From 728feea620ced6473a7db763d902262844611d81 Mon Sep 17 00:00:00 2001 From: Will Murphy Date: Wed, 29 Oct 2025 10:07:47 -0400 Subject: [PATCH] ci: use apple creds before pushing tags (#4313) We have had a few releases fail because the Apple credentials needed some sort of fix. These release were operationally more interesting because they failed after pushing a git tag (which effectively releases the golagn package). Therefore, try to use these creds early, before there's a tag pushed. Signed-off-by: Will Murphy --- .github/workflows/release.yaml | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml index 38c5a4395..a74f10376 100644 --- a/.github/workflows/release.yaml +++ b/.github/workflows/release.yaml @@ -19,6 +19,16 @@ jobs: with: persist-credentials: false + - name: Bootstrap environment + uses: ./.github/actions/bootstrap + + - name: Validate Apple notarization credentials + run: .tool/quill submission list + env: + QUILL_NOTARY_ISSUER: ${{ secrets.APPLE_NOTARY_ISSUER }} + QUILL_NOTARY_KEY_ID: ${{ secrets.APPLE_NOTARY_KEY_ID }} + QUILL_NOTARY_KEY: ${{ secrets.APPLE_NOTARY_KEY }} + - name: Check if running on main if: github.ref != 'refs/heads/main' # we are using the following flag when running `cosign blob-verify` for checksum signature verification: