fix(release): reuse configured Apple signing secrets - #8574
Merged
Conversation
LaZzyMan
marked this pull request as ready for review
August 5, 2026 09:11
Collaborator
Contributor
Code Coverage Summary
CLI Package - Full Text ReportCore Package - Full Text ReportFor detailed HTML reports, please see the 'coverage-reports-22.x-ubuntu-latest' artifact from the main CI run. |
DragonnZhang
approved these changes
Aug 5, 2026
Collaborator
|
Thanks for the PR! Template looks good ✓ Problem: observed failure, not theory — the first stable Live Host release (run 30990708152, Direction: aligned — this repairs the repo's own release pipeline for the Live Host app that just landed in #7859, by reusing the credential compatibility contract the Desktop release already ships with. No product runtime surface, no public-contract change. Size: not applicable — no core paths touched ( Approach: the scope is exactly right. Both steps prefer the modern secret names, fall back to the configured legacy pair/triple atomically (no mixing across sets), fail closed with a clear error when neither set is complete, and the keychain password becomes an ephemeral Risk: no elevated-risk signals — no high-risk paths matched. The secrets-gated steps only run on Moving on to code review. 🔍 中文说明感谢贡献！ 模板完整 ✓ 问题：是已观测到的故障，不是理论问题——首个 Live Host 稳定版发布（run 30990708152， 方向：对齐——这是在修复仓库自己的 Live Host（#7859 刚合入）发布管线，复用了 Desktop 发布已经在用的凭据兼容约定。不涉及产品运行时，也不改变公共契约。 规模：不适用——未触及核心路径（仅 方案：范围恰到好处。两个步骤都优先使用新密钥名，并原子性地回退到已配置的旧密钥二元组/三元组（不跨组混用）；两组都不完整时报错关闭；未配置 keychain 密码时改用 风险：无升级风险信号——未命中任何高风险路径。密钥相关步骤仅在 进入代码审查 🔍 — Qwen Code · qwen3.8-max Reviewed at |
Collaborator
Code reviewBefore reading the diff, my independent proposal for "Live Host release failed because the required Apple secret names aren't configured" was: copy the fallback contract that No blockers found. Notes from the pass:
TestingEvidence carried here: the PR's own CI results fetched via API for the reviewed commit — per unattended-run rules, no PR code was built or executed by this review. All checks complete, none failed.
About the skips: Two honest scoping notes: the successful dry-run dispatch proves the changed YAML parses and the pipeline runs through to the secrets-gated steps, but the signing/notarization steps themselves execute only on a real 中文说明代码审查在读 diff 之前，我对"Live Host 发布因所需 Apple 密钥名未配置而失败"的独立方案是：照搬 未发现阻塞问题。审查要点：
测试本节证据：通过 API 获取的该 PR 自身在受审 commit 上的 CI 结果——按无人值守运行规则，本审查未构建或执行任何 PR 代码。所有检查已完成，无失败。 （CI 明细见上方表格。） 关于跳过项： 两点如实说明：dry-run dispatch 成功证明了改动后的 YAML 可解析、管线能跑到密钥步骤之前，但签名/公证步骤本身只在 — Qwen Code · qwen3.8-max Reviewed at |
Collaborator
|
Confidence: 5/5 — an observed release failure fixed by faithfully mirroring a credential contract that already ships Desktop releases; minimal diff, fully green CI. My independent proposal for this failure was exactly what the PR does — reuse the The one residual — a genuinely signed release run — is structurally post-merge only (repository secrets never reach PR runs), and the step fails closed with a clear error if anything still mismatches; the legacy formats themselves are already consumed by shipped Desktop releases through the identical code. The direction question on release infrastructure was assessed as clear-cut rather than escalated: this repairs the repo's own pipeline for the app that just landed in #7859, authored by a repo admin, with a human maintainer approval already on the PR. Approving. ✅ 中文说明置信度：5/5 —— 一次已观测到的发布故障，通过忠实复刻已在 Desktop 发布中实战使用的凭据约定得到修复；diff 最小化，CI 全绿。 我对这个故障的独立方案与 PR 完全一致——复用 唯一的遗留——真正签名的发布运行——在结构上只能合入后进行（仓库 secrets 永远不会进入 PR 运行），且该步骤在任何不匹配时都会以清晰报错失败关闭；旧格式本身已经由已发布的 Desktop 版本通过完全相同的代码消费。关于发布基础设施的方向问题，我评估为清晰而非需要升级：这是在修复仓库自己的管线（对应 #7859 刚合入的应用），作者是仓库管理员，且 PR 上已有人类维护者的批准。予以批准。✅ — Qwen Code · qwen3.8-max Reviewed at |
qwen-code-ci-bot
approved these changes
Aug 5, 2026
qwen-code-ci-bot
left a comment
qwen-code-ci-bot
left a comment
Collaborator
There was a problem hiding this comment.
LGTM, looks ready to ship. ✅
Collaborator
|
Released in v0.21.6. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What this PR does
Allows the independent Qwen Live Host release workflow to use the macOS signing and notarization credentials that are already configured for the repository, while retaining support for the newer credential names. It also generates an ephemeral keychain password when no dedicated password secret is configured.
Why it's needed
The first stable Qwen Live Host release failed before packaging because the workflow required credential names that are not configured in this repository. The existing Desktop release already supports the configured legacy names, so this applies the same compatibility contract to Live Host without adding, moving, or exposing signing material.
Reviewer Test Plan
How to verify
Run the release-workflow unit test and validate the workflow with actionlint. Confirm that a published Live Host dispatch accepts the existing certificate pair and notarization trio, decodes their stored formats correctly, maps the notarization values to Electron Builder's expected environment variables, and still fails closed when neither credential set is complete.
Evidence (Before & After)
N/A — release infrastructure only. Before: run 30990708152 stopped at certificate import because all newly named secrets were empty. After: the workflow resolves the already configured repository credentials through the same fallback rules used by the Desktop release.
Tested on
Environment (optional)
macOS; Vitest 5/5 passed, Prettier passed, actionlint passed, and the workflow YAML parsed successfully.
Risk & Scope
main.Linked Issues
Follow-up to #7859.
中文说明
本 PR 的改动
让独立的 Qwen Live Host 发布工作流复用仓库已经配置的 macOS 签名与公证凭据，同时继续支持新凭据名称。若没有配置专用 keychain 密码，则生成一次性的临时密码。
为什么需要
首次稳定版 Qwen Live Host 发布在打包前失败，因为工作流强制要求了仓库中并未配置的凭据名称。现有 Desktop 发布已经兼容仓库当前使用的旧名称，因此这里为 Live Host 应用相同的兼容约定，不新增、不迁移、也不暴露任何签名材料。
Reviewer Test Plan
验证方式
运行发布工作流单测并使用 actionlint 校验工作流。确认正式 Live Host 发布可以使用现有证书二元组和公证三元组，正确解码存储格式并映射为 Electron Builder 期望的环境变量；当两组凭据都不完整时仍然失败关闭。
前后证据
不适用——仅涉及发布基础设施。修改前：run 30990708152 因新命名的 secrets 全部为空而停止在证书导入。修改后：工作流使用与 Desktop 发布相同的回退规则解析仓库已经配置的凭据。
测试平台
环境
macOS；Vitest 5/5 通过，Prettier 通过，actionlint 通过，工作流 YAML 解析通过。
风险与范围
main后运行。关联事项
#7859 的后续修复。