From c6a674003fb12e22f38ec8581360f8ca8a737441 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=E7=A8=8B=E5=BA=8F=E5=91=98=E9=98=BF=E6=B1=9F=28Relakkes?= =?UTF-8?q?=29?= Date: Thu, 4 Jun 2026 00:29:21 +0800 Subject: [PATCH] fix(release): don't feed empty signing env to electron-builder MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit When the signing secrets are absent, `CSC_LINK`/`APPLE_*`/`WIN_CSC_*` render as empty strings. electron-builder treats a present (even empty) CSC_LINK as "a certificate is configured", tries to load it, resolves the empty path to the working dir and dies with " not a file" — which broke the v0.4.0 release build. Drop those env vars from the release build step so unsigned builds behave exactly like the (already-green) dev build, which only sets CSC_IDENTITY_AUTO_DISCOVERY=false. Add them back once an Apple Developer ID / Windows cert is available. Co-Authored-By: Claude Opus 4.8 (1M context) --- .github/workflows/release-desktop.yml | 12 +++++------- 1 file changed, 5 insertions(+), 7 deletions(-) diff --git a/.github/workflows/release-desktop.yml b/.github/workflows/release-desktop.yml index b25bc29f..93c427ad 100644 --- a/.github/workflows/release-desktop.yml +++ b/.github/workflows/release-desktop.yml @@ -162,14 +162,12 @@ jobs: working-directory: desktop env: GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} + # 未签名发布：故意不传 CSC_LINK / APPLE_* / WIN_CSC_* 这些 env。 + # 当对应 secret 缺失时它们会被渲染成空字符串，而 electron-builder 一旦看到 + # CSC_LINK 这个 key 就会进入证书签名流程，把空路径当成证书去加载，最终报 + # " not a file" 而失败。拿到 Apple Developer ID / Windows 证书后， + # 再把对应签名 env 加回来即可开启签名 + 公证。 CSC_IDENTITY_AUTO_DISCOVERY: 'false' - CSC_LINK: ${{ secrets.MACOS_CERTIFICATE }} - CSC_KEY_PASSWORD: ${{ secrets.MACOS_CERTIFICATE_PASSWORD }} - APPLE_ID: ${{ secrets.APPLE_ID }} - APPLE_APP_SPECIFIC_PASSWORD: ${{ secrets.APPLE_APP_SPECIFIC_PASSWORD }} - APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }} - WIN_CSC_LINK: ${{ secrets.WINDOWS_CERTIFICATE }} - WIN_CSC_KEY_PASSWORD: ${{ secrets.WINDOWS_CERTIFICATE_PASSWORD }} run: bunx electron-builder ${{ matrix.builder_args }} --publish never - name: Verify packaged app structure