fix(ci): add ad-hoc code signing to OSS release build (#466)

Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>

.github/workflows/release.yml

@@ -63,6 +63,11 @@ jobs:
           TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
           CMAKE_POLICY_VERSION_MINIMUM: "3.5"
 
+      - name: Verify code signature
+        run: |
+          codesign --verify --deep --strict --verbose=2 \
+            desktop/src-tauri/target/release/bundle/macos/Sprout.app
+
       - name: Locate build artifacts
         id: artifacts
         run: |

RELEASING.md

@@ -69,6 +69,17 @@ The release workflow currently builds for **macOS ARM64 only**
 (`darwin-aarch64`). Intel Mac (`darwin-x86_64`) support would require
 adding a matrix build to the workflow.
 
+## Code Signing (macOS)
+
+OSS release builds use **ad-hoc code signing** (`signingIdentity: "-"`)
+rather than a Developer ID certificate. This means the app is not
+notarized by Apple.
+
+On first launch, macOS Gatekeeper will block the app with a "damaged" or
+"unidentified developer" message. Users can bypass this by
+**right-clicking the app > Open** (or via System Settings > Privacy &
+Security). After the first launch the app will open normally.
+
 ---
 
 ## Auto-Updater

desktop/scripts/build-release-config.mjs

@@ -14,6 +14,10 @@ import { resolve } from "node:path";
 // 3. plugins.updater with the public key and endpoint from env vars.
 //    Both SPROUT_UPDATER_PUBLIC_KEY and SPROUT_UPDATER_ENDPOINT are required —
 //    the script fails if either is missing (OSS builds always ship with updater).
+// 4. bundle.macOS.signingIdentity = "-" for ad-hoc code signing. This
+//    prevents macOS Gatekeeper from rejecting the app as "damaged".
+//    Users will see the standard "unidentified developer" dialog on first
+//    launch, which they can bypass via right-click > Open.
 
 const outputConfigPath = resolve(
   process.cwd(),
@@ -37,6 +41,7 @@ const releaseConfig = {
   bundle: {
     macOS: {
       minimumSystemVersion: "10.15",
+      signingIdentity: "-",
     },
     createUpdaterArtifacts: true,
   },