chore(aaif): Switch macOS code signing (#8076)

.github/workflows/release.yml

@@ -8,9 +8,8 @@ on:
 
 name: Release
 
-# Permissions needed for AWS OIDC authentication in called workflows
 permissions:
-  id-token: write   # Required for AWS OIDC authentication in called workflow
+  id-token: write   # Required for Sigstore OIDC signing and AWS OIDC (Windows signing)
   contents: write   # Required for creating releases and by actions/checkout
   actions: read     # May be needed for some workflows
   attestations: write  # Required for SLSA build provenance attestations
@@ -50,8 +49,8 @@ jobs:
       contents: read
     with:
       signing: true
-    secrets:
-      OSX_CODESIGN_ROLE: ${{ secrets.OSX_CODESIGN_ROLE }}
+      environment: signing
+    secrets: inherit
 
   # ------------------------------------------------------------
   # 4) Bundle Desktop App (macOS)
@@ -63,8 +62,8 @@ jobs:
       contents: read
     with:
       signing: true
-    secrets:
-      OSX_CODESIGN_ROLE: ${{ secrets.OSX_CODESIGN_ROLE }}
+      environment: signing
+    secrets: inherit
 
   # ------------------------------------------------------------
   # 5) Bundle Desktop App (Linux)