@@ -111,6 +111,13 @@ jobs:
111111 security set-key-partition-list -S apple-tool:,apple: \
112112 -s -k "$KEYCHAIN_PASSWORD" build.keychain
113113
114+ # Only expose the signing identity when a certificate was actually imported.
115+ # If this step is skipped, APPLE_SIGNING_IDENTITY is never set, so Tauri
116+ # will not attempt to call codesign at all.
117+ - name : Set Apple signing identity
118+ if : matrix.platform == 'macos' && env.APPLE_CERTIFICATE != ''
119+ run : echo "APPLE_SIGNING_IDENTITY=${{ secrets.APPLE_SIGNING_IDENTITY }}" >> $GITHUB_ENV
120+
114121 # ── Tauri build ──────────────────────────────────────────────────────────
115122 - name : Build Tauri app
116123 uses : tauri-apps/tauri-action@v0
@@ -120,7 +127,9 @@ jobs:
120127 APPLE_ID : ${{ secrets.APPLE_ID }}
121128 APPLE_PASSWORD : ${{ secrets.APPLE_PASSWORD }}
122129 APPLE_TEAM_ID : ${{ secrets.APPLE_TEAM_ID }}
123- APPLE_SIGNING_IDENTITY : ${{ secrets.APPLE_SIGNING_IDENTITY }}
130+ # APPLE_SIGNING_IDENTITY is injected into $GITHUB_ENV only when a
131+ # certificate was imported (see "Set Apple signing identity" step).
132+ # Omitting it here prevents codesign from running with an empty identity.
124133 # Tauri updater signing (optional — set to enable auto-updates)
125134 TAURI_SIGNING_PRIVATE_KEY : ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
126135 TAURI_SIGNING_PRIVATE_KEY_PASSWORD : ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
0 commit comments