Sign macOS apps for GitHub

Carry the authorized setup through a credentialed GitHub build and downloaded-artifact verification. Reuse the account holder's existing credentials where possible. Keep Apple credential names independent of the product name so renaming the app needs no new certificate or API key. This skill may load automatically for macOS distribution-signing work.

1. Inspect the app and accounts

• Check the checkout, Git remote, dirty files, packaging scripts, release workflow, bundle identifier, architectures, nested executables, and entitlements. Preserve unrelated work.
• Confirm the intended Apple team in the signed-in Developer portal using available browser tools. Check security find-identity -v -p codesigning locally and GitHub authentication. Never pick a certificate merely because it is the first identity listed.
• Use Developer ID Application for direct app/DMG distribution. Apple Development and ad hoc signatures are for different purposes. A signed installer .pkg needs Developer ID Installer as well.
• Inspect existing credential exports in known local storage before creating replacements; don't print their contents. A .cer alone is insufficient: CI needs a password-protected .p12 containing the certificate and its private key.

2. Obtain and verify credentials

If a usable certificate exists, export that identity and private key from Keychain Access as a protected .p12. Otherwise, create a CSR, issue a Developer ID Application certificate under the selected team, import the .cer into the keychain containing the CSR's private key, then export the identity.

For this workflow use an App Store Connect Team API key: its .p8, key ID, and issuer ID. Reuse a valid existing key; if absent, create one in App Store Connect under Users and Access → Integrations → App Store Connect API. Download and protect the private key immediately. Confirm the selected team before using any recovered key.

Verify the certificate's team and expiry, confirm its private key is available, then test notarization authentication: