separate mac signing from notarization (#26)

Author: tarik02

.github/workflows/release.yml

@@ -469,14 +469,20 @@ jobs:
           }
 
           if [[ "${{ matrix.platform }}" == "mac" ]]; then
-            if has_all "$CSC_LINK" "$CSC_KEY_PASSWORD" "$APPLE_API_KEY" "$APPLE_API_KEY_ID" "$APPLE_API_ISSUER"; then
-              key_path="$RUNNER_TEMP/AuthKey_${APPLE_API_KEY_ID}.p8"
-              printf '%s' "$APPLE_API_KEY" > "$key_path"
-              export APPLE_API_KEY="$key_path"
+            if has_all "$CSC_LINK" "$CSC_KEY_PASSWORD"; then
+              if has_all "$APPLE_API_KEY" "$APPLE_API_KEY_ID" "$APPLE_API_ISSUER"; then
+                key_path="$RUNNER_TEMP/AuthKey_${APPLE_API_KEY_ID}.p8"
+                printf '%s' "$APPLE_API_KEY" > "$key_path"
+                export APPLE_API_KEY="$key_path"
+                echo "macOS notarization enabled."
+              else
+                unset APPLE_API_KEY APPLE_API_KEY_ID APPLE_API_ISSUER
+                echo "macOS notarization disabled (missing one or more Apple notarization secrets)."
+              fi
               echo "macOS signing enabled."
               args+=(--signed)
             else
-              echo "macOS signing disabled (missing one or more Apple signing secrets)."
+              echo "macOS signing disabled (missing code-signing certificate secrets)."
             fi
           elif [[ "${{ matrix.platform }}" == "win" ]]; then
             if has_all \

AGENTS.md

@@ -30,6 +30,7 @@ Long term maintainability is a core priority. If you add new functionality, firs
 - When making fork-only changes, update `FORK.md` in the same change so future upstream merges have current context.
 - Keep workflow-only fork changes narrow and prefer job-level disables over broad refactors.
 - Do not commit package version bumps solely to represent fork releases.
+- Keep macOS release signing separate from Apple notarization; do not require notarization secrets just to sign updater artifacts.
 - Re-check Electron updater channel behavior when changing version strings, release metadata, or desktop packaging.
 - Keep fork-only storage in `state-tarik02.sqlite` unless intentionally upstreaming it.
 - When preparing fork PRs, branch from `origin/main` and target `tarik02/t3code:main`.

FORK.md

@@ -9,6 +9,7 @@ This repository is a fork of `pingdotgg/t3code`. Keep this file focused on fork
 - Fork workflows disable scheduled releases, relay jobs, hosted deploys, and fork-unsafe publish paths.
 - Release builds publish updater metadata against the fork repository.
 - Fork release versions are derived in the release workflow so package manifests stay close to upstream.
+- macOS release signing is separate from Apple notarization.
 
 ### Desktop Updater Channels