bdeshi/shannoncoat
0
0
Fork 0
Code Issues Pull Requests Releases 1 Activity

Compare commits

base: bdeshi/shannoncoat:0.0.9
Branches Tags
bdeshi/shannoncoat:main
bdeshi/shannoncoat:1.0.0 bdeshi/shannoncoat:0.0.10 bdeshi/shannoncoat:0.0.9 bdeshi/shannoncoat:0.0.8 bdeshi/shannoncoat:0.0.7 bdeshi/shannoncoat:0.0.5 bdeshi/shannoncoat:0.0.3 bdeshi/shannoncoat:0.0.2 bdeshi/shannoncoat:0.0.1 bdeshi/shannoncoat:0.0.0
...
compare: bdeshi/shannoncoat:0.0.10
Branches Tags
bdeshi/shannoncoat:main
bdeshi/shannoncoat:1.0.0 bdeshi/shannoncoat:0.0.10 bdeshi/shannoncoat:0.0.9 bdeshi/shannoncoat:0.0.8 bdeshi/shannoncoat:0.0.7 bdeshi/shannoncoat:0.0.5 bdeshi/shannoncoat:0.0.3 bdeshi/shannoncoat:0.0.2 bdeshi/shannoncoat:0.0.1 bdeshi/shannoncoat:0.0.0
2 Commits
0.0.9 ... 0.0.10
Author SHA1 Message Date
Claude Opus 5andbdeshi 58fc3444d5 0.0.10 
Supersedes 0.0.9, whose published build went out ad-hoc signed because
the release workflow ran without the signing secrets. Anyone installing
it gets an app whose Accessibility grant is pinned to that one binary and
breaks on their next update, so it wants replacing rather than leaving as
the latest release.
 2026-08-06 00:25:40 +06:00
Claude Opus 5andbdeshi 150a2394dd Hand the signing secrets to the called release workflow 
A workflow invoked with `uses:` gets no secrets unless they are passed to
it, so every secret was empty inside release.yml when tag-on-version-bump
called it. The certificate import was skipped, the build came out ad-hoc,
and the release published that way — the precise outcome signing exists
to prevent.

Its own ad-hoc guard didn't catch it either: that guard only fires when
an identity was configured, and from the called workflow's point of view
none was. So the failure was silent in both places at once, and the run
went green.

Verified against the 0.0.9 build, whose log shows an empty
SIGNING_IDENTITY and Signature=adhoc on the published artifact.
 2026-08-06 00:23:52 +06:00
2 changed files with 7 additions and 1 deletions
Expand all files Collapse all files
.github/workflows/tag-on-version-bump.yml
+6
View File
@@ -45,5 +45,11 @@ jobs:
uses: ./.github/workflows/release.yml
with:
tag: ${{ needs.tag.outputs.tag }}
# A called workflow gets no secrets unless they're handed over, so
# without this the signing secrets are empty inside release.yml and it
# quietly builds ad-hoc — which is exactly what signing exists to
# prevent, and which its own ad-hoc guard misses, since that guard only
# fires when an identity was configured.
secrets: inherit
permissions:
contents: write
VERSION
+1 -1
View File
@@ -1 +1 @@
0.0.9
0.0.10