Ludovic Marie 3ffbb1cb9f Sign and notarize the macOS builds with Developer ID ...

With the repository variable MACOS_SIGN_IDENTITY set, the launcher's Horizon.app and .dmg and the
game's three programs are signed with the hardened runtime and a timestamp, notarized and (app,
dmg) stapled, from a keychain of the Mac mini's own that keychain.sh unlocks with its password from
1Password. Unset, everything is signed ad hoc as before. The launcher checks an updated bundle's
signature before and after swapping it in, and puts the old one back when it doesn't hold.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

2026-10-21 12:20:34 +02:00

..

cancel-on-close.yml

CI: cancel a pull request's unfinished checks when it closes

2026-10-18 21:35:47 +02:00

ci.yml

checks: verify always runs, so a skipped job can never satisfy main's required check

2026-10-19 13:58:27 +02:00

launcher.yml

Sign and notarize the macOS builds with Developer ID

2026-10-21 12:20:34 +02:00

nightly.yml

CI disk: short artifact retention, runner cleanup, sccache on the Mac runners

2026-10-15 01:05:59 +02:00

parity.yml

checks: verify always runs, so a skipped job can never satisfy main's required check

2026-10-19 13:58:27 +02:00

promote.yml

Release channels: blockers hold every beta, latest only moves forward, a stalled promotion opens an issue

2026-10-19 15:38:05 +02:00

release.yml

Sign and notarize the macOS builds with Developer ID

2026-10-21 12:20:34 +02:00

run-parity.yml

checks: verify always runs, so a skipped job can never satisfy main's required check

2026-10-19 13:58:27 +02:00

telemetry-server.yml

Opt-in data collection (4/5): the ingest server

2026-10-15 02:53:59 +02:00