From 6070f0cbb930370a694126bd35593290af716f3f Mon Sep 17 00:00:00 2001
From: James Maes <james@kof22.com>
Date: Tue, 16 Jun 2026 12:08:05 -0500
Subject: [PATCH] fix(ci): build ad-hoc until Apple cert provisioned

Release build inherited upstream's Developer ID and failed on CI (exit 65, no cert). Build ad-hoc when the release gate is not signing-ready; build_app.sh now forwards xcodebuild overrides. Auto-switches to signed when the owner adds the cert.
---
 .github/workflows/ci_cd.yml | 16 ++++++++++++----
 scripts/build_app.sh        |  2 +-
 2 files changed, 13 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/ci_cd.yml b/.github/workflows/ci_cd.yml
index e342417e..d7dc977d 100644
--- a/.github/workflows/ci_cd.yml
+++ b/.github/workflows/ci_cd.yml
@@ -142,10 +142,18 @@ jobs:
       # so a relock fails BEFORE any irreversible side-effect (PLAN §4.4). This is what keeps push
       # CI GREEN today on the signing-unprovisioned fork.
       - run: scripts/run_tests.sh
-      # build_app.sh needs no secrets (builds unsigned/ad-hoc when CODE_SIGN_IDENTITY is unset), so
-      # it runs on every push to prove the tree compiles — independent of the release gate.
-      - run: scripts/build_app.sh
-        if: github.event_name == 'push'
+      # alt-tab-free [depaywall]: build the Release product to prove the tree compiles. The fork
+      # inherits upstream's Developer ID via config/release.xcconfig (CODE_SIGN_IDENTITY), which is
+      # absent on CI until the owner provisions the Apple cert — so when the release gate is NOT
+      # signing-ready we build AD-HOC (CODE_SIGN_IDENTITY=-, signing not required, no timestamp) to
+      # prove the tree compiles without a cert. When the owner adds the secrets AND sets the fork's
+      # Developer ID in config/local.xcconfig, this builds signed for the release tail (PLAN §3.3/§4.3).
+      - name: build app (signed — owner cert provisioned)
+        if: github.event_name == 'push' && steps.release-gate.outputs.signing-ready == 'true'
+        run: scripts/build_app.sh
+      - name: build app (ad-hoc — until signing-provisioned)
+        if: github.event_name == 'push' && steps.release-gate.outputs.signing-ready != 'true'
+        run: scripts/build_app.sh CODE_SIGN_IDENTITY=- CODE_SIGNING_REQUIRED=NO OTHER_CODE_SIGN_FLAGS=--timestamp=none
       # --- Release tail: requires the owner's Apple Developer ID + Sparkle secrets. Skipped cleanly
       # (NOT failed) when they are absent, so push CI stays GREEN until the owner provisions them. ---
       - run: scripts/package_and_notarize_release.sh
diff --git a/scripts/build_app.sh b/scripts/build_app.sh
index 5163b6fb..16fbf32a 100755
--- a/scripts/build_app.sh
+++ b/scripts/build_app.sh
@@ -2,5 +2,5 @@
 
 set -ex
 
-set -o pipefail && xcodebuild -project alt-tab-macos.xcodeproj -scheme Release -derivedDataPath DerivedData | scripts/xcbeautify
+set -o pipefail && xcodebuild -project alt-tab-macos.xcodeproj -scheme Release -derivedDataPath DerivedData "$@" | scripts/xcbeautify
 file "$BUILD_DIR/$XCODE_BUILD_PATH/$APP_NAME.app/Contents/MacOS/$APP_NAME"