ci: allow signed-only cli mac builds

Author: morajabi

.github/workflows/cli-release.yml

@@ -11,6 +11,11 @@ on:
         description: "Optional comma-separated release targets override"
         required: false
         default: ""
+      skip_notarize:
+        description: "Skip macOS notarization and publish signed-only CLI binaries"
+        required: false
+        default: false
+        type: boolean
 
 concurrency:
   group: ${{ github.workflow }}
@@ -45,6 +50,7 @@ jobs:
           APPLE_NOTARIZATION_KEY: ${{ secrets.APPLE_NOTARIZATION_KEY }}
           APPLE_NOTARIZATION_KEY_ID: ${{ secrets.APPLE_NOTARIZATION_KEY_ID }}
           APPLE_NOTARIZATION_ISSUER: ${{ secrets.APPLE_NOTARIZATION_ISSUER }}
+          INLINE_SKIP_NOTARIZE: ${{ github.event.inputs.skip_notarize }}
         run: |
           set -euo pipefail
           supported=(
@@ -100,6 +106,11 @@ jobs:
             exit 1
           fi
 
+          skip_notarize=false
+          if [[ "${INLINE_SKIP_NOTARIZE}" == "true" || "${INLINE_SKIP_NOTARIZE}" == "1" ]]; then
+            skip_notarize=true
+          fi
+
           if [[ -z "${TARGETS_OVERRIDE}" || "${TARGETS_OVERRIDE}" == *apple-darwin* ]]; then
             has_api_key=false
             if [[ -n "${APPLE_NOTARIZATION_KEY:-}" && -n "${APPLE_NOTARIZATION_KEY_ID:-}" && -n "${APPLE_NOTARIZATION_ISSUER:-}" ]]; then
@@ -109,7 +120,7 @@ jobs:
             if [[ -n "${APPLE_ID:-}" && -n "${APPLE_PASSWORD:-}" && -n "${APPLE_TEAM_ID:-}" ]]; then
               has_apple_id=true
             fi
-            if [[ "${has_api_key}" != "true" && "${has_apple_id}" != "true" ]]; then
+            if [[ "${skip_notarize}" != "true" && "${has_api_key}" != "true" && "${has_apple_id}" != "true" ]]; then
               echo "Missing notarization credentials: provide APPLE_NOTARIZATION_KEY, APPLE_NOTARIZATION_KEY_ID, APPLE_NOTARIZATION_ISSUER or APPLE_ID, APPLE_PASSWORD, APPLE_TEAM_ID" >&2
               exit 1
             fi
@@ -314,6 +325,7 @@ jobs:
           APPLE_NOTARIZATION_KEY: ${{ secrets.APPLE_NOTARIZATION_KEY }}
           APPLE_NOTARIZATION_KEY_ID: ${{ secrets.APPLE_NOTARIZATION_KEY_ID }}
           APPLE_NOTARIZATION_ISSUER: ${{ secrets.APPLE_NOTARIZATION_ISSUER }}
+          INLINE_SKIP_NOTARIZE: ${{ github.event.inputs.skip_notarize }}
         run: |
           set -euo pipefail
           bun run scripts/release-cli.ts build

scripts/release-cli.ts

@@ -20,6 +20,8 @@ const appleTeamId = process.env.APPLE_TEAM_ID;
 const appleNotarizationKey = process.env.APPLE_NOTARIZATION_KEY;
 const appleNotarizationKeyId = process.env.APPLE_NOTARIZATION_KEY_ID;
 const appleNotarizationIssuer = process.env.APPLE_NOTARIZATION_ISSUER;
+const skipNotarize =
+  isTruthy(process.env.INLINE_SKIP_NOTARIZE) || isTruthy(process.env.SKIP_NOTARIZE);
 const defaultTargets = [
   "aarch64-apple-darwin",
   "x86_64-apple-darwin",
@@ -58,6 +60,10 @@ function trimSlash(value: string): string {
   return value.replace(/^\/+|\/+$/g, "");
 }
 
+function isTruthy(value: string | undefined): boolean {
+  return ["1", "true", "yes"].includes(value?.toLowerCase() ?? "");
+}
+
 function getR2Context() {
   const accessKeyId = requireEnv("PUBLIC_RELEASES_R2_ACCESS_KEY_ID");
   const secretAccessKey = requireEnv("PUBLIC_RELEASES_R2_SECRET_ACCESS_KEY");
@@ -361,7 +367,7 @@ async function signAndNotarize(context: ReleaseContext) {
     Boolean(appleNotarizationKeyId) &&
     Boolean(appleNotarizationIssuer);
   const hasAppleId = Boolean(appleId) && Boolean(applePassword) && Boolean(appleTeamId);
-  if (!hasApiKey && !hasAppleId) {
+  if (!skipNotarize && !hasApiKey && !hasAppleId) {
     throw new Error(
       "Missing notarization env vars: provide APPLE_NOTARIZATION_KEY, APPLE_NOTARIZATION_KEY_ID, APPLE_NOTARIZATION_ISSUER or APPLE_ID, APPLE_PASSWORD, APPLE_TEAM_ID",
     );
@@ -380,7 +386,8 @@ async function signAndNotarize(context: ReleaseContext) {
     10,
   );
 
-  const keyPath = hasApiKey ? join(context.releaseDir, "notarization-key.p8") : null;
+  const keyPath =
+    !skipNotarize && hasApiKey ? join(context.releaseDir, "notarization-key.p8") : null;
   if (keyPath && appleNotarizationKey) {
     await writeFile(keyPath, appleNotarizationKey, { mode: 0o600 });
   }
@@ -405,6 +412,15 @@ async function signAndNotarize(context: ReleaseContext) {
         { cwd: cliDir },
       );
 
+      await runCommand("codesign", ["--verify", "--strict", "--verbose=2", binaryPath], {
+        cwd: cliDir,
+      });
+
+      if (skipNotarize) {
+        console.log(`Skipping notarization for ${target} (INLINE_SKIP_NOTARIZE=1).`);
+        continue;
+      }
+
       await runCommand("zip", ["-j", "-X", zipPath, binaryPath], { cwd: cliDir });
 
       const args = notarytoolSubmitArgs(zipPath, keyPath);
@@ -440,9 +456,6 @@ async function signAndNotarize(context: ReleaseContext) {
         await sleep(delay);
       }
 
-      await runCommand("codesign", ["--verify", "--strict", "--verbose=2", binaryPath], {
-        cwd: cliDir,
-      });
     }
   } finally {
     if (keyPath) {