From 8ac74683c69956c0958209217acd32e3cf6d9ca9 Mon Sep 17 00:00:00 2001
From: Jack Amadeo <jackamadeo@block.xyz>
Date: Wed, 29 Jul 2026 13:27:34 -0400
Subject: [PATCH] fix(release): signing environment (#10797)

---
 .github/workflows/bundle-macos.yml   | 7 ++++++-
 .github/workflows/bundle-windows.yml | 7 ++++++-
 .github/workflows/release.yml        | 8 ++++++++
 3 files changed, 20 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/bundle-macos.yml b/.github/workflows/bundle-macos.yml
index cbf759fe3..86852668e 100644
--- a/.github/workflows/bundle-macos.yml
+++ b/.github/workflows/bundle-macos.yml
@@ -50,6 +50,11 @@ on:
         required: false
         default: false
         type: boolean
+      environment:
+        description: 'GitHub Environment containing signing secrets. Leave empty for unsigned builds.'
+        required: false
+        default: ''
+        type: string
       ref:
         description: 'Git ref to checkout (branch, tag, or SHA). Defaults to main branch if not specified.'
         required: false
@@ -190,7 +195,7 @@ jobs:
     if: ${{ inputs.package_desktop }}
     needs: build-goose
     runs-on: ${{ inputs.target == 'x86_64-apple-darwin' && 'macos-15-intel' || 'macos-latest' }}
-    environment: ${{ inputs.signing && 'signing' || null }}
+    environment: ${{ inputs.environment || '' }}
     env:
       MACOSX_DEPLOYMENT_TARGET: "12.0"
     permissions:
diff --git a/.github/workflows/bundle-windows.yml b/.github/workflows/bundle-windows.yml
index 805be2420..2c0aec877 100644
--- a/.github/workflows/bundle-windows.yml
+++ b/.github/workflows/bundle-windows.yml
@@ -47,6 +47,11 @@ on:
         required: false
         type: boolean
         default: false
+      environment:
+        description: 'GitHub Environment containing signing secrets. Leave empty for unsigned builds.'
+        required: false
+        type: string
+        default: ''
       ref:
         description: 'Git ref to checkout'
         required: false
@@ -284,7 +289,7 @@ jobs:
     needs: build-desktop-windows
     if: ${{ inputs.package_desktop && inputs.signing }}
     runs-on: windows-latest
-    environment: ${{ inputs.signing && 'signing' || null }}
+    environment: ${{ inputs.environment || '' }}
     permissions:
       id-token: write
     steps:
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 928837a92..d81d31c58 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -54,6 +54,8 @@ jobs:
       package_cli: true
       package_desktop: true
       signing: ${{ startsWith(github.ref, 'refs/tags/') }}
+      environment: ${{ startsWith(github.ref, 'refs/tags/') && 'signing' || '' }}
+    secrets: inherit
 
   # ------------------------------------------------------------
   # 4) Bundle CLI and Desktop (macOS x64)
@@ -67,6 +69,8 @@ jobs:
       package_cli: true
       package_desktop: true
       signing: ${{ startsWith(github.ref, 'refs/tags/') }}
+      environment: ${{ startsWith(github.ref, 'refs/tags/') && 'signing' || '' }}
+    secrets: inherit
 
   # ------------------------------------------------------------
   # 5) Bundle Desktop App (Linux)
@@ -86,6 +90,8 @@ jobs:
       package_cli: true
       package_desktop: true
       signing: ${{ startsWith(github.ref, 'refs/tags/') }}
+      environment: ${{ startsWith(github.ref, 'refs/tags/') && 'signing' || '' }}
+    secrets: inherit
 
   bundle-windows-cuda:
     uses: ./.github/workflows/bundle-windows.yml
@@ -96,7 +102,9 @@ jobs:
       package_cli: true
       package_desktop: true
       signing: ${{ startsWith(github.ref, 'refs/tags/') }}
+      environment: ${{ startsWith(github.ref, 'refs/tags/') && 'signing' || '' }}
       windows_variant: cuda
+    secrets: inherit
 
   # ------------------------------------
   # 7) Create/Update GitHub Release