Fix MacOS signing and remove debug lines

Author: richardkoehler

.github/workflows/release.yml

@@ -86,27 +86,16 @@ jobs:
         run: |
           uv export --locked --format requirements.txt --no-dev --no-hashes --no-emit-project --no-emit-workspace --output-file constraints-briefcase.txt
 
-      - name: Debug pip index visibility (Windows)
-        shell: pwsh
-        env:
-          PIP_INDEX_URL: https://pypi.org/simple
-          PIP_EXTRA_INDEX_URL: ""
-          PIP_NO_CACHE_DIR: "1"
-        run: |
-          uv run python -m pip config debug
-          uv run python -m pip index versions PySide6 -i https://pypi.org/simple
-          Get-ChildItem Env: | Where-Object { $_.Name -like "PIP_*" } | Sort-Object Name
-
       - name: Briefcase create / build / package (msi)
         env:
           QT_QPA_PLATFORM: offscreen
           PIP_INDEX_URL: https://pypi.org/simple
           PIP_EXTRA_INDEX_URL: ""
           PIP_NO_CACHE_DIR: "1"
         run: |
-          uv run briefcase create windows app
-          uv run briefcase build windows app
-          uv run briefcase package windows -p msi
+          uv run briefcase create --no-input
+          uv run briefcase build --no-input
+          uv run briefcase package --no-input -p msi
 
       - name: Validate Windows signing secrets (optional gate)
         if: ${{ github.event_name == 'workflow_dispatch' && inputs.sign_artifacts }}
@@ -169,86 +158,20 @@ jobs:
         run: |
           uv export --locked --format requirements.txt --no-dev --no-hashes --no-emit-project --no-emit-workspace --output-file constraints-briefcase.txt
 
