses for Windows and Linux. Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-07 22:09:24 +01:00