use sparrowwallet action for macos codesigning
What the developer wrote
Authored by Craig Raw
use sparrowwallet action for macos codesigning
What changed, and why it matters
This commit updates the project's automated build workflow to use a custom Sparrow Wallet action for signing and notarizing macOS releases. It is a routine CI/CD configuration change and does not contain any apparent security vulnerability.
No security action required. As a general hygiene measure, project maintainers may want to review the `sparrowwallet/github-actions/codesign-macos@v1` action's source and pin it to a specific commit hash rather than a floating `@v1` tag to reduce supply-chain risk, but this is not evidenced as an active issue in the commit.
Security signals we found
No strong security signals were identified.
Evidence from the diff
The diff modifies .github/workflows/package.yaml. It replaces a generic packaging step for Windows/macOS with a dedicated macOS codesigning and notarization step that calls sparrowwallet/github-actions/codesign-macos@v1 and passes several GitHub secrets (certificate, password, Apple ID, team ID, notarization password). Other packaging steps are renamed for clarity (Windows zip, Linux tar/deb, headless variants). The upload artifact path also excludes build/jpackage/Sparrow.app/. There is no code change to the application itself.
Changed components
.github/workflows/package.yamlInspect captured patch +16 / −6
diff --git a/.github/workflows/package.yaml b/.github/workflows/package.yaml
index d18d555..3472fa3 100644
--- a/.github/workflows/package.yaml
+++ b/.github/workflows/package.yaml
@@ -24,13 +24,22 @@ jobs:
run: ./gradlew -v
- name: Build with Gradle
run: ./gradlew jpackage
- - name: Package zip distribution
- if: ${{ runner.os == 'Windows' || runner.os == 'macOS' }}
+ - name: Codesign, package and notarize macOS distribution
+ if: ${{ runner.os == 'macOS' }}
+ uses: sparrowwallet/github-actions/codesign-macos@v1
+ with:
+ certificate: ${{ secrets.MACOS_CERTIFICATE }}
+ certificate-password: ${{ secrets.MACOS_CERTIFICATE_PASSWORD }}
+ apple-id: ${{ secrets.MACOS_NOTARIZATION_APPLE_ID }}
+ team-id: ${{ secrets.MACOS_NOTARIZATION_TEAM_ID }}
+ notarization-password: ${{ secrets.MACOS_NOTARIZATION_PASSWORD }}
+ - name: Package Windows zip distribution
+ if: ${{ runner.os == 'Windows' }}
run: ./gradlew packageZipDistribution
- - name: Package tar distribution
+ - name: Package Linux tar distribution
if: ${{ runner.os == 'Linux' }}
run: ./gradlew packageTarDistribution
- - name: Repackage deb distribution
+ - name: Repackage Linux deb distribution
if: ${{ runner.os == 'Linux' }}
run: ./repackage.sh
- name: Upload Artifact
@@ -40,13 +49,14 @@ jobs:
path: |
build/jpackage/*
!build/jpackage/Sparrow/
+ !build/jpackage/Sparrow.app/
- name: Headless build with Gradle
if: ${{ runner.os == 'Linux' }}
run: ./gradlew -Djava.awt.headless=true clean jpackage
- - name: Package headless tar distribution
+ - name: Package Linux headless tar distribution
if: ${{ runner.os == 'Linux' }}
run: ./gradlew -Djava.awt.headless=true packageTarDistribution
- - name: Repackage headless deb distribution
+ - name: Repackage Linux headless deb distribution
if: ${{ runner.os == 'Linux' }}
run: ./repackage.sh
- name: Upload Headless Artifact
Why this scored 15/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.