Keep empty signing secrets out of release builds

The v0.3.2 release proved that exporting blank CSC_LINK makes electron-builder treat the macOS project directory as a certificate path. The workflow now only exports CSC_LINK when the certificate secret is present and otherwise unsets signing variables before packaging.

Constraint: GitHub Actions exposes absent secrets as empty environment values when mapped directly
Rejected: Re-run v0.3.2 unchanged | release workflow fails before artifacts are uploaded
Confidence: high
Scope-risk: narrow
Directive: Do not expose blank CSC_LINK/CSC_KEY_PASSWORD to electron-builder; unset them when unsigned builds are intentional
Tested: node --test apps/macos/electron/*.test.cjs; npm run typecheck; ruby YAML parse for release.yml; git diff --check; unset CSC_LINK CSC_KEY_PASSWORD with CSC_IDENTITY_AUTO_DISCOVERY=false npm --workspace @paste/macos run dist -- --mac zip --arm64
Not-tested: Production Developer ID certificate signing path in GitHub Actions

Author: leeguooooo

.github/workflows/release.yml

@@ -16,9 +16,7 @@ jobs:
       matrix:
         arch: [x64, arm64]
     env:
-      CSC_LINK: ${{ secrets.MACOS_CERTIFICATE }}
-      CSC_KEY_PASSWORD: ${{ secrets.MACOS_CERTIFICATE_PASSWORD }}
-      CSC_IDENTITY_AUTO_DISCOVERY: ${{ secrets.MACOS_CERTIFICATE == '' && 'false' || 'true' }}
+      MACOS_CERTIFICATE_CONFIGURED: ${{ secrets.MACOS_CERTIFICATE == '' && 'false' || 'true' }}
       APPLE_API_KEY_ID: ${{ secrets.APPLE_API_KEY_ID }}
       APPLE_API_ISSUER: ${{ secrets.APPLE_API_ISSUER }}
     steps:
@@ -55,12 +53,27 @@ jobs:
           printf '%s' "${APPLE_API_KEY_CONTENT}" > "${key_path}"
           chmod 600 "${key_path}"
           echo "APPLE_API_KEY=${key_path}" >> "${GITHUB_ENV}"
-      - run: npm --workspace @paste/macos run dist -- --mac dmg zip --${{ matrix.arch }}
+      - name: Build macOS artifacts
+        shell: bash
+        env:
+          MACOS_CERTIFICATE: ${{ secrets.MACOS_CERTIFICATE }}
+          MACOS_CERTIFICATE_PASSWORD: ${{ secrets.MACOS_CERTIFICATE_PASSWORD }}
+        run: |
+          set -euo pipefail
+          if [[ -n "${MACOS_CERTIFICATE:-}" ]]; then
+            export CSC_LINK="${MACOS_CERTIFICATE}"
+            export CSC_KEY_PASSWORD="${MACOS_CERTIFICATE_PASSWORD:-}"
+            export CSC_IDENTITY_AUTO_DISCOVERY=true
+          else
+            unset CSC_LINK CSC_KEY_PASSWORD
+            export CSC_IDENTITY_AUTO_DISCOVERY=false
+          fi
+          npm --workspace @paste/macos run dist -- --mac dmg zip --${{ matrix.arch }}
       - name: Verify Developer ID signature when certificate is configured
         shell: bash
         run: |
           set -euo pipefail
-          if [[ -z "${CSC_LINK:-}" ]]; then
+          if [[ "${MACOS_CERTIFICATE_CONFIGURED}" != "true" ]]; then
             echo "MACOS_CERTIFICATE is not configured; macOS auto-update will stay disabled for this release."
             exit 0
           fi

apps/macos/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@paste/macos",
   "private": true,
-  "version": "0.3.2",
+  "version": "0.3.3",
   "type": "module",
   "main": "electron/main.cjs",
   "scripts": {

package-lock.json

@@ -1,7 +1,7 @@
 {
   "name": "pastyx",
   "private": true,
-  "version": "0.3.2",
+  "version": "0.3.3",
   "workspaces": [
     "apps/*",
     "packages/*"