From bb1c02125b30eeb537f8e840f2f29364258fc7d9 Mon Sep 17 00:00:00 2001
From: Illustar0 <me@illustar0.com>
Date: Tue, 22 Jul 2025 15:09:16 +0800
Subject: [PATCH] GHA CI: Add code signing to fix app launch crash on macOS

PR #23016.
---
 .github/workflows/ci_macos.yaml | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/ci_macos.yaml b/.github/workflows/ci_macos.yaml
index 6e3de936c..33737d09d 100644
--- a/.github/workflows/ci_macos.yaml
+++ b/.github/workflows/ci_macos.yaml
@@ -131,7 +131,15 @@ jobs:
           pushd build
           PACKAGE_RETRY=0
           while [ "$PACKAGE_RETRY" -lt "3" ]; do
-            macdeployqt "$appName.app" -dmg -no-strip
+            macdeployqt "$appName.app" -no-strip
+            # sign
+            xattr -cr "$appName.app"
+            codesign --force --sign - --options runtime \
+              "$appName.app/Contents/Frameworks"/* \
+              "$appName.app/Contents/MacOS/$appName" \
+              "$appName.app"
+            codesign --verify --deep --strict -v "$appName.app"
+            hdiutil create -fs HFS+ -srcfolder "$appName.app" -volname "$appName" "$appName.dmg"
             if [ -f "$appName.dmg" ]; then
               break
             fi