From f7be95dc6564dc3d2160fac5e213805d59424e60 Mon Sep 17 00:00:00 2001
From: fly1d <309400591+fly1d@users.noreply.github.com>
Date: Tue, 18 Aug 2026 20:59:17 +0800
Subject: [PATCH] ci: fail release early when signing secrets are missing

---
 .github/workflows/release.yml | 37 +++++++++++++++++++++++++++++++++++
 docs/releasing.md             |  2 ++
 2 files changed, 39 insertions(+)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 9bcf393..9643927 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -9,7 +9,44 @@ permissions:
   contents: write
 
 jobs:
+  preflight:
+    name: Verify signing configuration
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    permissions:
+      contents: read
+    steps:
+      - name: Check required Apple secrets
+        env:
+          APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }}
+          APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
+          APPLE_SIGNING_IDENTITY: ${{ secrets.APPLE_SIGNING_IDENTITY }}
+          APPLE_ID: ${{ secrets.APPLE_ID }}
+          APPLE_PASSWORD: ${{ secrets.APPLE_PASSWORD }}
+          APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
+        shell: bash
+        run: |
+          set -euo pipefail
+          missing=()
+          for secret_name in \
+            APPLE_CERTIFICATE \
+            APPLE_CERTIFICATE_PASSWORD \
+            APPLE_SIGNING_IDENTITY \
+            APPLE_ID \
+            APPLE_PASSWORD \
+            APPLE_TEAM_ID; do
+            if [[ -z "${!secret_name:-}" ]]; then
+              missing+=("$secret_name")
+            fi
+          done
+          if (( ${#missing[@]} > 0 )); then
+            printf 'Missing required release secrets: %s\n' "${missing[*]}"
+            exit 1
+          fi
+          echo "All required release secrets are configured."
+
   build-macos:
+    needs: preflight
     runs-on: macos-14
     timeout-minutes: 45
     steps:
diff --git a/docs/releasing.md b/docs/releasing.md
index 985a29a..3e33381 100644
--- a/docs/releasing.md
+++ b/docs/releasing.md
@@ -19,6 +19,8 @@ Public macOS artifacts should not be published without Apple signing and notariz
 - `APPLE_PASSWORD`
 - `APPLE_TEAM_ID`
 
+The release workflow checks that all six secrets are present before reserving a macOS runner. It never prints their values; a missing secret stops the workflow with the secret name and setup guidance.
+
 Unsigned builds are suitable only for local development and internal beta testing because Gatekeeper will warn users.
 
 ## Rollback