sign github macos releases with developer id

2026-08-12 12:22:13 +02:00
parent ca01296949
commit 35b300bd66
3 changed files with 86 additions and 5 deletions
@@ -41,9 +41,8 @@ matching custom tag already exists, pushes only the `<upstream>-stignore.7` tag
 by default, and publishes release assets on the CI host running the workflow.
 The local `custom/<version>` branch is only pushed when
 `CUSTOM_RELEASE_PUSH_BRANCH=1` is set. The workflow builds macOS arm64, Linux
-amd64, and Linux arm64 archives. Gitea signs its macOS build with the configured
-Developer ID certificate; GitHub builds an unsigned macOS archive until the
-equivalent signing secrets are configured there.
+amd64, and Linux arm64 archives. Both hosts sign their macOS builds with their
+configured Developer ID certificate.

 The patch makes root-level `.stignore` sync like regular folder content while
 keeping `.stfolder` and `.stversions` protected as internal Syncthing paths.