Repository navigation
Conversation
Pinned to the release-toolkit branch adding bare binary support until that ships in a release. --- Generated with the help of Claude Code (Opus 5.5), https://code.claude.com
Suggested by Ian in #56 (comment). The action has no hardened runtime check, so that stays in the lane. `sh` merges stderr, so the `2>&1` and the comment justifying it were unnecessary. --- Generated with the help of Claude Code (Opus 5.5), https://code.claude.com
mokagio
added a commit
to wordpress-mobile/release-toolkit
that referenced
this pull request
Nov 6, 2026
A caller that verifies before notarizing passes `verify_notarization: false`, so nothing asserted the hardened runtime that notarization will later demand. beeper/cli#64 kept its own check for exactly this. The option defaults to `false` so existing callers are unaffected. Disk images are skipped with a warning rather than failed, because a list mixing an app with its `.dmg` is a normal call. --- Generated with the help of Claude Code (Opus 5.5), https://code.claude.com
4 tasks done
The `macos_verify_code_signing` action gained a `verify_hardened_runtime` option in wordpress-mobile/release-toolkit#782, so the lane no longer needs its own `codesign --display` check. --- Generated with the help of Claude Code (Opus 5.5), https://code.claude.com
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Replaces the hand-rolled signature checks in
verify_code_signingwith the shared release-toolkit action, as @iangmaia suggested on #56.Not mergeable yet: it depends on release-toolkit#782, which adds the bare binary support this needs.
Gemfilepins that branch until it ships in a release.Tradeoffs
fastlane-plugin-wpmreleasetoolkit, 92 lockfile lines includingnokogiriandoctokit, to replace about six lines of checks. No existing gem changes version.Gotchas
#63 edits this lane and uses
shellescape, while this PR removes therequire 'shellwords'line, so whichever lands second may need a small rebase.How to test
bundle exec fastlane verify_code_signing binary:<path>on variants of the notarized arm64 binary from build 17:The Buildkite build on this PR exercises the lane through
sign_and_notarize.