From 5ee08a3e62ed868f26b4887a871e17da106cd3cb Mon Sep 17 00:00:00 2001
From: Nexmoe <16796652+nexmoe@users.noreply.github.com>
Date: Mon, 12 Jan 2026 10:13:58 +0800
Subject: [PATCH] chore(build): add macOS signing secrets and validation

- Introduced new secrets for macOS signing in the build workflow.
- Added validation to check for the presence of required secrets before proceeding with code signing setup.
---
 .github/workflows/build.yml   | 20 ++++++++++++++++++++
 .github/workflows/release.yml |  1 +
 2 files changed, 21 insertions(+)

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 2558ed5..1776960 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -8,6 +8,17 @@ on:
         type: boolean
         default: false
         description: 'Whether to upload build artifacts'
+    secrets:
+      MAC_CERT_P12_BASE64:
+        required: false
+      MAC_CERT_P12_PASSWORD:
+        required: false
+      APPLE_API_KEY_ID:
+        required: false
+      APPLE_API_ISSUER:
+        required: false
+      APPLE_API_KEY_P8_BASE64:
+        required: false
 
 jobs:
   build:
@@ -138,6 +149,15 @@ jobs:
           APPLE_API_ISSUER: ${{ secrets.APPLE_API_ISSUER }}
         run: |
           set -euo pipefail
+
+          # Check if all required secrets are present
+          if [[ -z "$MAC_CERT_P12_BASE64" ]] || [[ -z "$MAC_CERT_P12_PASSWORD" ]] || \
+             [[ -z "$APPLE_API_KEY_ID" ]] || [[ -z "$APPLE_API_ISSUER" ]] || \
+             [[ -z "$APPLE_API_KEY_P8_BASE64" ]]; then
+            echo "::notice::macOS signing secrets not available, skipping code signing setup"
+            exit 0
+          fi
+
           CERT_PATH="$RUNNER_TEMP/mac_cert.p12"
           KEYCHAIN_PATH="$RUNNER_TEMP/build.keychain"
           API_KEY_PATH="$RUNNER_TEMP/AuthKey.p8"
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 9b0c24a..954a6fb 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -10,6 +10,7 @@ jobs:
     uses: ./.github/workflows/build.yml
     with:
       upload_artifacts: true
+    secrets: inherit
 
   release:
     needs: [build]