From 261d17c059318c87c4dc8c698493b9ba16b9e9cc Mon Sep 17 00:00:00 2001
From: 7418 <7418@openclaw.ai>
Date: Tue, 3 Mar 2026 00:57:57 +0800
Subject: [PATCH] =?UTF-8?q?fix:=20CI=20=E8=A7=A3=E7=A0=81=20base64=20?=
 =?UTF-8?q?=E8=AF=81=E4=B9=A6=E4=B8=BA=20.p12=20=E6=96=87=E4=BB=B6?=
 =?UTF-8?q?=E5=90=8E=E4=BC=A0=E7=BB=99=20CSC=5FLINK?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

electron-builder 把 base64 字符串当文件路径解析导致构建失败。
改为先 base64 --decode 写入 /tmp/cert.p12，CSC_LINK 指向文件路径。
同时加 HAS_CERT 环境变量控制签名/验证步骤的条件执行。

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---
 .github/workflows/build.yml | 11 ++++++++++-
 1 file changed, 10 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 46224b6..0311f36 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -54,6 +54,8 @@ jobs:
   build-macos:
     if: ${{ github.event_name == 'push' || inputs.platform == 'all' || inputs.platform == 'macos' }}
     runs-on: macos-latest
+    env:
+      HAS_CERT: ${{ secrets.MAC_CERT_P12_BASE64 != '' && 'true' || 'false' }}
     steps:
       - uses: actions/checkout@v4
 
@@ -68,9 +70,15 @@ jobs:
       - name: Build Electron app
         run: npm run electron:build
 
+      - name: Decode signing certificate
+        if: ${{ env.HAS_CERT == 'true' }}
+        env:
+          MAC_CERT_P12_BASE64: ${{ secrets.MAC_CERT_P12_BASE64 }}
+        run: echo "$MAC_CERT_P12_BASE64" | base64 --decode > /tmp/cert.p12
+
       - name: Package for macOS (x64 + arm64)
         env:
-          CSC_LINK: ${{ secrets.MAC_CERT_P12_BASE64 }}
+          CSC_LINK: ${{ env.HAS_CERT == 'true' && '/tmp/cert.p12' || '' }}
           CSC_KEY_PASSWORD: ${{ secrets.MAC_CERT_PASSWORD }}
           APPLE_ID: ${{ secrets.APPLE_ID }}
           APPLE_APP_SPECIFIC_PASSWORD: ${{ secrets.APPLE_APP_SPECIFIC_PASSWORD }}
@@ -78,6 +86,7 @@ jobs:
         run: npx electron-builder --mac --config electron-builder.yml --publish never
 
       - name: Verify code signature
+        if: ${{ env.HAS_CERT == 'true' }}
         run: |
           # Verify every .app bundle produced (arm64 + x64)
           APPS=$(find release -name "CodePilot.app" -maxdepth 3)