chore(ci): fail closed without notarization credentials

[jdx]

Summary

• require all App Store Connect credentials in the reusable release workflow
• fail the macOS release job if any credential resolves to an empty value
• prevent releases from silently publishing signed but unnotarized binaries

Testing

• actionlint .github/workflows/release.yml

AI-assisted — Tool: Codex; model: openai/gpt-5; version: unavailable.

Summary by CodeRabbit

• Bug Fixes
  • macOS releases now require complete Apple notarization credentials.
  • Releases fail early when notarization credentials are missing, preventing unsigned or unnotarized binaries from being distributed.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited), Organization UI (inherited)

Review profile: CHILL

Plan: Pro Plus

Run ID: 0682019f-7a2e-4b46-8c59-e4b38c726e4a

📥 Commits

Reviewing files that changed from the base of the PR and between 4e9341f and 4f0ecc0.

📒 Files selected for processing (1)

• .github/workflows/release.yml

Included review availability: Your plan provides up to 4 included reviews per hour; 3 remain after this review.

---

📝 Walkthrough

Walkthrough

The reusable release workflow now requires all Apple notarization credentials. macOS release jobs stop with an error when any credential is missing.

Changes

Release notarization enforcement

Layer / File(s)	Summary
Notarization contract and failure handling .github/workflows/release.yml	The workflow requires APPLE_API_KEY_P8, APPLE_API_KEY_ID, and APPLE_API_ISSUER_ID. The macOS notarization step exits with an error when a credential is missing.

Estimated code review effort: 2 (Simple) | ~10 minutes

Merge Risk: ⚪ Minimal · up to 4f0ec

The macOS release now stops instead of publishing signed but unnotarized binaries when required credentials are missing. No actionable merge-blocking risk remains after normal checks and review.

Suggested reviewers: robertderose

Poem

A rabbit checks the release gate

Three Apple keys must now be straight
Missing keys stop the flight
Signed builds wait for notarization right
The workflow guards the night

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly states that CI will fail closed when notarization credentials are unavailable. This matches the main change in the workflow.

Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (1 skipped: 1 unsupported.)

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[greptile-apps]

Greptile Summary

This PR makes notarization credentials mandatory for reusable release-workflow callers and stops macOS releases when those credentials are empty.

• Marks all three App Store Connect secrets as required workflow inputs.
• Replaces the signed-but-unnotarized warning path with a failing error.

Confidence Score: 5/5

The PR appears safe to merge because the existing caller supplies every newly required secret and missing credentials now prevent unnotarized releases.

The sole reusable-workflow caller already passes all three App Store Connect credentials, dry runs skip notarization, and real releases now stop rather than publishing artifacts when credentials are unavailable.

Important Files Changed

Filename	Overview
.github/workflows/release.yml	Enforces fail-closed macOS notarization while remaining compatible with the repository's existing release caller.

_{Reviews (1): Last reviewed commit: "chore(ci): fail closed without notarizat..." | Re-trigger Greptile}

[github-actions]

Instruction counts

benchmark	trend	instructions	Δ	wall (min)	Δ
graph	▅▅█▅▁▁▅▂▁▄▅█▅▁▁█▅▅▁	13,342,808 → 13,261,723	-0.61%	4.56 → 4.56ms	+0.03%
install	███████▁▁▂▂▂▂▂▂▂▂▂▂	108,152,626 → 108,164,743	+0.01%	26.54 → 27.32ms	+2.94%
run	▁▂▄▃▄▃▃▆▄▅█▄▆▅▄▄▆▅▅	3,061,490 → 3,060,822	-0.02%	4.43 → 4.89ms	+10.46%
startup	▁▁▁▁▁▁▂▇▅▂███▂▂▃▅▂▄	2,380,371 → 2,381,646	+0.05%	3.09 → 2.99ms	-3.23%
tree	▇▇▁▇▇▁▁▂▂▇█▂▂▂▂▇▂▁▂	12,599,887 → 12,601,943	+0.02%	4.55 → 4.60ms	+1.02%

No instruction-count regression above 1%.

_{Only instruction counts gate. Wall clock is shown for context — on identical hardware it moves 4-20% run to run.}

_{Measured by tak — instruction-counted CLI benchmarks, stored in this repository's git notes.}

_{4f0ecc0a5225 vs 4e9341fa9281 · measured on this runner, not pushed to the history.}