build(release): notarize macos cli binaries

Author: ngutman

.github/workflows/release.yml

@@ -53,3 +53,8 @@ jobs:
           args: release --clean --config .goreleaser.yaml
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          MACOS_SIGN_P12: ${{ secrets.MACOS_SIGN_P12 }}
+          MACOS_SIGN_PASSWORD: ${{ secrets.MACOS_SIGN_PASSWORD }}
+          MACOS_NOTARY_ISSUER_ID: ${{ secrets.MACOS_NOTARY_ISSUER_ID }}
+          MACOS_NOTARY_KEY_ID: ${{ secrets.MACOS_NOTARY_KEY_ID }}
+          MACOS_NOTARY_KEY: ${{ secrets.MACOS_NOTARY_KEY }}

.goreleaser.yaml

@@ -32,5 +32,20 @@ archives:
       - goos: windows
         format: zip
 
+notarize:
+  macos:
+    - enabled: '{{ and (isEnvSet "MACOS_SIGN_P12") (isEnvSet "MACOS_NOTARY_ISSUER_ID") (isEnvSet "MACOS_NOTARY_KEY_ID") (isEnvSet "MACOS_NOTARY_KEY") }}'
+      ids:
+        - zen
+      sign:
+        certificate: "{{ .Env.MACOS_SIGN_P12 }}"
+        password: "{{ .Env.MACOS_SIGN_PASSWORD }}"
+      notarize:
+        issuer_id: "{{ .Env.MACOS_NOTARY_ISSUER_ID }}"
+        key_id: "{{ .Env.MACOS_NOTARY_KEY_ID }}"
+        key: "{{ .Env.MACOS_NOTARY_KEY }}"
+        wait: true
+        timeout: 20m
+
 checksum:
   name_template: checksums.txt

CHANGELOG.md

@@ -14,5 +14,6 @@
 - groups and users helper commands
 - JSON and plain TSV output modes
 - Makefile, CI workflow, and GoReleaser config
+- GitHub Release flow for signed and notarized macOS CLI binaries
 - usage, auth, development, and release documentation
 - MIT license

README.md

@@ -56,7 +56,13 @@ Public replies are intentionally not supported by this workflow unless code expl
 
 Choose one of the following options.
 
-### Option A: Build locally
+### Option A: Download a release binary
+
+Download the archive for your platform from GitHub Releases, extract it, and place `zen` somewhere on your `PATH`.
+
+For macOS releases, the published CLI binaries are intended to be signed and notarized by the release workflow.
+
+### Option B: Build locally
 
 ```bash
 git clone <your-repo-url>
@@ -70,7 +76,7 @@ This builds the binary to:
 ./bin/zen
 ```
 
-### Option B: Plain `go build`
+### Option C: Plain `go build`
 
 ```bash
 go build -o ./bin/zen ./cmd/zen

docs/releasing.md

@@ -9,6 +9,7 @@ This repo includes a GitHub Actions release workflow and a GoReleaser config.
 3. create a semver tag
 4. push the tag
 5. GitHub Actions builds release archives and checksums
+6. macOS release binaries are signed and notarized when the Apple secrets are configured
 
 ## Example
 
@@ -30,6 +31,51 @@ Configured in GoReleaser:
 - darwin amd64 / arm64
 - windows amd64 / arm64
 
+## macOS signing and notarization
+
+This repo is configured to sign and notarize the `darwin` CLI binaries during the normal GitHub Releases flow.
+
+The GoReleaser notarization block is enabled only when all required Apple secrets are present in GitHub Actions.
+
+### Apple prerequisites
+
+You need:
+
+- an Apple Developer account
+- a `Developer ID Application` certificate exported as `.p12`
+- the password for that `.p12`
+- an App Store Connect API key exported as `.p8`
+- the App Store Connect key ID
+- the App Store Connect issuer ID
+
+### GitHub Actions secrets
+
+Add these repository or organization secrets before cutting a release:
+
+- `MACOS_SIGN_P12` — base64-encoded `.p12` certificate contents
+- `MACOS_SIGN_PASSWORD` — password for the `.p12` (may be empty if you exported the `.p12` without one)
+- `MACOS_NOTARY_KEY` — base64-encoded `.p8` App Store Connect key contents
+- `MACOS_NOTARY_KEY_ID` — App Store Connect key ID
+- `MACOS_NOTARY_ISSUER_ID` — App Store Connect issuer UUID
+
+Example base64 commands:
+
+```bash
+base64 < Certificates.p12 | tr -d '\n'
+base64 < ApiKey_ABC123XYZ.p8 | tr -d '\n'
+```
+
+### Release result
+
+When those secrets are present:
+
+- Linux and Windows artifacts are built as before
+- macOS `amd64` and `arm64` binaries are signed before packaging
+- the macOS binaries are submitted to Apple for notarization
+- the notarized binaries are the ones included in the release archives
+
+If the secrets are not present, the release still works, but macOS artifacts will be unsigned and unnotarized.
+
 ## Manual re-release
 
 The workflow also supports `workflow_dispatch` with a tag input, for example:
@@ -46,8 +92,21 @@ If you want local GoReleaser snapshots, install GoReleaser and run:
 goreleaser release --snapshot --clean
 ```
 
+If the Apple environment variables are exported locally, the same config can sign and notarize macOS snapshot binaries as well.
+
 ## Notes
 
 - release archives are named `zencli_<version>_<os>_<arch>`
 - Windows artifacts are zipped
 - other platforms are archived as `.tar.gz`
+- notarization is configured for standalone CLI binaries, not app bundles or `.pkg` installers
+
+## Verifying a downloaded macOS binary
+
+After downloading and extracting a macOS release archive:
+
+```bash
+codesign --verify --verbose ./zen
+spctl --assess --type execute --verbose ./zen
+xattr -p com.apple.quarantine ./zen 2>/dev/null || true
+```