From f66b86ceec1a497417f750b88a06cf6923c5c75f Mon Sep 17 00:00:00 2001
From: Dax Raad <d@ironbay.co>
Date: Tue, 29 Sep 2026 15:33:27 -0400
Subject: [PATCH] fix(ci): sign macOS CLI with Developer ID

Cross-compiled darwin binaries ship with an invalid Bun signature, which breaks codesign verification and publisher-based allowlists. Sign them on macOS with the Developer ID certificate and hardened runtime, matching V2, then repack the release zips and publish the signed binaries to npm and Homebrew.

Refs #46313
---
 .github/workflows/publish.yml               | 91 +++++++++++++++++++++
 packages/opencode/script/entitlements.plist | 16 ++++
 2 files changed, 107 insertions(+)
 create mode 100644 packages/opencode/script/entitlements.plist

diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index c86a1fda135..d2c528e1720 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -117,6 +117,88 @@ jobs:
     outputs:
       version: ${{ needs.version.outputs.version }}
 
+  sign-cli-macos:
+    needs:
+      - build-cli
+      - version
+    runs-on: macos-26
+    if: github.repository == 'anomalyco/opencode'
+    steps:
+      - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
+
+      - uses: apple-actions/import-codesign-certs@8f3fb608891dd2244cdab3d69cd68c0d37a7fe93 # v2.0.0
+        with:
+          keychain: build
+          p12-file-base64: ${{ secrets.APPLE_CERTIFICATE }}
+          p12-password: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
+
+      - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
+        with:
+          name: opencode-cli
+          path: packages/opencode/dist
+
+      - name: Setup git committer
+        id: committer
+        uses: ./.github/actions/setup-git-committer
+        with:
+          opencode-app-id: ${{ vars.OPENCODE_APP_ID }}
+          opencode-app-secret: ${{ secrets.OPENCODE_APP_SECRET }}
+
+      - name: Sign macOS CLI binaries
+        run: |
+          identity=$(security find-identity -v -p codesigning build.keychain | sed -n 's/.*"\(Developer ID Application:.*\)"/\1/p' | head -n 1)
+          if [ -z "$identity" ]; then
+            echo "Developer ID Application identity not found"
+            exit 1
+          fi
+
+          for name in opencode-darwin-arm64 opencode-darwin-x64 opencode-darwin-x64-baseline; do
+            file="packages/opencode/dist/$name/bin/opencode"
+            chmod +x "$file"
+            codesign \
+              --force \
+              --timestamp \
+              --options runtime \
+              --entitlements packages/opencode/script/entitlements.plist \
+              --sign "$identity" \
+              "$file"
+            codesign --verify --deep --strict --verbose=4 "$file"
+            codesign --display --requirements - "$file"
+          done
+
+      - name: Smoke test signed binary
+        run: ./packages/opencode/dist/opencode-darwin-arm64/bin/opencode --version
+
+      - name: Repack macOS CLI archives
+        working-directory: packages/opencode/dist
+        run: |
+          for name in opencode-darwin-arm64 opencode-darwin-x64 opencode-darwin-x64-baseline; do
+            rm -f "$name.zip"
+            (cd "$name/bin" && zip -r "../../$name.zip" *)
+          done
+
+      - name: Upload signed macOS CLI release assets
+        if: needs.version.outputs.release != ''
+        env:
+          GH_TOKEN: ${{ steps.committer.outputs.token }}
+        run: |
+          gh release upload "v${{ needs.version.outputs.version }}" \
+            packages/opencode/dist/opencode-darwin-arm64.zip \
+            packages/opencode/dist/opencode-darwin-x64.zip \
+            packages/opencode/dist/opencode-darwin-x64-baseline.zip \
+            --clobber \
+            --repo "${{ needs.version.outputs.repo }}"
+
+      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        with:
+          name: opencode-cli-signed-macos
+          path: |
+            packages/opencode/dist/opencode-darwin-arm64
+            packages/opencode/dist/opencode-darwin-x64
+            packages/opencode/dist/opencode-darwin-x64-baseline
+            packages/opencode/dist/opencode-darwin-*.zip
+          if-no-files-found: error
+
   sign-cli-windows:
     needs:
       - build-cli
@@ -405,6 +487,7 @@ jobs:
     needs:
       - version
       - build-cli
+      - sign-cli-macos
       - sign-cli-windows
       - build-electron
     if: always() && !failure() && !cancelled()
@@ -437,6 +520,14 @@ jobs:
           name: opencode-cli
           path: packages/opencode/dist
 
+      - name: Remove unsigned macOS CLI binaries
+        run: rm -rf packages/opencode/dist/opencode-darwin*
+
+      - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
+        with:
+          name: opencode-cli-signed-macos
+          path: packages/opencode/dist
+
       - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
         with:
           name: opencode-cli-windows
diff --git a/packages/opencode/script/entitlements.plist b/packages/opencode/script/entitlements.plist
new file mode 100644
index 00000000000..afa54db33b9
--- /dev/null
+++ b/packages/opencode/script/entitlements.plist
@@ -0,0 +1,16 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+    <key>com.apple.security.cs.allow-jit</key>
+    <true/>
+    <key>com.apple.security.cs.allow-unsigned-executable-memory</key>
+    <true/>
+    <key>com.apple.security.cs.disable-executable-page-protection</key>
+    <true/>
+    <key>com.apple.security.cs.allow-dyld-environment-variables</key>
+    <true/>
+    <key>com.apple.security.cs.disable-library-validation</key>
+    <true/>
+</dict>
+</plist>