ci(one): import Apple Developer ID cert + optional notarization

Adds a macOS-only 'Import Apple signing certificate' step that
provisions an ephemeral keychain from APPLE_CERTIFICATE (.p12 base64)
+ APPLE_CERTIFICATE_PASSWORD. The step no-ops if APPLE_CERTIFICATE
is empty, so the workflow still works without Apple secrets.

Passes APPLE_SIGNING_IDENTITY + APPLE_TEAM_ID + APPLE_ID +
APPLE_PASSWORD to 'tauri build'. Tauri v2 auto-detects:
- cert present, no APPLE_ID/PASSWORD → sign only
- cert + APPLE_ID + APPLE_PASSWORD → sign + notarize + staple

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: os-zhuang

.github/workflows/one.yml

@@ -80,6 +80,44 @@ jobs:
           TARGET_ARCH: ${{ matrix.target-arch }}
         run: pnpm --filter @objectos/one stage
 
+      - name: Import Apple signing certificate
+        if: runner.os == 'macOS'
+        env:
+          APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }}
+          APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
+        run: |
+          set -euo pipefail
+          if [ -z "${APPLE_CERTIFICATE:-}" ]; then
+            echo "APPLE_CERTIFICATE not set — skipping (build will be unsigned)."
+            exit 0
+          fi
+
+          KEYCHAIN="$RUNNER_TEMP/build.keychain-db"
+          KEYCHAIN_PASSWORD="$(openssl rand -base64 24)"
+          CERT_PATH="$RUNNER_TEMP/cert.p12"
+
+          echo "$APPLE_CERTIFICATE" | base64 --decode > "$CERT_PATH"
+
+          security create-keychain -p "$KEYCHAIN_PASSWORD" "$KEYCHAIN"
+          security set-keychain-settings -lut 21600 "$KEYCHAIN"
+          security unlock-keychain -p "$KEYCHAIN_PASSWORD" "$KEYCHAIN"
+
+          security import "$CERT_PATH" -k "$KEYCHAIN" \
+            -P "$APPLE_CERTIFICATE_PASSWORD" \
+            -T /usr/bin/codesign -T /usr/bin/security -T /usr/bin/productbuild
+
+          security set-key-partition-list \
+            -S apple-tool:,apple:,codesign: \
+            -s -k "$KEYCHAIN_PASSWORD" "$KEYCHAIN" >/dev/null
+
+          # Put new keychain first in the search list (keep existing ones too).
+          security list-keychains -d user -s "$KEYCHAIN" $(security list-keychains -d user | tr -d '"')
+
+          echo "Available signing identities:"
+          security find-identity -v -p codesigning "$KEYCHAIN"
+
+          rm -f "$CERT_PATH"
+
       - name: Build Tauri bundle
         env:
           # AppImage tools need FUSE on Linux; ubuntu-22.04 dropped it.
@@ -88,6 +126,12 @@ jobs:
           # Tauri updater key (no-password key generated via `signer generate --ci`).
           TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
           TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ""
+          # macOS code signing (only used if cert was imported above).
+          APPLE_SIGNING_IDENTITY: ${{ secrets.APPLE_SIGNING_IDENTITY }}
+          APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
+          # macOS notarization (only triggered if APPLE_ID + APPLE_PASSWORD are set).
+          APPLE_ID: ${{ secrets.APPLE_ID }}
+          APPLE_PASSWORD: ${{ secrets.APPLE_PASSWORD }}
         run: pnpm --filter @objectos/one tauri build --target ${{ matrix.target }}
 
       - name: Upload artifacts