skills.rest
arthur-debert
arthur-debertCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

macos-signing-notarization

Automate macOS code signing and Apple notarization for Electron DMGs in GitHub Actions.

Updated May 1, 2026
Search Tags:#github actions#macos#electron#code signing#notarization#apple notarization#hardened runtime
One-click install
npx skills add https://github.com/arthur-debert/release --skill macos-signing-notarization
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: macos-signing-notarization
Source: https://github.com/arthur-debert/release/tree/main/skills/macos-signing-notarization
Command: npx skills add https://github.com/arthur-debert/release --skill macos-signing-notarization

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This Skill solves the CI reliability problem of producing macOS Electron artifacts that are both correctly code signed and accepted by Gatekeeper through Apple notarization, avoiding slow or opaque built-in notarization steps.

Core Features & Use Cases

  • Code signing for Electron artifacts: Uses a Developer ID Application certificate provided as base64 (p12) so the app bundle is signed deterministically by electron-builder during packaging.
  • Apple notarization via App Store Connect API key: Submits, polls, and staples the DMG using xcrun notarytool with AuthKey.p8 generated at runtime from secrets, avoiding Apple ID/password and 2FA issues in CI.
  • CI-friendly workflow steps with guardrails: Splits submit/poll/staple so you can see queue progress, applies a non-blocking notarization timeout, and ensures artifact release continues even if notarization is delayed.

Use case: You ship an Electron macOS app on every release and need a known-good workflow that handles certificate format pitfalls (legacy PKCS12), hardened runtime entitlements, and reliable notarization ticket stapling before uploads.

Quick Start

Add the three workflow steps (submit, poll, staple) after electron-builder packaging, using the required GitHub Actions secrets for the certificate and App Store Connect API key.

Frequently Asked Questions about macos-signing-notarization

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I automate Apple notarization for an Electron app in GitHub Actions without 2FA issues?▼

Automating Apple notarization in GitHub Actions requires submitting, polling, and stapling the DMG using an App Store Connect API key, which avoids Apple ID password and 2FA limitations in CI environments.

Why does my macOS code signing fail in CI when using a Developer ID p12 certificate?▼

macOS code signing in CI often fails due to certificate encryption formats; providing a base64-encoded Developer ID .p12 with legacy PKCS12 encryption ensures electron-builder can deterministically sign the app bundle.

Should I use the built-in electron-builder notarize option or split the notarization workflow steps?▼

Splitting notarization into separate submit, poll, and staple steps is better for CI, as it applies a non-blocking timeout and allows artifact release to continue even if the Apple notarization queue is delayed.

What configuration is needed for a hardened runtime Electron app before submitting for Apple notarization?▼

Before submitting for Apple notarization, your electron-builder configuration must have hardenedRuntime enabled and notarize set to false, while ensuring the App Store Connect API key is written to the runner's temporary directory.

What is the best way to staple a notarization ticket to a macOS DMG in a release pipeline?▼

The best way to staple a notarization ticket to a macOS DMG is using xcrun notarytool after polling completes, ensuring the hardened runtime artifact passes Gatekeeper checks upon distribution.

Related Skills

Explore More Legal & Compliance Skills→
yspreenyspreen
33

asc-notarization

Archive, export, and notarize macOS apps with xcodebuild and asc.

Community
Advanced
CaldisCaldis
21.1k

generate-sparkle-appcast

Generate Sparkle appcast.xml from notarized zips and publish bilingual release notes.

Community
Advanced
benjaminshafiibenjaminshafii
10

openwork-notary

Store Apple notarization credentials in macOS Keychain for OpenWork notarization workflows.

Community
Advanced
laststancelaststance
1

electron-release

Automate Electron release workflows from versioning to GitHub publication.

Official
Advanced