ci(macos): fail fast on invalid notary credentials

[meiiie]

Description

Protected candidate run 31274913581 signed both x64 and arm64 apps with the configured Developer ID certificate, but Apple notarization then failed on both architectures with HTTP 401 invalid credentials.

This PR adds an explicit notarytool history authentication preflight after compilation and certificate validation, but before electron-builder packaging. Apple ID and app-specific password are now scoped to that dedicated step and the package step rather than the certificate parser. Successful history output is discarded, the check has a five-minute timeout, and the existing always-run certificate cleanup remains unchanged.

Apple documents notarytool authentication with Apple ID, app-specific password, and Team ID in its custom notarization workflow guidance.

Safety and scope

• Candidate-only workflow; public release.yml is unchanged.
• Exact-main authorization, --publish never, fail-closed verdict, and three-day artifact retention are unchanged.
• No secret value was read, copied, logged, or persisted.
• With the current invalid credentials, the next candidate should fail before packaging. A credential holder must replace or correct the Apple notarization secrets before a successful candidate is possible.

Testing

• Checksum-verified actionlint 1.7.12 passed.
• PyYAML parse and focused policy assertions passed.
• git diff --check passed.

Type of change

• Release engineering / CI hardening
• Product runtime change

Summary by CodeRabbit

• Release Improvements
  • Improved macOS release validation by separating signing certificate and notarization credential checks.
  • Added an independent verification step for Apple notarization access before release processing.
  • Release checks now provide clearer detection of missing or invalid signing and notarization credentials.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: ea2c3b83-639b-4204-9492-4d4268f6c545

📥 Commits

Reviewing files that changed from the base of the PR and between c80ae87 and 10a8097.

📒 Files selected for processing (1)

• .github/workflows/macos-release-candidate.yml

---

📝 Walkthrough

Walkthrough

The macOS release-candidate workflow now separates signing certificate validation from notarization credential validation. The new notarization check validates Apple ID, app-specific password, and team ID secrets through xcrun notarytool history.

Changes

macOS release credential validation

Layer / File(s)	Summary
Separate signing and notarization checks .github/workflows/macos-release-candidate.yml	The signing preflight validates certificate secrets only. A separate five-minute preflight validates notarization credentials and authenticates with xcrun notarytool history.

Estimated code review effort: 2 (Simple) | ~10 minutes

Possibly related PRs

• webadderallorg/Recordly#801: Both PRs update Apple credential validation in the macOS release-candidate workflow.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly summarizes the main change: fail-fast validation for invalid macOS notarization credentials.
Description check	✅ Passed	The description explains the purpose, motivation, scope, testing, and safety impact, but omits the template checklist and related issue section.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch ci/macos-notary-credential-preflight

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}