fix(release): require signed macOS builds

[leoisadev1]

Stable releases accepted an empty macOS credential set and published an ad-hoc signed, unnotarized app. macOS 27 rejects that artifact even though the code-seal check passes.

The stable workflow now requires the complete Developer ID and notarization credential set for macOS. Certificate import, notarization, stapling, and Gatekeeper checks always run for the macOS release job. The unsigned macOS path remains available in the non-publishing smoke workflow.

Model: gpt-5.6-sol
Harness: Codex harness in T3 Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
akeru-bot-landing	Building	Preview	Sep 3, 2026 12:09am UTC

[greptile-apps]

Greptile Summary

This change requires signing and notarization credentials for stable macOS releases and adds release smoke coverage for that policy. Verification found that the new smoke check can still pass after equivalent unsigned macOS release behavior is restored under a different verification-step name. Strengthen the test to validate the required credential gate and unconditional signed/notarized verification behavior rather than one step label.

Confidence Score: 4/5

The release policy change is directionally correct, but its regression coverage should be strengthened before relying on the smoke test to prevent unsigned stable macOS releases.

There is one independent verified P2 finding and it is not security-related, which maps to a score of 4.

Files Needing Attention: scripts/release-smoke.ts needs attention so the smoke test asserts the release behavior rather than a single workflow-step label.

T-Rex Logs

What T-Rex did

• T-Rex executed the unsigned macOS bypass reproduction script.
• T-Rex observed the release smoke bypass output during the run.

_{Ran code and verified through T-Rex}

_{Reviews (1): Last reviewed commit: "fix(release): require signed macOS build..." | Re-trigger Greptile}

[greptile-apps]

Unsigned-path check matches only one label

This regression check only rejects the literal Verify unsigned macOS app signature. An unsigned stable macOS path can be restored by retaining the required-credentials message and signed-build markers, skipping signing-only steps when credentials are absent, and using a differently named verification step. The release smoke test still passes in that case, so it does not enforce the intended invariant that stable releases cannot produce or verify an unsigned macOS artifact. Assert the credential gate and unconditional signed/notarized verification behavior instead of relying on a single step label.

Note: If this suggestion doesn't match your team's coding style, reply to this and let me know. I'll remember it for next time!

Artifacts

Executed unsigned macOS bypass reproduction script

• Creates an isolated worktree, runs the baseline smoke check, injects renamed equivalent unsigned macOS release behavior, and runs the real smoke check again; it demonstrates the targeted bypass test.

Observed release smoke bypass output

• Captured output from the executed harness shows both baseline and renamed unsigned macOS fixture smoke checks exit 0; the existing regression check misses the equivalent unsigned behavior.

_{Ran code and verified through T-Rex}