From 66f2211d6860b7d33ba426993c4306f284c3c678 Mon Sep 17 00:00:00 2001
From: Nexmoe <16796652+nexmoe@users.noreply.github.com>
Date: Mon, 12 Jan 2026 21:53:39 +0800
Subject: [PATCH] fix(build): move mac tool signing to beforeSign (#86)

* fix(build): move tool signing to beforeSign

* ci(macos): verify signing and notarization

* fix(build): move signing hook to afterPack
---
 .github/workflows/build.yml              | 33 ++++++++++++++++++++++++
 build/{after-sign.cjs => after-pack.cjs} |  8 +++---
 electron-builder.yml                     |  2 +-
 3 files changed, 38 insertions(+), 5 deletions(-)
 rename build/{after-sign.cjs => after-pack.cjs} (84%)

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 1776960..3699803 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -149,6 +149,7 @@ jobs:
           APPLE_API_ISSUER: ${{ secrets.APPLE_API_ISSUER }}
         run: |
           set -euo pipefail
+          echo "SIGNING_AVAILABLE=false" >> "$GITHUB_ENV"
 
           # Check if all required secrets are present
           if [[ -z "$MAC_CERT_P12_BASE64" ]] || [[ -z "$MAC_CERT_P12_PASSWORD" ]] || \
@@ -177,10 +178,42 @@ jobs:
           echo "APPLE_API_KEY=$API_KEY_PATH" >> "$GITHUB_ENV"
           echo "APPLE_API_KEY_ID=$APPLE_API_KEY_ID" >> "$GITHUB_ENV"
           echo "APPLE_API_ISSUER=$APPLE_API_ISSUER" >> "$GITHUB_ENV"
+          echo "SIGNING_AVAILABLE=true" >> "$GITHUB_ENV"
 
       - name: Build application
         run: ${{ matrix.build_script }}
 
+      - name: Verify macOS codesign and notarization
+        if: matrix.platform == 'macos' && env.SIGNING_AVAILABLE == 'true'
+        shell: bash
+        run: |
+          set -euo pipefail
+          apps_found=0
+          while IFS= read -r app; do
+            apps_found=1
+            echo "Verifying codesign for $app"
+            codesign --verify --deep --strict --verbose=2 "$app"
+            spctl -a -t exec -vv "$app"
+            echo "Validating notarization ticket for $app"
+            xcrun stapler validate "$app"
+          done < <(find dist -type d -name "*.app" -prune -print)
+
+          if [[ "$apps_found" -eq 0 ]]; then
+            echo "::error::No .app bundles found in dist"
+            exit 1
+          fi
+
+          dmgs_found=0
+          while IFS= read -r dmg; do
+            dmgs_found=1
+            echo "Validating notarization ticket for $dmg"
+            xcrun stapler validate "$dmg"
+          done < <(find dist -type f -name "*.dmg" -print)
+
+          if [[ "$dmgs_found" -eq 0 ]]; then
+            echo "::notice::No DMG artifacts found to validate"
+          fi
+
       - name: Upload build artifacts
         if: inputs.upload_artifacts == true
         uses: actions/upload-artifact@v4
diff --git a/build/after-sign.cjs b/build/after-pack.cjs
similarity index 84%
rename from build/after-sign.cjs
rename to build/after-pack.cjs
index 2f83afb..7b46f66 100644
--- a/build/after-sign.cjs
+++ b/build/after-pack.cjs
@@ -25,14 +25,14 @@ const signBinary = (targetPath, entitlementsPath) => {
   execFileSync('codesign', args, { stdio: 'inherit' })
 }
 
-exports.default = async function afterSign(context) {
+exports.default = async function afterPack(context) {
   if (context.electronPlatformName !== 'darwin') {
     return
   }
 
   const appBundle = findAppBundle(context.appOutDir)
   if (!appBundle) {
-    console.warn('afterSign: No .app bundle found, skipping yt-dlp signing.')
+    console.warn('afterPack: No .app bundle found, skipping tool signing.')
     return
   }
 
@@ -49,10 +49,10 @@ exports.default = async function afterSign(context) {
   for (const binary of BINARIES) {
     const targetPath = path.join(resourcesPath, binary)
     if (!fs.existsSync(targetPath)) {
-      console.warn(`afterSign: Missing ${binary}, skipping.`)
+      console.warn(`afterPack: Missing ${binary}, skipping.`)
       continue
     }
-    console.log(`afterSign: Signing ${binary} with entitlements.`)
+    console.log(`afterPack: Signing ${binary} with entitlements.`)
     signBinary(targetPath, entitlementsPath)
   }
 }
diff --git a/electron-builder.yml b/electron-builder.yml
index ee9e655..16b700e 100644
--- a/electron-builder.yml
+++ b/electron-builder.yml
@@ -2,7 +2,7 @@ appId: com.vidbee
 productName: VidBee
 directories:
   buildResources: build
-afterSign: build/after-sign.cjs
+afterPack: build/after-pack.cjs
 protocols:
   - name: VidBee
     schemes: