From 150a2394dd63f8237e2e9d6e81bc8399cff87689 Mon Sep 17 00:00:00 2001 From: Claude Opus 5 Date: Thu, 6 Aug 2026 00:23:52 +0600 Subject: [PATCH] Hand the signing secrets to the called release workflow MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit A workflow invoked with `uses:` gets no secrets unless they are passed to it, so every secret was empty inside release.yml when tag-on-version-bump called it. The certificate import was skipped, the build came out ad-hoc, and the release published that way — the precise outcome signing exists to prevent. Its own ad-hoc guard didn't catch it either: that guard only fires when an identity was configured, and from the called workflow's point of view none was. So the failure was silent in both places at once, and the run went green. Verified against the 0.0.9 build, whose log shows an empty SIGNING_IDENTITY and Signature=adhoc on the published artifact. --- .github/workflows/tag-on-version-bump.yml | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/.github/workflows/tag-on-version-bump.yml b/.github/workflows/tag-on-version-bump.yml index 0054ebc..f29c89d 100644 --- a/.github/workflows/tag-on-version-bump.yml +++ b/.github/workflows/tag-on-version-bump.yml @@ -45,5 +45,11 @@ jobs: uses: ./.github/workflows/release.yml with: tag: ${{ needs.tag.outputs.tag }} + # A called workflow gets no secrets unless they're handed over, so + # without this the signing secrets are empty inside release.yml and it + # quietly builds ad-hoc — which is exactly what signing exists to + # prevent, and which its own ad-hoc guard misses, since that guard only + # fires when an identity was configured. + secrets: inherit permissions: contents: write