Fix macOS notarization skipped after adding second binary

[Soph]

https://entire.io/gh/entireio/cli/trails/478

Problem

v0.7.0 shipped macOS binaries that Gatekeeper kills on launch. Users hit it as Homebrew completion-generation failures:

Warning: Failed to generate bash completions ... was terminated by uncaught signal KILL.

The published entire and git-remote-entire binaries are only ad-hoc/linker-signed (Signature=adhoc, TeamIdentifier=not set); spctl assessment → rejected. They were never Developer-ID signed or notarized.

Root cause

Adding git-remote-entire (#1306) gave the GoReleaser builds explicit ids (entire, git-remote-entire). The notarize.macos block has no ids: field, so GoReleaser defaults it to [project_name] = [cli] (from the module github.com/entireio/cli).

Previously the single build had no explicit id, so it also defaulted to cli — they matched by accident. Once the builds were named, nothing matched cli and the notarize pipe skipped silently while the job stayed green:

• sign & notarize macOS binaries
  • pipe skipped or partially skipped   reason=no darwin binaries found with ids cli

Fix

• .goreleaser.yaml — pin notarize.macos.ids to both darwin builds (entire, git-remote-entire), with a comment documenting the footgun.
• .github/workflows/release.yml — add a fail-closed guard after GoReleaser: it inspects every darwin binary in dist/ and fails the release if any lacks a Developer ID signature, or if none are found. We can't run codesign/spctl on the Linux runner, so it greps the Mach-O for the embedded signing certificate subject (Developer ID Application), which is absent from ad-hoc binaries. Gated on a signing-availability check so forks without the cert secret aren't failed.

Notes

• Config-only — 0.7.0 itself can't be repaired; a new tagged release (0.7.1) is needed for users to get notarized binaries.
• Nightlies have shipped ad-hoc binaries since git-remote-entire: ship the remote helper in the CLI, on a shared contexts.json login #1306 merged too; this fixes all future builds.

Verification

• Confirmed against the published entire_darwin_arm64.tar.gz: both binaries ad-hoc only, spctl rejected.
• Traced the skip to the release run log (no darwin binaries found with ids cli).
• Diffed the v0.7.0-tagged config vs v0.6.3 to confirm the build-id rename is the trigger.

🤖 Generated with Claude Code

---

Note

Low Risk
Release pipeline and GoReleaser config only; no runtime app logic, and the new check is gated on signing secrets so forks without certs are unaffected.

Overview
Restores macOS Developer ID signing and notarization for both darwin artifacts (entire, git-remote-entire) after a second named build caused GoReleaser’s notarize step to silently skip (default ids no longer matched).

In .goreleaser.yaml, notarize.macos.ids is set explicitly to entire and git-remote-entire, with a comment explaining the default-id footgun.

In .github/workflows/release.yml, a signing-availability step gates a fail-closed post-release check: when MACOS_SIGN_P12 is present, every darwin binary in dist/artifacts.json must contain an embedded Developer ID Application certificate string (grep on Linux), or the job fails with actionable errors.

^{Reviewed by Cursor Bugbot for commit 73584a0. Configure here.}

[Copilot]

Pull request overview

Fixes a release pipeline footgun where GoReleaser’s macOS notarization step could silently skip after introducing a second named darwin build, resulting in ad-hoc signed binaries that Gatekeeper rejects.

Changes:

• Pin notarize.macos.ids in .goreleaser.yaml to explicitly include both darwin build IDs (entire, git-remote-entire) so the notarize pipe runs deterministically.
• Add a post-GoReleaser guard in .github/workflows/release.yml (only when signing secrets are present) to fail the release if any darwin binary lacks a Developer ID signature, or if none are found.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

File	Description
.goreleaser.yaml	Ensures notarization targets both macOS build IDs to prevent silent skipping.
.github/workflows/release.yml	Adds a fail-closed verification step to catch unsigned macOS binaries in release artifacts.