Skip to content

Add code signing support for XCFrameworks#844

Merged
Kyle-Ye merged 1 commit into
mainfrom
feature/codesign-xcframework
Mar 25, 2026
Merged

Add code signing support for XCFrameworks#844
Kyle-Ye merged 1 commit into
mainfrom
feature/codesign-xcframework

Conversation

@Kyle-Ye
Copy link
Copy Markdown
Member

@Kyle-Ye Kyle-Ye commented Mar 24, 2026

Summary

  • Sign all 7 xcframeworks (main + 6 dependency stubs) with a self-signed "OpenSwiftUI" certificate during the release build
  • Import signing certificate from GitHub secrets via apple-actions/import-codesign-certs@v3
  • Gracefully skip signing when certificate is not available (external contributor PRs, manual builds)

Changes

  • Scripts/build_xcframework.sh — added signing step after xcframework creation
  • .github/actions/build-xcframework/action.yml — added certificate import step and new inputs
  • .github/workflows/release.yml — pass signing secrets to the composite action

Setup required

Add these GitHub repo secrets:

  • SIGNING_CERTIFICATE_BASE_64 — base64-encoded .p12 certificate
  • SIGNING_CERTIFICATE_PASSWORD — password for the .p12 file

Test plan

  • Verify release workflow still succeeds without secrets (signing skipped)
  • Add secrets and verify xcframeworks are signed in release
  • Verify signature with codesign -dv --verbose=4 OpenSwiftUI.xcframework

@github-actions github-actions Bot added enhancement platform: macOS macOS-specific behavior or support. labels Mar 24, 2026
@augmentcode
Copy link
Copy Markdown

augmentcode Bot commented Mar 24, 2026

🤖 Augment PR Summary

Summary: This PR adds optional code-signing for the generated XCFramework artifacts during the release build.

Changes:

  • Extends the build-xcframework composite action with inputs for a base64-encoded .p12 certificate and password.
  • Imports the signing certificate in CI using apple-actions/import-codesign-certs@v3 when provided.
  • Passes signing secrets from .github/workflows/release.yml into the composite action.
  • Runs codesign over the main XCFramework and dependency-stub XCFrameworks after building, and skips signing when no certificate is available.

🤖 Was this summary useful? React with 👍 or 👎

Copy link
Copy Markdown

@augmentcode augmentcode Bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Review completed. 2 suggestions posted.

Fix All in Augment

Comment augment review to trigger a new review at any time.

Comment thread .github/actions/build-xcframework/action.yml Outdated
Comment thread Scripts/build_xcframework.sh Outdated
@codecov
Copy link
Copy Markdown

codecov Bot commented Mar 24, 2026

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 26.85%. Comparing base (cd9a5fc) to head (a99f773).
⚠️ Report is 1 commits behind head on main.

Additional details and impacted files
@@            Coverage Diff             @@
##             main     #844      +/-   ##
==========================================
- Coverage   26.85%   26.85%   -0.01%     
==========================================
  Files         671      671              
  Lines       43470    43470              
==========================================
- Hits        11675    11672       -3     
- Misses      31795    31798       +3     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

@Kyle-Ye Kyle-Ye requested a review from Mx-Iris as a code owner March 25, 2026 07:29
Add a reusable codesign-xcframework action that imports a signing
certificate and signs xcframeworks. Integrate it into the build and
release workflows.

Changes:
- .github/actions/codesign-xcframework — new reusable composite action
  that sets up a CI keychain, imports a .p12 cert, trusts it for code
  signing, and signs xcframeworks
- .github/actions/build-xcframework — call codesign action after build
- .github/workflows/release.yml — pass signing secrets
- .github/workflows/build_xcframework.yml — pass signing secrets

The signing certificate (self-signed, "OpenSwiftUI") is stored as
org-level GitHub secrets (SIGNING_CERTIFICATE_BASE_64 and
SIGNING_CERTIFICATE_PASSWORD). Signing is gracefully skipped when
secrets are not available.
@Kyle-Ye Kyle-Ye force-pushed the feature/codesign-xcframework branch from 1816363 to a99f773 Compare March 25, 2026 07:47
@Kyle-Ye Kyle-Ye merged commit 6e47bd6 into main Mar 25, 2026
10 checks passed
@Kyle-Ye Kyle-Ye deleted the feature/codesign-xcframework branch March 25, 2026 10:19
@Kyle-Ye Kyle-Ye added area: tooling Developer tooling, package manifests, Tuist, scripts, formatting, or release tooling. type: build Build system, packaging, toolchain, release, or compiler support. type: feature New API, behavior, platform support, or user-facing capability. labels May 20, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

area: tooling Developer tooling, package manifests, Tuist, scripts, formatting, or release tooling. platform: macOS macOS-specific behavior or support. type: build Build system, packaging, toolchain, release, or compiler support. type: feature New API, behavior, platform support, or user-facing capability.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant