ci(one): only notarize when APPLE_ID + APPLE_PASSWORD are non-empty

Tauri triggers notarization whenever the env vars are defined,
even if their values are empty strings (as produced by an unset
GitHub secret). Unset them at the shell level when empty so the
build degrades to sign-only instead of failing with 401.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: os-zhuang

.github/workflows/one.yml

@@ -132,7 +132,16 @@ jobs:
           # macOS notarization (only triggered if APPLE_ID + APPLE_PASSWORD are set).
           APPLE_ID: ${{ secrets.APPLE_ID }}
           APPLE_PASSWORD: ${{ secrets.APPLE_PASSWORD }}
-        run: pnpm --filter @objectos/one tauri build --target ${{ matrix.target }}
+        shell: bash
+        run: |
+          set -euo pipefail
+          # Tauri treats any defined APPLE_ID/APPLE_PASSWORD as a request to
+          # notarize; unset them when empty so we just sign without notarizing.
+          if [ -z "${APPLE_ID:-}" ] || [ -z "${APPLE_PASSWORD:-}" ]; then
+            unset APPLE_ID APPLE_PASSWORD
+            echo "APPLE_ID/APPLE_PASSWORD not set — will sign without notarization."
+          fi
+          pnpm --filter @objectos/one tauri build --target ${{ matrix.target }}
 
       - name: Upload artifacts
         uses: actions/upload-artifact@v4