🤖 Fix: macOS code signing with newline handling #80
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
The MACOS_CERTIFICATE secret contains newlines which caused electron-builder's internal base64 decoder to fail with: 'SecKeychainItemImport: Unknown format in import' Solution: Decode the certificate ourselves and provide a file path instead of using the base64: prefix. This approach: - Handles newlines in the base64 string correctly - Avoids electron-builder's internal decoder issues - Only sets CSC_LINK when the secret is available Tested successfully on debug-cert-format branch with both x64 and arm64 builds being signed correctly.
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Changed base64 --decode to base64 -D for macOS BSD compatibility.
Member
Author
|
@codex review |
|
Codex Review: Didn't find any major issues. Delightful! ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. |
ammario
added a commit
that referenced
this pull request
Oct 7, 2025
When Codex doesn't find any issues, it leaves a regular comment saying "Didn't find any major issues. Delightful!" These comments should not block PR merges since they indicate the code is good. Before: All regular Codex comments blocked merge After: Only actionable Codex comments block merge Fixes issue where PR #80 was blocked despite Codex approval. _Generated with `cmux`_
ammario
added a commit
that referenced
this pull request
Oct 7, 2025
## Problem When Codex reviews a PR and doesn't find any issues, it leaves a regular comment: > Codex Review: Didn't find any major issues. Delightful! The current `check_codex_comments.sh` script treats **all** regular Codex comments as blocking, including these "all clear" messages. This caused PR #80 to be blocked even though Codex approved it. ## Solution Filter out Codex comments that contain "Didn't find any major issues" so they don't block the merge. ## Testing - ✅ PR #80 (has "Delightful" comment): Now passes - ✅ PR #74 (has actual review comment): Still blocks correctly ## Changes - Updated `scripts/check_codex_comments.sh` to use `jq` filter that excludes "all clear" comments - Only actionable Codex feedback will now block PRs _Generated with `cmux`_
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Problem
The previous code signing attempts failed with:
Root Cause
The
MACOS_CERTIFICATEsecret contains 54 newlines (formatted at ~76 chars/line). When using thebase64:prefix, electron-builder's internal base64 decoder couldn't handle the newlines properly.Solution
Instead of relying on electron-builder's base64 decoder, we:
base64 --decode(which handles newlines correctly)CSC_LINKThis approach:
CSC_LINKwhen the secret is available (graceful fallback for unsigned builds)Testing
Successfully tested on the
debug-cert-formatbranch withCSC_FOR_PULL_REQUEST=true:Both x64 and arm64 builds were successfully signed.
Generated with
cmux