From 42c68e41536ef9ad008471091edddf3673aab7ab Mon Sep 17 00:00:00 2001
From: EMRG Evolution <emrg@argszero.dev>
Date: Thu, 6 Aug 2026 13:42:37 +0800
Subject: [PATCH] =?UTF-8?q?emrg:=20=E4=BF=AE=E5=A4=8D=20electron-builder?=
 =?UTF-8?q?=20=E5=85=AC=E8=AF=81=E5=8F=98=E9=87=8F=E5=90=8D=20=E2=80=94=20?=
 =?UTF-8?q?APPLE=5FAPP=5FSPECIFIC=5FPASSWORD=EF=BC=88=E7=AC=AC=208=20?=
 =?UTF-8?q?=E6=AC=A1=E6=9E=84=E5=BB=BA=E5=A4=B1=E8=B4=A5=E6=A0=B9=E5=9B=A0?=
 =?UTF-8?q?=EF=BC=89?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .github/workflows/build-release.yml | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/.github/workflows/build-release.yml b/.github/workflows/build-release.yml
index 75e801f3..3c85a7cf 100644
--- a/.github/workflows/build-release.yml
+++ b/.github/workflows/build-release.yml
@@ -133,6 +133,14 @@ jobs:
             export CSC_LINK="file:///tmp/signing.p12"
             export CSC_KEY_PASSWORD="$MACOS_SIGNING_P12_PASSWORD"
           fi
+          # macOS 公证：electron-builder 签名后自动 notarize .app（macPackager.js 源码：
+          # getNotarizeOptions 读 APPLE_ID + APPLE_APP_SPECIFIC_PASSWORD——不是我们
+          # 的 MACOS_NOTARY_APP_PASSWORD 变量名！缺失即报 "APPLE_APP_SPECIFIC_PASSWORD
+          # env var needs to be set"（第 8 次构建失败根因）。仅在 macOS + 公证 secret 就绪时导出。
+          if [ "$RUNNER_OS" = "macOS" ] && [ -n "${APPLE_ID:-}" ] && [ -n "${MACOS_NOTARY_APP_PASSWORD:-}" ] && [ -n "${MACOS_NOTARY_TEAM_ID:-}" ]; then
+            export APPLE_APP_SPECIFIC_PASSWORD="$MACOS_NOTARY_APP_PASSWORD"
+            export APPLE_TEAM_ID="$MACOS_NOTARY_TEAM_ID"
+          fi
           npm run dist
 
       # ── 捆绑 git/gh（§6 R59：macOS/Linux 源码编译，Windows portable）──