Fix macOS release codesign failure caused by empty Apple secrets env vars

[Copilot]

The release (macos-latest, aarch64-apple-darwin, dmg,app) job was failing during the "Build and Release" step with:

security: SecKeychainItemImport: One or more parameters passed to a function were not valid.
failed to bundle project: failed codesign application: failed to run command security import: failed to import keychain certificate

This happened even though Flint intentionally ships unsigned macOS builds when no Apple signing secrets are configured.

Root cause

• tauri-bundler checks for a certificate via Rust's env::var_os("APPLE_CERTIFICATE"), which returns Some("") — not None — for an env var that GitHub Actions sets to an empty string.
• The workflow's "Build and Release" step set APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }} (and 5 related vars) unconditionally as step env:. With the secret unset, this created an empty-but-present env var.
• tauri-bundler treated the empty value as "a certificate was provided," tried to base64-decode it into a .p12, and called security import on the resulting empty file — which fails.

Fix

• .github/workflows/release.yml: the "Check Apple signing secrets" step now forwards APPLE_CERTIFICATE, APPLE_CERTIFICATE_PASSWORD, APPLE_SIGNING_IDENTITY, APPLE_ID, APPLE_PASSWORD, APPLE_TEAM_ID to $GITHUB_ENV only when APPLE_CERTIFICATE is genuinely non-empty.
• The "Build and Release" step no longer sets those six vars in its own env: block, so on an unsigned build they're truly absent from the process environment rather than empty strings — matching what var_os expects.

[Copilot]

🟡 Changes recommended

The new $GITHUB_ENV export uses single-line echo "APPLE_CERTIFICATE=$APPLE_CERTIFICATE" which will truncate/split multi-line base64 certificates, potentially breaking configured signing.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

This PR adjusts the macOS release workflow so unsigned builds don’t fail codesigning when Apple signing secrets are unset, by ensuring APPLE_* signing/notarization variables are absent (not present-as-empty) unless a real APPLE_CERTIFICATE is configured.

Changes:

• Updates the “Check Apple signing secrets” step to only export APPLE_* variables to $GITHUB_ENV when APPLE_CERTIFICATE is non-empty.
• Removes unconditional APPLE_* variables from the “Build and Release” step env: to prevent empty-but-present values from triggering tauri-bundler signing logic.

File summaries

File	Description
.github/workflows/release.yml	Prevents empty Apple secrets from being forwarded into the build environment, avoiding unintended macOS codesign/cert import attempts on unsigned releases.

Review details

• Files reviewed: 1/1 changed files
• Comments generated: 1
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.