Fix(release): macOS signing survives electron-builder's keychain password bug

The macOS release job died inside code signing: electron-builder creates
a temporary keychain with a random password, then runs `security
set-key-partition-list -k` with the certificate's import password
instead. Older macOS let that slide on an already-unlocked keychain, and
2.43.0 signed fine two days ago on the same electron-builder 26.15.7; the
macOS 26.6 runner image now verifies the password and refuses
("SecKeychainUnlock: The user name or passphrase you entered is not
correct"). Upstream fixed it in electron-builder #10101 (issue #10066),
but the fix is missing from 26.16.0 and the v26 backport is unreleased.

Until a release carries it, the macOS job applies the same two-line
change to the installed app-builder-lib through a small script. The
script is idempotent, becomes a no-op once the installed copy has the
fix, and fails loudly if the file stops looking like either version so
it gets dropped rather than silently skipped. Local builds are untouched:
they sign from the login keychain and never enter this code path.

Claude-Session: https://claude.ai/code/session_015HNdWonTE8g6dPY2SkdsRS

Author: adibhanna

.github/workflows/release.yml

@@ -77,6 +77,17 @@ jobs:
       - name: Install dependencies
         run: npm ci
 
+      - name: Carry the electron-builder keychain fix
+        if: matrix.name == 'macOS'
+        # electron-builder 26.15 and 26.16 hand `security set-key-partition-list`
+        # the certificate's import password instead of the temporary keychain's
+        # own password; the macOS 26.6 runner image verifies it and signing
+        # dies with "SecKeychainUnlock: The user name or passphrase you entered
+        # is not correct". The fix is merged upstream (electron-builder #10101)
+        # but no v26 release carries it yet, so apply it to the installed copy.
+        # The script is a no-op once the installed version has the fix.
+        run: node tooling/scripts/patch-electron-builder-keychain.mjs
+
       - name: Verify mac signing secrets
         if: matrix.name == 'macOS'
         shell: bash

tooling/scripts/patch-electron-builder-keychain.mjs

@@ -0,0 +1,64 @@
+#!/usr/bin/env node
+/**
+ * Carry electron-builder's macOS keychain fix until a v26 release ships it.
+ *
+ * app-builder-lib 26.15 and 26.16 create a temporary signing keychain with a
+ * random password, then hand `security set-key-partition-list -k` the
+ * certificate's import password instead. Older macOS ignored the mismatch on
+ * an already-unlocked keychain; the macOS 26.6 runner image verifies it and
+ * signing dies with "SecKeychainUnlock: The user name or passphrase you
+ * entered is not correct" (electron-builder #10066). The fix (#10101) is
+ * merged upstream and backported to v26 but not published, so the release
+ * workflow applies the same two-line change to the installed copy. The script
+ * is idempotent and exits 0 without touching a copy that already carries the
+ * fix, so it can stay in the workflow past the upgrade; it fails loudly if the
+ * file no longer looks like either version, which is the cue to drop it.
+ *
+ * Usage: node tooling/scripts/patch-electron-builder-keychain.mjs [path/to/macCodeSign.js]
+ */
+import { existsSync, readFileSync, writeFileSync } from 'node:fs'
+import path from 'node:path'
+import { fileURLToPath } from 'node:url'
+
+const repoRoot = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..', '..')
+const candidates = [
+  path.join(repoRoot, 'apps', 'desktop', 'node_modules', 'app-builder-lib', 'out', 'codeSign', 'macCodeSign.js'),
+  path.join(repoRoot, 'node_modules', 'app-builder-lib', 'out', 'codeSign', 'macCodeSign.js')
+]
+const target = process.argv[2] ?? candidates.find((candidate) => existsSync(candidate))
+if (!target || !existsSync(target)) {
+  console.error('patch-electron-builder-keychain: app-builder-lib macCodeSign.js not found')
+  process.exit(1)
+}
+
+const source = readFileSync(target, 'utf8')
+const fixedCall = 'return await importCerts(keychainFile, certPaths, cscPasswords, keychainPassword);'
+if (source.includes(fixedCall)) {
+  console.log(`patch-electron-builder-keychain: already fixed, nothing to do (${target})`)
+  process.exit(0)
+}
+
+const replacements = [
+  ['return await importCerts(keychainFile, certPaths, cscPasswords);', fixedCall],
+  [
+    'async function importCerts(keychainFile, paths, keyPasswords) {',
+    'async function importCerts(keychainFile, paths, keyPasswords, keychainPassword) {'
+  ],
+  [
+    '["set-key-partition-list", "-S", "apple-tool:,apple:", "-s", "-k", password, keychainFile]',
+    '["set-key-partition-list", "-S", "apple-tool:,apple:", "-s", "-k", keychainPassword, keychainFile]'
+  ]
+]
+let patched = source
+for (const [from, to] of replacements) {
+  const occurrences = patched.split(from).length - 1
+  if (occurrences !== 1) {
+    console.error(
+      `patch-electron-builder-keychain: expected exactly one occurrence of ${JSON.stringify(from)}, found ${occurrences}; the installed app-builder-lib no longer matches the known bug, review and drop this script`
+    )
+    process.exit(1)
+  }
+  patched = patched.replace(from, to)
+}
+writeFileSync(target, patched)
+console.log(`patch-electron-builder-keychain: patched ${target}`)