-      - name: Debug pip index visibility (macOS)
-        env:
-          PIP_INDEX_URL: https://pypi.org/simple
-          PIP_EXTRA_INDEX_URL: ""
-          PIP_NO_CACHE_DIR: "1"
-        run: |
-          uv run python -V
-          uv run python -m pip config debug
-          uv run python -m pip --version
-          uv run python -m pip debug --verbose | sed -n '1,120p'
-          uv run python -m pip index versions PySide6 -i https://pypi.org/simple
-          uv run python -m pip index versions PySide6-Addons -i https://pypi.org/simple
-          uv run python -m pip index versions PySide6-Essentials -i https://pypi.org/simple
-          uv run python -m pip index versions shiboken6 -i https://pypi.org/simple
-          uv run python -m pip download --no-deps "pyside6==6.11.0" -i https://pypi.org/simple -d /tmp/pyside6-test
-          uv run python -m pip download --no-deps "pyside6-addons==6.11.0" -i https://pypi.org/simple -d /tmp/pyside6-test
-          uv run python -m pip download --no-deps "pyside6-essentials==6.11.0" -i https://pypi.org/simple -d /tmp/pyside6-test
-          uv run python -m pip download --no-deps "shiboken6==6.11.0" -i https://pypi.org/simple -d /tmp/pyside6-test
-          ls -la /tmp/pyside6-test
-          env | sort | grep '^PIP_' || true
-
-      - name: Debug constraints file (macOS)
-        run: |
-          ls -la constraints-briefcase.txt
-          sed -n '1,120p' constraints-briefcase.txt
-          grep -i '^pyside6' constraints-briefcase.txt || true
-
       - name: Briefcase create / build / package (dmg)
         env:
           QT_QPA_PLATFORM: offscreen
           PIP_INDEX_URL: https://pypi.org/simple
           PIP_EXTRA_INDEX_URL: ""
           PIP_NO_CACHE_DIR: "1"
         run: |
-          set -uo pipefail
-
-          probe_support_python() {
-            echo "---- Probing Briefcase macOS support-package Python ----"
-            # Briefcase unpacks the support package BEFORE running pip install, so even
-            # when `briefcase create` fails the interpreter should already be on disk.
-            support_python=$(find build -type f \( -name 'python3' -o -name 'python3.12' -o -name 'python3.13' -o -name 'python3.14' \) -path '*Support*' 2>/dev/null | head -n 1 || true)
-            if [ -z "${support_python}" ]; then
-              echo "No support-package Python found under build/ (searching more broadly)..."
-              find build -maxdepth 8 -type f -name 'python3*' 2>/dev/null | head -n 20 || true
-              return 0
-            fi
-            echo "Support python: ${support_python}"
-            "${support_python}" -V || true
-            "${support_python}" -c "import sys, sysconfig; print('sys.platform:', sys.platform); print('sysconfig.get_platform:', sysconfig.get_platform()); print('MACOSX_DEPLOYMENT_TARGET:', sysconfig.get_config_var('MACOSX_DEPLOYMENT_TARGET')); print('executable:', sys.executable); print('prefix:', sys.prefix)" || true
-            # Full list of platform tags the support-package pip will accept.
-            "${support_python}" -c "from pip._internal.utils.compatibility_tags import get_supported; [print(t) for t in get_supported()[:40]]" || true
-            echo "---- Support-package pip: index versions for PySide6 ----"
-            "${support_python}" -m pip index versions PySide6 -i https://pypi.org/simple || true
-            echo "---- Support-package pip: dry-run install PySide6==6.11.0 ----"
-            "${support_python}" -m pip install --dry-run --index-url https://pypi.org/simple "pyside6==6.11.0" -vvv 2>&1 | sed -n '1,80p' || true
-            echo "---- End support-package probe ----"
-          }
-
-          uv run briefcase create -v
-          status=$?
-          if [ "${status}" -ne 0 ]; then
-            echo "Briefcase create failed (exit ${status}); running support-package probe..."
-            probe_support_python
-            echo "Briefcase saved log (if any):"
-            ls -la logs 2>/dev/null || true
-            latest_log=$(ls -1t logs/briefcase.*.create.log 2>/dev/null | head -n 1 || true)
-            if [ -n "${latest_log}" ]; then
-              echo "---- Begin ${latest_log} ----"
-              sed -n '1,260p' "${latest_log}" || true
-              echo "---- End ${latest_log} ----"
-            fi
-            exit "${status}"
-          fi
-
-          # Create succeeded: probe anyway (cheap) so we can confirm the fix landed.
-          probe_support_python
-
-          set -e
-          uv run briefcase build -v
-          uv run briefcase package -v -p dmg
+          set -euo pipefail
+          uv run briefcase create --no-input
+          uv run briefcase build --no-input
+          # --adhoc-sign keeps `briefcase package` non-interactive when no Apple Developer
+          # ID is configured. When signing secrets ARE provided, the dedicated
+          # "Sign and notarize DMG" step below re-signs and notarizes the artifact.
+          uv run briefcase package --no-input --adhoc-sign -p dmg
 
       - name: Validate macOS signing secrets (optional gate)
         if: ${{ github.event_name == 'workflow_dispatch' && inputs.sign_artifacts }}
@@ -333,26 +256,16 @@ jobs:
         run: |
           uv export --locked --format requirements.txt --no-dev --no-hashes --no-emit-project --no-emit-workspace --output-file constraints-briefcase.txt
 
-      - name: Debug pip index visibility (Linux)
-        env:
-          PIP_INDEX_URL: https://pypi.org/simple
-          PIP_EXTRA_INDEX_URL: ""
-          PIP_NO_CACHE_DIR: "1"
-        run: |
-          uv run python -m pip config debug
-          uv run python -m pip index versions PySide6 -i https://pypi.org/simple
-          env | sort | grep '^PIP_' || true
-
       - name: Briefcase create / build / package (linux system)
         env:
           QT_QPA_PLATFORM: offscreen
           PIP_INDEX_URL: https://pypi.org/simple
           PIP_EXTRA_INDEX_URL: ""
           PIP_NO_CACHE_DIR: "1"
         run: |
-          uv run briefcase create linux system
-          uv run briefcase build linux system
-          uv run briefcase package linux system
+          uv run briefcase create linux system --no-input
+          uv run briefcase build linux system --no-input
+          uv run briefcase package linux system --no-input
 
       - name: Upload Briefcase Linux artifacts
         uses: actions/upload-artifact@v4