fix(release): signing environment (#10797)

.github/workflows/bundle-macos.yml

@@ -50,6 +50,11 @@ on:
         required: false
         default: false
         type: boolean
+      environment:
+        description: 'GitHub Environment containing signing secrets. Leave empty for unsigned builds.'
+        required: false
+        default: ''
+        type: string
       ref:
         description: 'Git ref to checkout (branch, tag, or SHA). Defaults to main branch if not specified.'
         required: false
@@ -190,7 +195,7 @@ jobs:
     if: ${{ inputs.package_desktop }}
     needs: build-goose
     runs-on: ${{ inputs.target == 'x86_64-apple-darwin' && 'macos-15-intel' || 'macos-latest' }}
-    environment: ${{ inputs.signing && 'signing' || null }}
+    environment: ${{ inputs.environment || '' }}
     env:
       MACOSX_DEPLOYMENT_TARGET: "12.0"
     permissions:

.github/workflows/bundle-windows.yml

@@ -47,6 +47,11 @@ on:
         required: false
         type: boolean
         default: false
+      environment:
+        description: 'GitHub Environment containing signing secrets. Leave empty for unsigned builds.'
+        required: false
+        type: string
+        default: ''
       ref:
         description: 'Git ref to checkout'
         required: false
@@ -284,7 +289,7 @@ jobs:
     needs: build-desktop-windows
     if: ${{ inputs.package_desktop && inputs.signing }}
     runs-on: windows-latest
-    environment: ${{ inputs.signing && 'signing' || null }}
+    environment: ${{ inputs.environment || '' }}
     permissions:
       id-token: write
     steps:

.github/workflows/release.yml

@@ -54,6 +54,8 @@ jobs:
       package_cli: true
       package_desktop: true
       signing: ${{ startsWith(github.ref, 'refs/tags/') }}
+      environment: ${{ startsWith(github.ref, 'refs/tags/') && 'signing' || '' }}
+    secrets: inherit
 
   # ------------------------------------------------------------
   # 4) Bundle CLI and Desktop (macOS x64)
@@ -67,6 +69,8 @@ jobs:
       package_cli: true
       package_desktop: true
       signing: ${{ startsWith(github.ref, 'refs/tags/') }}
+      environment: ${{ startsWith(github.ref, 'refs/tags/') && 'signing' || '' }}
+    secrets: inherit
 
   # ------------------------------------------------------------
   # 5) Bundle Desktop App (Linux)
@@ -86,6 +90,8 @@ jobs:
       package_cli: true
       package_desktop: true
       signing: ${{ startsWith(github.ref, 'refs/tags/') }}
+      environment: ${{ startsWith(github.ref, 'refs/tags/') && 'signing' || '' }}
+    secrets: inherit
 
   bundle-windows-cuda:
     uses: ./.github/workflows/bundle-windows.yml
@@ -96,7 +102,9 @@ jobs:
       package_cli: true
       package_desktop: true
       signing: ${{ startsWith(github.ref, 'refs/tags/') }}
+      environment: ${{ startsWith(github.ref, 'refs/tags/') && 'signing' || '' }}
       windows_variant: cuda
+    secrets: inherit
 
   # ------------------------------------
   # 7) Create/Update GitHub Release