From 00c4a9b82bb1c0795134e6ea6e4f5f02a3f383f7 Mon Sep 17 00:00:00 2001
From: EMRG Evolution <emrg@argszero.dev>
Date: Thu, 6 Aug 2026 10:20:03 +0800
Subject: [PATCH] =?UTF-8?q?emrg:=20macOS=20=E4=BB=A3=E7=A0=81=E7=AD=BE?=
 =?UTF-8?q?=E5=90=8D=20CI=20=E2=80=94=20=E8=AF=81=E4=B9=A6=E5=AF=BC?=
 =?UTF-8?q?=E5=85=A5=20+=20electron-builder=20codesign=20+=20pkg=20product?=
 =?UTF-8?q?sign=EF=BC=88rant=202026-08-06T10:06:55=20P1/P2=EF=BC=89?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .github/workflows/build-release.yml | 36 +++++++++++++++++++++++++++++
 emrg/gui/package.json               |  1 +
 2 files changed, 37 insertions(+)

diff --git a/.github/workflows/build-release.yml b/.github/workflows/build-release.yml
index 027b5366..76969ff5 100644
--- a/.github/workflows/build-release.yml
+++ b/.github/workflows/build-release.yml
@@ -49,6 +49,24 @@ jobs:
         with:
           node-version: "22"
 
+      # ── macOS 代码签名（rant 2026-08-06T10:06:55 P1/P2；Secret 未配则跳过降级）──
+      - name: Import signing certificate (macOS only)
+        if: runner.os == 'macOS' && secrets.MACOS_SIGNING_P12_BASE64 != ''
+        shell: bash
+        env:
+          MACOS_SIGNING_P12_BASE64: ${{ secrets.MACOS_SIGNING_P12_BASE64 }}
+          MACOS_SIGNING_P12_PASSWORD: ${{ secrets.MACOS_SIGNING_P12_PASSWORD }}
+        run: |
+          echo "$MACOS_SIGNING_P12_BASE64" | base64 --decode > /tmp/signing.p12
+          security create-keychain -p 'ci-temp' /tmp/ci.keychain
+          security set-keychain-settings -lut 21600 /tmp/ci.keychain
+          security unlock-keychain -p 'ci-temp' /tmp/ci.keychain
+          security import /tmp/signing.p12 -k /tmp/ci.keychain -P "$MACOS_SIGNING_P12_PASSWORD" \
+            -T /usr/bin/codesign -T /usr/bin/productsign
+          security set-key-partition-list -S apple-tool:,apple: -k 'ci-temp' /tmp/ci.keychain
+          security list-keychains -d user -s /tmp/ci.keychain $(security list-keychains -d user | tr -d '"')
+          security find-identity -v -p codesigning /tmp/ci.keychain
+
       # ── 回归门禁 ─────────────────────────────────────────────
       - name: Python tests (regression gate)
         run: |
@@ -80,6 +98,11 @@ jobs:
       - name: Build GUI (electron-builder)
         working-directory: emrg/gui
         shell: bash
+        env:
+          # macOS 签名：CSC_LINK+CSC_KEY_PASSWORD 激活 electron-builder 自动 codesign
+          # （含 hardened runtime；Secret 未配时为空 → 不签名，保持现状降级）
+          CSC_LINK: ${{ runner.os == 'macOS' && secrets.MACOS_SIGNING_P12_BASE64 != '' && 'file:///tmp/signing.p12' || '' }}
+          CSC_KEY_PASSWORD: ${{ runner.os == 'macOS' && secrets.MACOS_SIGNING_P12_PASSWORD || '' }}
         run: |
           npm ci
           npm run dist
@@ -94,6 +117,19 @@ jobs:
         shell: bash
         run: bash packaging/make-installer.sh
 
+      # ── pkg 签名（macOS only，P2；Secret 未配则跳过降级）──
+      - name: Sign pkg (macOS only)
+        if: runner.os == 'macOS' && secrets.MACOS_SIGNING_IDENTITY != ''
+        shell: bash
+        env:
+          MACOS_SIGNING_IDENTITY: ${{ secrets.MACOS_SIGNING_IDENTITY }}
+        run: |
+          PKG="$(ls dist/artifacts/EMRG-*-macos-*.pkg | head -1)"
+          if [ -z "$PKG" ]; then echo "no pkg found, skipping"; exit 0; fi
+          productsign --sign "$MACOS_SIGNING_IDENTITY" "$PKG" "${PKG}.signed"
+          mv "${PKG}.signed" "$PKG"
+          pkgutil --check-signature "$PKG" || true
+
       # ── 冒烟（§12，临时 HOME + 无 Python runner）────────────
       - name: Smoke test (R42 temp HOME)
         shell: bash
diff --git a/emrg/gui/package.json b/emrg/gui/package.json
index 4aab3b9b..e21b73d7 100644
--- a/emrg/gui/package.json
+++ b/emrg/gui/package.json
@@ -41,6 +41,7 @@
     "icon": "../packaging/assets/",
     "mac": {
       "identity": null,
+      "hardenedRuntime": true,
       "target": [
         {
           "target": "dir",