Fix notarize enabled template to return boolean#188
Conversation
Go template `and` returns the last truthy value (the raw env var content), not the string "true". GoReleaser checks for "true" specifically. Switch to `ne .Env.X ""` comparisons which return the boolean true/false that renders as the string "true"/"false".
There was a problem hiding this comment.
Pull request overview
This PR fixes a silent notarization bug in v0.2.2 where macOS code signing was being skipped despite all secrets being present. The root cause was that {{ and .Env.X .Env.Y }} in Go templates returns the last truthy value (the raw base64 string), not the boolean true, while GoReleaser's enabled field expects exactly the string "true". The fix switches to {{ and (ne .Env.X "") (ne .Env.Y "") }}, which correctly returns true/false. The PR also wires up the necessary workflow infrastructure (environment, timeout, secret verification) and aligns the install script's cosign verification to use the .bundle format that was introduced in PR #185.
Changes:
- Fix GoReleaser
enabledtemplate in.goreleaser.yamlto return a proper boolean usingne .Env.VAR ""comparisons instead of raw env var truthiness - Add the
releaseenvironment, bump timeout to 45 minutes, and add a pre-flight macOS secrets verification step to the release workflow - Update
scripts/install.shcosign verification to use the.bundleformat (dropping separate.sig/.pemfiles)
Reviewed changes
Copilot reviewed 1 out of 1 changed files in this pull request and generated no comments.
| File | Description |
|---|---|
.goreleaser.yaml |
Adds notarize.macos block with corrected boolean enabled template and all required signing/notarization fields |
.github/workflows/release.yml |
Adds environment: release, increases timeout to 45min, adds pre-flight macOS secrets check, and passes all 5 MACOS_* secrets to GoReleaser |
scripts/install.sh |
Updates cosign verification to download and use checksums.txt.bundle instead of separate .sig/.pem files |
RELEASING.md |
Documents the new environment secrets table and macOS signing step in the release pipeline description |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Summary
The
enabledfield in.goreleaser.yamlused{{ and .Env.X .Env.Y }}which returns the last truthy value (the raw base64 string), not"true". GoReleaser checks for the string"true"specifically, so notarization was silently skipped in v0.2.2 despite all secrets being present.Switch to
{{ and (ne .Env.X "") (ne .Env.Y "") }}which returns the booleantrue/false, rendering as the string GoReleaser expects.Verified locally:
reason=disabled)Follow-up to #185.