fix(release): sign and notarize macOS downloads

[steipete]

macOS release binaries were only ad-hoc signed, so direct downloads failed Gatekeeper. Replace the tag-triggered publisher with the shared Go CLI release workflow pinned to v1.9.0 (f613cbfed2b043159c850c353e7facb8c89833b0), using Peter Steinberger's personal Developer ID identity and Apple notarization.

The workflow owns the annotated tag, immutable release payload, independent Intel/Apple Silicon verification, checksum-bound publication, and the steipete/homebrew-tap handoff. Existing archive names, checksums.txt, LICENSE/README.md members, and the blu executable stay compatible. Signing credentials are confined to the shared signing job.

Build on macOS and check every Darwin Mach-O deployment target after GoReleaser builds it. Both architectures must record macOS 12.0; regression tests reject newer/older targets, malformed commands, wrong platforms, and mixed slices. CI exercises this same build configuration without signing secrets. Document setup, release dispatch, and verification, and record the user-facing fix in Unreleased.

Validation: actionlint; GoReleaser configuration check; Python target-gate regression tests; Go race tests; golangci-lint; six-platform snapshot build with Go 1.26.8; independent P0–P2 review. Repository prerequisites are configured: protected main and Actions closeout PR permissions.

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

ClawSweeper review complete

ClawSweeper finished reviewing this revision. The review result is being finalized.

View the workflow run.

[clawsweeper]

Codex review: blocked before merge. Reviewed September 14, 2026, 11:13 AM ET / 15:13 UTC.

ClawSweeper review

What this changes

Replace tag-triggered releases with a pinned signing and notarization workflow, enforce macOS 12 deployment targets, and document release and download verification.

Merge readiness

⛔ Blocked before merge - 1 item remains

The signing fix remains useful: current main still uses the unsigned release pipeline, and no merged replacement was found. No blocking patch defect was identified; owner authorship and repository policy also preclude automatic closure.

Priority: P2
Reviewed head: d2d9319e14641c4e6ffb92e762bb76cd7fc0b911

Review scores

Measure	Result	What it means
Overall readiness	🐚 platinum hermit (4/6)	A focused, coherent release migration with compatible artifacts and useful validation; the first complete signed release remains operationally unobserved.
Proof confidence	🌊 off-meta tidepool	Not applicable: The ordinary contributor proof gate does not apply to this OWNER-authored PR. Supplied build validation covers the deployment-target gate, but does not establish an after-fix signed publication or Gatekeeper result; source inspection found no unresolved authority violation requiring the exceptional proof gate.
Patch quality	🐚 platinum hermit (4/6)	No actionable review findings were identified.

Verification

Check	Result	Evidence
Real behavior	Not applicable	Not applicable: The ordinary contributor proof gate does not apply to this OWNER-authored PR. Supplied build validation covers the deployment-target gate, but does not establish an after-fix signed publication or Gatekeeper result; source inspection found no unresolved authority violation requiring the exceptional proof gate.
Evidence reviewed	9 items	Repository policy: Read the complete root AGENTS.md; its prior-art and discovery guidance does not govern release signing. No nested AGENTS.md or maintainer-notes directory was found. Introduced change and dependency boundary: The verified merge-base-to-head patch replaces the publisher with an explicit call to openclaw/release-workflows at f613cbfed2b043159c850c353e7facb8c89833b0. This executable dependency establishes the need to inspect its signing, packaging, and publication contracts. Current-main necessity: Current main remains 5cc25b3. Its tag-triggered workflow runs GoReleaser without Apple signing credentials, and its configuration has no notarization stage. The repository pull-request listing contains no merged signing replacement.
Findings	None	None.
Security	None	None.

How this fits together

blucli’s release pipeline turns tagged Go source into downloadable archives and Homebrew updates. This change adds Apple signing and notarization between building binaries and publishing verified assets.

flowchart LR
  A[Manual release request] --> B[Protected source and CI checks]
  B --> C[Build six platform binaries]
  C --> D[Check macOS deployment targets]
  D --> E[Sign and notarize macOS binaries]
  E --> F[Independent artifact verification]
  F --> G[GitHub release and Homebrew update]

Loading

Before merge

• Resolve merge risk (P1) - Tag pushes will no longer publish releases: operators must use manual dispatch with the documented signing credentials and protected-branch prerequisites. The owner explicitly proposes this cutover, but its first complete signed publication is not demonstrated in the supplied evidence.

Agent review details

Security

None.

Review metrics

Metric	Value	Why it matters
Release gate code	production Python +53 lines; test Python +36 lines	The added script enforces the documented macOS minimum, with focused parser regression coverage.
Download compatibility	6 platform archive names preserved	Existing direct-download and package-manager naming contracts remain intact.

