chore(aaif): Switch macOS code signing (#8076)

ui/desktop/forge.config.ts

@@ -33,11 +33,28 @@ let cfg = {
       },
     ],
     // Usage descriptions for macOS TCC (Transparency, Consent, and Control)
-    NSCalendarsUsageDescription: 'Goose needs access to your calendars to help manage and query calendar events.',
-    NSRemindersUsageDescription: 'Goose needs access to your reminders to help manage and query reminders.',
+    NSCalendarsUsageDescription:
+      'Goose needs access to your calendars to help manage and query calendar events.',
+    NSRemindersUsageDescription:
+      'Goose needs access to your reminders to help manage and query reminders.',
   },
 };
 
+// macOS code signing and notarization via Electron Forge
+// Activated when APPLE_TEAM_ID is set (CI signing builds)
+if (process.env.APPLE_TEAM_ID) {
+  cfg.osxSign = {
+    keychain: process.env.KEYCHAIN_PATH || undefined,
+    entitlements: 'entitlements.plist',
+    'entitlements-inherit': 'entitlements.plist',
+  };
+  cfg.osxNotarize = {
+    appleId: process.env.APPLE_ID,
+    appleIdPassword: process.env.APPLE_ID_PASSWORD,
+    teamId: process.env.APPLE_TEAM_ID,
+  };
+}
+
 module.exports = {
   packagerConfig: cfg,
   rebuildConfig: {},
@@ -103,7 +120,7 @@ module.exports = {
           id: 'io.github.block.Goose',
           categories: ['Development'],
           icon: {
-            'scalable': 'src/images/icon.svg',
+            scalable: 'src/images/icon.svg',
             '512x512': 'src/images/icon-512.png',
           },
           homepage: 'https://block.github.io/goose/',
@@ -119,9 +136,9 @@ module.exports = {
                 'mkdir -p /app/lib',
                 // Point to the actual library in the 25.08 runtime
                 // We use a wildcard to handle multi-arch paths (x86_64-linux-gnu, etc)
-                'ln -s $(find /usr/lib -name "libbz2.so.1" | head -n 1) /app/lib/libbz2.so.1.0'
-              ]
-            }
+                'ln -s $(find /usr/lib -name "libbz2.so.1" | head -n 1) /app/lib/libbz2.so.1.0',
+              ],
+            },
           ],
           finishArgs: [
             '--share=ipc',
@@ -134,7 +151,7 @@ module.exports = {
             '--socket=session-bus',
             '--socket=system-bus',
             // This ensures the app looks in our shim folder first
-            '--env=LD_LIBRARY_PATH=/app/lib'
+            '--env=LD_LIBRARY_PATH=/app/lib',
           ],
         },
       },