Skip to content

Add code signing support for XCFrameworks#844

Merged
Kyle-Ye merged 1 commit intomainfrom
feature/codesign-xcframework
Mar 25, 2026
Merged

Add code signing support for XCFrameworks#844
Kyle-Ye merged 1 commit intomainfrom
feature/codesign-xcframework

Conversation

@Kyle-Ye
Copy link
Collaborator

@Kyle-Ye Kyle-Ye commented Mar 24, 2026

Summary

  • Sign all 7 xcframeworks (main + 6 dependency stubs) with a self-signed "OpenSwiftUI" certificate during the release build
  • Import signing certificate from GitHub secrets via apple-actions/import-codesign-certs@v3
  • Gracefully skip signing when certificate is not available (external contributor PRs, manual builds)

Changes

  • Scripts/build_xcframework.sh — added signing step after xcframework creation
  • .github/actions/build-xcframework/action.yml — added certificate import step and new inputs
  • .github/workflows/release.yml — pass signing secrets to the composite action

Setup required

Add these GitHub repo secrets:

  • SIGNING_CERTIFICATE_BASE_64 — base64-encoded .p12 certificate
  • SIGNING_CERTIFICATE_PASSWORD — password for the .p12 file

Test plan

  • Verify release workflow still succeeds without secrets (signing skipped)
  • Add secrets and verify xcframeworks are signed in release
  • Verify signature with codesign -dv --verbose=4 OpenSwiftUI.xcframework

@augmentcode
Copy link

augmentcode bot commented Mar 24, 2026

🤖 Augment PR Summary

Summary: This PR adds optional code-signing for the generated XCFramework artifacts during the release build.

Changes:

  • Extends the build-xcframework composite action with inputs for a base64-encoded .p12 certificate and password.
  • Imports the signing certificate in CI using apple-actions/import-codesign-certs@v3 when provided.
  • Passes signing secrets from .github/workflows/release.yml into the composite action.
  • Runs codesign over the main XCFramework and dependency-stub XCFrameworks after building, and skips signing when no certificate is available.

🤖 Was this summary useful? React with 👍 or 👎

Copy link

@augmentcode augmentcode bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Review completed. 2 suggestions posted.

Fix All in Augment

Comment augment review to trigger a new review at any time.

@codecov
Copy link

codecov bot commented Mar 24, 2026

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 26.85%. Comparing base (cd9a5fc) to head (a99f773).
⚠️ Report is 1 commits behind head on main.

Additional details and impacted files
@@            Coverage Diff             @@
##             main     #844      +/-   ##
==========================================
- Coverage   26.85%   26.85%   -0.01%     
==========================================
  Files         671      671              
  Lines       43470    43470              
==========================================
- Hits        11675    11672       -3     
- Misses      31795    31798       +3     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

@Kyle-Ye Kyle-Ye requested a review from Mx-Iris as a code owner March 25, 2026 07:29
Add a reusable codesign-xcframework action that imports a signing
certificate and signs xcframeworks. Integrate it into the build and
release workflows.

Changes:
- .github/actions/codesign-xcframework — new reusable composite action
  that sets up a CI keychain, imports a .p12 cert, trusts it for code
  signing, and signs xcframeworks
- .github/actions/build-xcframework — call codesign action after build
- .github/workflows/release.yml — pass signing secrets
- .github/workflows/build_xcframework.yml — pass signing secrets

The signing certificate (self-signed, "OpenSwiftUI") is stored as
org-level GitHub secrets (SIGNING_CERTIFICATE_BASE_64 and
SIGNING_CERTIFICATE_PASSWORD). Signing is gracefully skipped when
secrets are not available.
@Kyle-Ye Kyle-Ye force-pushed the feature/codesign-xcframework branch from 1816363 to a99f773 Compare March 25, 2026 07:47
@Kyle-Ye Kyle-Ye merged commit 6e47bd6 into main Mar 25, 2026
10 checks passed
@Kyle-Ye Kyle-Ye deleted the feature/codesign-xcframework branch March 25, 2026 10:19
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant