release: dev → main (v2.0.0-alpha.1)

.github/workflows/release.yml

@@ -34,17 +34,40 @@ jobs:
         env:
           NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
+      - name: Import signing certificate
+        if: ${{ secrets.APPLE_CERTIFICATE != '' }}
+        env:
+          CERTIFICATE_BASE64: ${{ secrets.APPLE_CERTIFICATE }}
+          CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
+        run: |
+          KEYCHAIN_PATH=$RUNNER_TEMP/app-signing.keychain-db
+          KEYCHAIN_PASSWORD=$(openssl rand -base64 32)
+          security create-keychain -p "$KEYCHAIN_PASSWORD" "$KEYCHAIN_PATH"
+          security set-keychain-settings -lut 21600 "$KEYCHAIN_PATH"
+          security unlock-keychain -p "$KEYCHAIN_PASSWORD" "$KEYCHAIN_PATH"
+          echo "$CERTIFICATE_BASE64" | base64 --decode > $RUNNER_TEMP/certificate.p12
+          security import "$RUNNER_TEMP/certificate.p12" -P "$CERTIFICATE_PASSWORD" -A -t cert -f pkcs12 -k "$KEYCHAIN_PATH"
+          security list-keychain -d user -s "$KEYCHAIN_PATH"
+          security set-key-partition-list -S apple-tool:,apple: -s -k "$KEYCHAIN_PASSWORD" "$KEYCHAIN_PATH"
+          echo "KEYCHAIN_PATH=$KEYCHAIN_PATH" >> $GITHUB_ENV
+          echo "KEYCHAIN_PASSWORD=$KEYCHAIN_PASSWORD" >> $GITHUB_ENV
+
       - name: Build macOS arm64
         run: npm run make -- --platform darwin --arch arm64
         env:
-          # Code signing (optional)
-          # APPLE_ID: ${{ secrets.APPLE_ID }}
-          # APPLE_ID_PASSWORD: ${{ secrets.APPLE_ID_PASSWORD }}
-          # APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
-          # CSC_LINK: ${{ secrets.CSC_LINK }}
-          # CSC_KEY_PASSWORD: ${{ secrets.CSC_KEY_PASSWORD }}
+          APPLE_IDENTITY: ${{ secrets.APPLE_CERTIFICATE != '' && 'Developer ID Application: Andrew Chumchal (2TT36YTB8P)' || '' }}
+          APPLE_ID: ${{ secrets.APPLE_ID }}
+          APPLE_APP_SPECIFIC_PASSWORD: ${{ secrets.APPLE_APP_SPECIFIC_PASSWORD }}
+          APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
           NODE_ENV: production
 
+      - name: Clean up keychain
+        if: always()
+        run: |
+          if [ -n "$KEYCHAIN_PATH" ]; then
+            security delete-keychain "$KEYCHAIN_PATH" || true
+          fi
+
       - uses: actions/upload-artifact@v4
         with:
           name: openconduit-mac-arm64-${{ github.ref_name }}

packages/desktop/entitlements.plist

@@ -0,0 +1,10 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+  <key>com.apple.security.cs.allow-jit</key><true/>
+  <key>com.apple.security.cs.allow-unsigned-executable-memory</key><true/>
+  <key>com.apple.security.cs.disable-library-validation</key><true/>
+  <key>com.apple.security.network.client</key><true/>
+</dict>
+</plist>

packages/desktop/forge.config.ts

@@ -7,13 +7,30 @@ import { VitePlugin } from '@electron-forge/plugin-vite';
 import { FusesPlugin } from '@electron-forge/plugin-fuses';
 import { FuseV1Options, FuseVersion } from '@electron/fuses';
 
+const isMac = process.platform === 'darwin';
+
 const config: ForgeConfig = {
   packagerConfig: {
     asar: true,
     extraResource: ['icons'],
     name: 'OpenConduit',
     executableName: 'openconduit',
     icon: 'icons/icon', // .icns on macOS, .ico on Windows, .png on Linux
+    ...(isMac && process.env.APPLE_IDENTITY && {
+      osxSign: {
+        identity: process.env.APPLE_IDENTITY,
+        optionsForFile: () => ({
+          entitlements: 'entitlements.plist',
+          entitlementsInherit: 'entitlements.plist',
+          hardenedRuntime: true,
+        }),
+      },
+      osxNotarize: {
+        appleId: process.env.APPLE_ID!,
+        appleIdPassword: process.env.APPLE_APP_SPECIFIC_PASSWORD!,
+        teamId: process.env.APPLE_TEAM_ID!,
+      },
+    }),
   },
   rebuildConfig: {},
   makers: [

packages/desktop/package.json

@@ -1,7 +1,7 @@
 {
   "name": "openconduit",
   "productName": "OpenConduit",
-  "version": "1.2.2",
+  "version": "2.0.0-alpha.1",
   "description": "Cross-platform desktop AI chat client — OpenAI, Anthropic, LM Studio, and MCP tool servers",
   "main": ".vite/build/main.js",
   "private": true,
@@ -57,7 +57,7 @@
     "@anthropic-ai/sdk": "^0.96.0",
     "@google/genai": "^2.3.0",
     "@modelcontextprotocol/sdk": "^1.29.0",
-    "@openconduit/core": "^1.2.0",
+    "@openconduit/core": "^2.0.0-alpha.3",
     "@types/pdf-parse": "^1.1.5",
     "electron-squirrel-startup": "^1.0.1",
     "electron-store": "^11.0.2",