From a0f18644d75a562e2b2d593091215adb2fd00bbe Mon Sep 17 00:00:00 2001 From: Daniel Arantes Loverde Date: Thu, 30 Jul 2026 18:40:51 -0300 Subject: [PATCH] [macos-runner] Use a dedicated CI keychain instead of the login keychain A Gitea Actions job runs in a different macOS security session than an interactive SSH login - login.keychain-db's unlock state and search-list membership don't reliably carry over across that boundary, so the identity was invisible to the job even after successful unlock. Point the workflow's unlock step at a dedicated ci-signing.keychain-db instead, created independent of any login session. --- .gitea/workflows/beta.yml | 6 +++--- .gitea/workflows/release.yml | 6 +++--- 2 files changed, 6 insertions(+), 6 deletions(-) diff --git a/.gitea/workflows/beta.yml b/.gitea/workflows/beta.yml index e921d0b..851fe3c 100644 --- a/.gitea/workflows/beta.yml +++ b/.gitea/workflows/beta.yml @@ -49,9 +49,9 @@ jobs: - name: Unlock keychain run: | - security unlock-keychain -p "${{ secrets.MAC_KEYCHAIN_PASSWORD }}" ~/Library/Keychains/login.keychain-db - security list-keychains -d user -s ~/Library/Keychains/login.keychain-db - security default-keychain -d user -s ~/Library/Keychains/login.keychain-db + security unlock-keychain -p "${{ secrets.CI_KEYCHAIN_PASSWORD }}" ~/Library/Keychains/ci-signing.keychain-db + security list-keychains -d user -s ~/Library/Keychains/ci-signing.keychain-db ~/Library/Keychains/login.keychain-db + security default-keychain -d user -s ~/Library/Keychains/ci-signing.keychain-db security find-identity -v -p codesigning - name: fastlane beta diff --git a/.gitea/workflows/release.yml b/.gitea/workflows/release.yml index ef11a3f..1611495 100644 --- a/.gitea/workflows/release.yml +++ b/.gitea/workflows/release.yml @@ -56,9 +56,9 @@ jobs: - name: Unlock keychain run: | - security unlock-keychain -p "${{ secrets.MAC_KEYCHAIN_PASSWORD }}" ~/Library/Keychains/login.keychain-db - security list-keychains -d user -s ~/Library/Keychains/login.keychain-db - security default-keychain -d user -s ~/Library/Keychains/login.keychain-db + security unlock-keychain -p "${{ secrets.CI_KEYCHAIN_PASSWORD }}" ~/Library/Keychains/ci-signing.keychain-db + security list-keychains -d user -s ~/Library/Keychains/ci-signing.keychain-db ~/Library/Keychains/login.keychain-db + security default-keychain -d user -s ~/Library/Keychains/ci-signing.keychain-db security find-identity -v -p codesigning - name: fastlane release