From 54728cdc719e78e2ff9a5f61c61dda0a93234b3b Mon Sep 17 00:00:00 2001
From: Daniel Arantes Loverde <daniel@loverde.com.br>
Date: Thu, 30 Jul 2026 18:21:54 -0300
Subject: [PATCH] [macos-runner] Unlock login keychain explicitly before
 fastlane signing steps

act_runner's launchd daemon now runs as loverde_vm_mac (UserName set),
but its background session doesn't inherit the unlock state from an
interactive SSH session - the login keychain is still locked when
fastlane/sigh looks for signing identities, so none are found. Unlock it
explicitly at the start of each signing job instead.
---
 .gitea/workflows/beta.yml    | 3 +++
 .gitea/workflows/release.yml | 3 +++
 2 files changed, 6 insertions(+)

diff --git a/.gitea/workflows/beta.yml b/.gitea/workflows/beta.yml
index 067aacc..0c466b4 100644
--- a/.gitea/workflows/beta.yml
+++ b/.gitea/workflows/beta.yml
@@ -47,6 +47,9 @@ jobs:
           }
           EOF
 
+      - name: Unlock keychain
+        run: security unlock-keychain -p "${{ secrets.MAC_KEYCHAIN_PASSWORD }}" ~/Library/Keychains/login.keychain-db
+
       - name: fastlane beta
         run: |
           cd Darwin
diff --git a/.gitea/workflows/release.yml b/.gitea/workflows/release.yml
index 3a3e743..f9d9a76 100644
--- a/.gitea/workflows/release.yml
+++ b/.gitea/workflows/release.yml
@@ -54,6 +54,9 @@ jobs:
           }
           EOF
 
+      - name: Unlock keychain
+        run: security unlock-keychain -p "${{ secrets.MAC_KEYCHAIN_PASSWORD }}" ~/Library/Keychains/login.keychain-db
+
       - name: fastlane release
         run: |
           cd Darwin