From 5ccfda002e6326e3fb8f33f8762509991b26a878 Mon Sep 17 00:00:00 2001
From: TerrifiedBug <admin@terrifiedbug.com>
Date: Thu, 27 Aug 2026 20:33:52 +0100
Subject: [PATCH] ci: assert the Developer ID identity imported

security find-identity exits 0 even when it finds "0 valid identities",
so a p12 that imports but whose chain does not validate on the runner
sailed past the import step and failed deep inside build-release.sh.
Grep the identity out of the listing instead.
---
 .github/workflows/release.yml | 11 ++++++++++-
 CHANGELOG.md                  |  2 +-
 2 files changed, 11 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 28cec66..436c39e 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -81,6 +81,7 @@ jobs:
         env:
           APP_P12: ${{ secrets.DEVELOPER_ID_APP_P12_BASE64 }}
           P12_PASSWORD: ${{ secrets.DEV_ID_P12_PASSWORD }}
+          APP_IDENTITY: ${{ secrets.APP_IDENTITY }}
         run: |
           if [ -z "$APP_P12" ]; then
             echo "::error::DEVELOPER_ID_APP_P12_BASE64 is not set. Releases must be signed and notarized."
@@ -98,7 +99,15 @@ jobs:
           security set-key-partition-list -S apple-tool:,apple:,codesign: \
             -s -k "$KEYCHAIN_PW" "$KEYCHAIN" >/dev/null
           security list-keychains -d user -s "$KEYCHAIN" login.keychain
-          security find-identity -v -p codesigning "$KEYCHAIN"
+          # find-identity exits 0 even when it finds "0 valid identities", so a
+          # p12 that imports but whose chain does not validate here would sail
+          # past this step and fail confusingly inside build-release.sh.
+          IDENTITIES="$(security find-identity -v -p codesigning "$KEYCHAIN")"
+          echo "$IDENTITIES"
+          if ! grep -qF "$APP_IDENTITY" <<<"$IDENTITIES"; then
+            echo "::error::$APP_IDENTITY is not a valid codesigning identity in the build keychain."
+            exit 1
+          fi
 
       - name: Store notary credentials
         env:
diff --git a/CHANGELOG.md b/CHANGELOG.md
index ff8b238..55ee41a 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -14,4 +14,4 @@ All notable changes to Browseroute are documented here (Keep a Changelog style).
 
 - Developer ID-signed, notarized GitHub releases (same methodology as yap and TickerBar) and a Homebrew cask.
 - Sparkle EdDSA key baked in; Check for Updates is live on Developer ID-signed GitHub builds (ad-hoc and Homebrew stay off). The cert check runs after launch and does not hash sealed resources.
-- Release CI fails before notarize if `HOMEBREW_TAP_TOKEN` is missing, expired, or cannot push to the tap.
+- Release CI fails before notarize if `HOMEBREW_TAP_TOKEN` is missing, expired, or cannot push to the tap, or if the Developer ID identity does not validate in the build keychain.