From c24dedcffe8339399b7788519ddeac73c74714aa Mon Sep 17 00:00:00 2001
From: 7418 <7418@openclaw.ai>
Date: Tue, 3 Mar 2026 01:30:09 +0800
Subject: [PATCH] =?UTF-8?q?fix:=20CI=20=E6=B7=BB=E5=8A=A0=20notarization?=
 =?UTF-8?q?=20=E5=87=AD=E8=AF=81=E9=A2=84=E6=A0=A1=E9=AA=8C=E6=AD=A5?=
 =?UTF-8?q?=E9=AA=A4?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

在打包前用 xcrun notarytool history 验证 APPLE_ID / APP_SPECIFIC_PASSWORD / TEAM_ID
凭证组合是否有效，提前暴露凭证配置问题。

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---
 .github/workflows/build.yml | 13 +++++++++++++
 1 file changed, 13 insertions(+)

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 474280d..8dc3fc1 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -79,6 +79,19 @@ jobs:
           printf '%s' "$MAC_CERT_P12_BASE64" | tr -d '\r\n' | base64 --decode > /tmp/cert.p12
           openssl pkcs12 -in /tmp/cert.p12 -passin pass:"$MAC_CERT_PASSWORD" -noout
 
+      - name: Validate notarization credentials
+        if: ${{ env.HAS_CERT == 'true' }}
+        env:
+          APPLE_ID: ${{ secrets.APPLE_ID }}
+          APPLE_APP_SPECIFIC_PASSWORD: ${{ secrets.APPLE_APP_SPECIFIC_PASSWORD }}
+          APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
+        run: |
+          echo "APPLE_ID len=${#APPLE_ID}, TEAM=$APPLE_TEAM_ID, APP_PWD len=${#APPLE_APP_SPECIFIC_PASSWORD}"
+          xcrun notarytool history \
+            --apple-id "$APPLE_ID" \
+            --password "$APPLE_APP_SPECIFIC_PASSWORD" \
+            --team-id "$APPLE_TEAM_ID" >/dev/null
+
       - name: Package for macOS (x64 + arm64)
         env:
           CSC_LINK: ${{ env.HAS_CERT == 'true' && '/tmp/cert.p12' || '' }}