Merge-risk options

Maintainer options:

1. Adopt the documented release cutover (recommended)
   Accept the owner-proposed move to manual dispatch and retain signing, publication, and tap verification evidence from the first release.

Technical review

Best possible solution:

Adopt the owner-proposed dispatch workflow while preserving existing download contracts, and verify the first signed release through the documented Gatekeeper and Homebrew checks.

Do we have a high-confidence way to reproduce the issue?

No: source confirms that current main lacks the proposed signing pipeline, but this review did not reproduce Gatekeeper rejection with a quarantined v0.1.6 download.

Is this the best way to solve the issue?

Yes: the pinned shared workflow supplies the signing and verification stages while the caller preserves existing archives and enforces the stated macOS minimum.

AGENTS.md: found, but no applicable review policy affected this item.

Codex review notes: model internal, reasoning medium; reviewed against 5cc25b387e9f.

Labels

Label changes:

• add P2: This is a bounded release-distribution improvement addressing macOS download acceptance.
• add merge-risk: 🚨 automation: The patch replaces tag-triggered publishing with a credential-dependent manual release pipeline, requiring operators to adopt the documented cutover.
• add rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🌊 off-meta tidepool and patch quality is 🐚 platinum hermit.
• add status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Not applicable: The ordinary contributor proof gate does not apply to this OWNER-authored PR. Supplied build validation covers the deployment-target gate, but does not establish an after-fix signed publication or Gatekeeper result; source inspection found no unresolved authority violation requiring the exceptional proof gate.

Label justifications:

• P2: This is a bounded release-distribution improvement addressing macOS download acceptance.
• merge-risk: 🚨 automation: The patch replaces tag-triggered publishing with a credential-dependent manual release pipeline, requiring operators to adopt the documented cutover.
• rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🌊 off-meta tidepool and patch quality is 🐚 platinum hermit.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Not applicable: The ordinary contributor proof gate does not apply to this OWNER-authored PR. Supplied build validation covers the deployment-target gate, but does not establish an after-fix signed publication or Gatekeeper result; source inspection found no unresolved authority violation requiring the exceptional proof gate.

Evidence

What I checked:

• Repository policy: Read the complete root AGENTS.md; its prior-art and discovery guidance does not govern release signing. No nested AGENTS.md or maintainer-notes directory was found. (AGENTS.md:1, d2d9319e1464)
• Introduced change and dependency boundary: The verified merge-base-to-head patch replaces the publisher with an explicit call to openclaw/release-workflows at f613cbfed2b043159c850c353e7facb8c89833b0. This executable dependency establishes the need to inspect its signing, packaging, and publication contracts. (.github/workflows/release-unified.yml:21, d2d9319e1464)
• Current-main necessity: Current main remains 5cc25b3. Its tag-triggered workflow runs GoReleaser without Apple signing credentials, and its configuration has no notarization stage. The repository pull-request listing contains no merged signing replacement. (.github/workflows/release.yml:24, 5cc25b387e9f)
• Latest release and archive compatibility: The latest release is v0.1.6, containing six platform archives and checksums.txt. The proposed configuration preserves those filename templates, the blu executable, and LICENSE/README.md archive members. (.goreleaser.yaml:27, d2d9319e1464)
• Pinned signing and source controls: The dependency checks the protected default-branch head, freezes and rechecks the tag target, builds without signing credentials, selects Peter Steinberger’s Developer ID identity for personal repositories, and requires accepted notarization. Signing secrets also appear in the credential-presence preflight; they are not literally confined to the signing job as the PR body claims. (.github/workflows/release-go-cli.yml:287, f613cbfed2b0)
• Final publication boundary: Independent Intel and ARM verifiers check signatures and notarization without signing credentials. Publication compares both attestations, binds downloaded draft assets to their verified checksums, and rechecks the tag’s target before making the release public. (.github/workflows/release-go-cli.yml:2859, f613cbfed2b0)

Likely related people:

• unknown: The claimed source-line change could not be verified from bounded local history. (role: source history unknown; confidence: low)

Rating scale

Score	Internal tier	Crab rank	Meaning
6/6	S	🦀 challenger crab	Exceptional readiness
5/6	A	🦞 diamond lobster	Very strong readiness
4/6	B	🐚 platinum hermit	Good normal PR; ordinary maintainer review
3/6	C	🦐 gold shrimp	Useful, but confidence is limited
2/6	D	🦪 silver shellfish	Proof or implementation needs work
1/6	F	🧂 unranked krab	Not merge-ready
N/A	NA	🌊 off-meta tidepool	Rating does not apply

Overall follows the weaker of proof and patch quality.
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

Workflow

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.