fix(ci): sign macOS CLI with Developer ID

Cross-compiled darwin binaries ship with an invalid Bun signature, which breaks codesign verification and publisher-based allowlists. Sign them on macOS with the Developer ID certificate and hardened runtime, matching V2, then repack the release zips and publish the signed binaries to npm and Homebrew.

Refs #46313

.github/workflows/publish.yml

@@ -117,6 +117,88 @@ jobs:
     outputs:
       version: ${{ needs.version.outputs.version }}
 
+  sign-cli-macos:
+    needs:
+      - build-cli
+      - version
+    runs-on: macos-26
+    if: github.repository == 'anomalyco/opencode'
+    steps:
+      - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
+
+      - uses: apple-actions/import-codesign-certs@8f3fb608891dd2244cdab3d69cd68c0d37a7fe93 # v2.0.0
+        with:
+          keychain: build
+          p12-file-base64: ${{ secrets.APPLE_CERTIFICATE }}
+          p12-password: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
+
+      - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
+        with:
+          name: opencode-cli
+          path: packages/opencode/dist
+
+      - name: Setup git committer
+        id: committer
+        uses: ./.github/actions/setup-git-committer
+        with:
+          opencode-app-id: ${{ vars.OPENCODE_APP_ID }}
+          opencode-app-secret: ${{ secrets.OPENCODE_APP_SECRET }}
+
+      - name: Sign macOS CLI binaries
+        run: |
+          identity=$(security find-identity -v -p codesigning build.keychain | sed -n 's/.*"\(Developer ID Application:.*\)"/\1/p' | head -n 1)
+          if [ -z "$identity" ]; then
+            echo "Developer ID Application identity not found"
+            exit 1
+          fi
+
+          for name in opencode-darwin-arm64 opencode-darwin-x64 opencode-darwin-x64-baseline; do
+            file="packages/opencode/dist/$name/bin/opencode"
+            chmod +x "$file"
+            codesign \
+              --force \
+              --timestamp \
+              --options runtime \
+              --entitlements packages/opencode/script/entitlements.plist \
+              --sign "$identity" \
+              "$file"
+            codesign --verify --deep --strict --verbose=4 "$file"
+            codesign --display --requirements - "$file"
+          done
+
+      - name: Smoke test signed binary
+        run: ./packages/opencode/dist/opencode-darwin-arm64/bin/opencode --version
+
+      - name: Repack macOS CLI archives
+        working-directory: packages/opencode/dist
+        run: |
+          for name in opencode-darwin-arm64 opencode-darwin-x64 opencode-darwin-x64-baseline; do
+            rm -f "$name.zip"
+            (cd "$name/bin" && zip -r "../../$name.zip" *)
+          done
+
+      - name: Upload signed macOS CLI release assets
+        if: needs.version.outputs.release != ''
+        env:
+          GH_TOKEN: ${{ steps.committer.outputs.token }}
+        run: |
+          gh release upload "v${{ needs.version.outputs.version }}" \
+            packages/opencode/dist/opencode-darwin-arm64.zip \
+            packages/opencode/dist/opencode-darwin-x64.zip \
+            packages/opencode/dist/opencode-darwin-x64-baseline.zip \
+            --clobber \
+            --repo "${{ needs.version.outputs.repo }}"
+
+      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        with:
+          name: opencode-cli-signed-macos
+          path: |
+            packages/opencode/dist/opencode-darwin-arm64
+            packages/opencode/dist/opencode-darwin-x64
+            packages/opencode/dist/opencode-darwin-x64-baseline
+            packages/opencode/dist/opencode-darwin-*.zip
+          if-no-files-found: error
+
   sign-cli-windows:
     needs:
       - build-cli
@@ -405,6 +487,7 @@ jobs:
     needs:
       - version
       - build-cli
+      - sign-cli-macos
       - sign-cli-windows
       - build-electron
     if: always() && !failure() && !cancelled()
@@ -437,6 +520,14 @@ jobs:
           name: opencode-cli
           path: packages/opencode/dist
 
+      - name: Remove unsigned macOS CLI binaries
+        run: rm -rf packages/opencode/dist/opencode-darwin*
+
+      - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
+        with:
+          name: opencode-cli-signed-macos
+          path: packages/opencode/dist
+
       - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
         with:
           name: opencode-cli-windows

packages/opencode/script/entitlements.plist

@@ -0,0 +1,16 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+    <key>com.apple.security.cs.allow-jit</key>
+    <true/>
+    <key>com.apple.security.cs.allow-unsigned-executable-memory</key>
+    <true/>
+    <key>com.apple.security.cs.disable-executable-page-protection</key>
+    <true/>
+    <key>com.apple.security.cs.allow-dyld-environment-variables</key>
+    <true/>
+    <key>com.apple.security.cs.disable-library-validation</key>
+    <true/>
+</dict>
+</plist>